Power vulnerability positioning method, device, equipment and medium based on vulnerability fingerprint

Abstract

The present invention discloses a method, device, equipment and medium for locating power vulnerabilities based on vulnerability fingerprints. The method includes: real-time monitoring of specific network communication traffic of each system structure and calculating corresponding information entropy characteristics. If the monitoring finds that the information entropy characteristics deviate from the corresponding standard threshold range, it is determined that a network anomaly has occurred; when a network anomaly has occurred, the traffic characteristics of the abnormal network communication traffic are extracted, and similarity calculation is performed with the vulnerability fingerprints in a pre-established vulnerability fingerprint library. If a vulnerability fingerprint similar to the traffic characteristics of the abnormal network communication traffic exists in the vulnerability fingerprint library, it is determined that a power vulnerability exists; in the system structure corresponding to the abnormal network communication traffic, the potential vulnerability location associated with the transmission process of the abnormal network communication traffic is queried, and the potential vulnerability location is output. The above technical solution can accurately and comprehensively discover the vulnerability location in the power system.

Description

Technical Field

[0001] The present invention relates to the technical field of power system network security, and in particular to a power vulnerability locating method, device, equipment and medium based on vulnerability fingerprint. Background Art

[0002] With the continuous development of information and communication technologies, many industries have transformed their production and operation methods through high-speed information and communication channels, significantly improving production and operation efficiency. However, the large number of network infrastructure applications and the large amount of power equipment that exchange information via high-speed networks also provide opportunities for cyber attackers to launch cyber attacks, bringing many potential risks.

[0003] Especially with the construction of new power systems and the widespread use of technologies such as 5G communications and the Internet of Things, the network boundaries of power monitoring systems have become blurred, increasing network security risks.

[0004] In the existing technology, the discovery of network security vulnerabilities in power monitoring systems and power equipment mainly relies on vulnerability scanning tools and manual means. These methods are difficult to accurately and comprehensively discover the location of vulnerabilities. The main reason is that some vulnerabilities are obvious, but some are hidden. The above existing solutions are all directly targeted at the detection or scanning of network vulnerabilities themselves. They are more effective for known or obvious vulnerabilities, but difficult to discover when faced with hidden vulnerabilities. In particular, there are many network communication devices in the power system, and there are many locations where vulnerabilities may exist, making it very easy to overlook potential or hidden vulnerabilities. Summary of the Invention

[0005] Purpose of the invention: The present invention provides a method, device, equipment and medium for locating power vulnerabilities based on vulnerability fingerprints, aiming to solve the technical problem in the prior art that it is difficult to accurately and comprehensively discover the locations of vulnerabilities in the power system, especially the difficulty in discovering hidden vulnerabilities.

[0006] Technical solution: The present invention provides a power vulnerability locating method based on vulnerability fingerprints, comprising: obtaining specific network communication traffic of each system structure in a power monitoring system; monitoring the specific network communication traffic of each system structure in real time and calculating the corresponding information entropy characteristics; if the monitoring finds that the information entropy characteristics deviate from the corresponding standard threshold range, it is determined that a network anomaly has occurred, and the specific network communication traffic corresponding to the information entropy characteristics that deviate from the standard threshold range is queried and identified as abnormal network communication traffic; when a network anomaly is determined to have occurred, the traffic characteristics of the abnormal network communication traffic are extracted, and a similarity calculation is performed with the vulnerability fingerprints in a pre-established vulnerability fingerprint library; if there is a vulnerability fingerprint in the vulnerability fingerprint library that is similar to the traffic characteristics of the abnormal network communication traffic, it is determined that a power vulnerability exists; in the system structure corresponding to the abnormal network communication traffic, the potential vulnerability position associated with the transmission process of the abnormal network communication traffic is queried, and the potential vulnerability position is output.

[0007] Specifically, the system structure includes at least one of the following system layers: a network layer; a transport layer; and an application layer.

[0008] Specifically, the specific network communication traffic includes traffic of at least one of the following data types: IP address; network port; service content; network link; device or service operating time; and user access frequency.

[0009] Specifically, a corresponding information entropy calculation model is established for the specific network communication traffic of each system structure, the specific network communication traffic is collected within a unit time period, and the information entropy characteristics of the specific network communication traffic corresponding to the unit time period are calculated through the information entropy calculation model.

[0010] Specifically, a corresponding long-short-term memory network model is established and trained for the specific network communication traffic of each system structure. The predicted traffic for the current unit time period is predicted by the long-short-term memory network model, and the predicted traffic is compared with the corresponding abnormal network communication traffic. If the comparison result is outside a reasonable deviation range, the network anomaly is officially recognized, and the corresponding specific network communication traffic is officially recognized as abnormal network communication traffic; if the comparison result is within a reasonable deviation range, the network anomaly is no longer recognized, and the corresponding specific network communication traffic is no longer recognized as abnormal network communication traffic.

[0011] Specifically, the traffic features serving as the main components of abnormal network communication traffic are selected and extracted by a principal component analysis method.

[0012] Specifically, the traffic characteristics of the abnormal network communication traffic are taken as the first set, and the vulnerability fingerprints in the vulnerability fingerprint library are taken as the second set. The similarity value is calculated by dividing the intersection of the first set and the second set by the union of the first set and the second set. If the similarity value is higher than the similarity threshold, it is determined that the traffic characteristics of the abnormal network communication traffic are similar to the corresponding vulnerability fingerprint.

[0013] The present invention also provides a power vulnerability locating device based on vulnerability fingerprints, comprising: a flow acquisition unit, an abnormality identification unit, a similarity comparison unit and a vulnerability locating unit, wherein: the flow acquisition unit is used to obtain the specific network communication flow of each system structure in the power monitoring system; the abnormality identification unit is used to monitor the specific network communication flow of each system structure in real time and calculate the corresponding information entropy characteristics. If the monitoring finds that the information entropy characteristics deviate from the corresponding standard threshold range, it is determined that a network abnormality has occurred, and the specific network communication flow corresponding to the information entropy characteristics that deviate from the standard threshold range is queried and identified as abnormal network communication flow; the similarity comparison unit is used to extract the flow characteristics of the abnormal network communication flow when it is determined that a network abnormality has occurred, and perform similarity calculation with the vulnerability fingerprint in a pre-established vulnerability fingerprint library. If there is a vulnerability fingerprint in the vulnerability fingerprint library that is similar to the flow characteristics of the abnormal network communication flow, it is determined that a power vulnerability exists; in the system structure corresponding to the abnormal network communication flow, the potential vulnerability position associated with the transmission process of the abnormal network communication flow is queried, and the potential vulnerability position is output.

[0014] Specifically, the system structure includes at least one of the following system layers: a network layer; a transport layer; and an application layer.

[0015] Specifically, the specific network communication traffic includes traffic of at least one of the following data types: IP address; network port; service content; network link; device or service operating time; and user access frequency.

[0016] Specifically, the anomaly identification unit is used to establish a corresponding information entropy calculation model for the specific network communication traffic of each system structure, collect the specific network communication traffic within a unit time period, and calculate the information entropy characteristics of the specific network communication traffic corresponding to the unit time period through the information entropy calculation model.

[0017] Specifically, the abnormality identification unit is used to establish and train a corresponding long-short-term memory network model for the specific network communication traffic of each system structure, predict the predicted traffic of the current unit time period through the long-short-term memory network model, and compare the predicted traffic with the corresponding abnormal network communication traffic. If the comparison result is outside the reasonable deviation range, it is officially determined that a network abnormality has occurred, and the corresponding specific network communication traffic is officially identified as abnormal network communication traffic; if the comparison result is within the reasonable deviation range, the network abnormality is no longer identified, and the corresponding specific network communication traffic is no longer identified as abnormal network communication traffic.

[0018] Specifically, the similarity comparison unit is used to select and extract traffic features serving as principal components of abnormal network communication traffic through a principal component analysis method.

[0019] Specifically, the similarity comparison unit is used to take the traffic characteristics of the abnormal network communication traffic as the first set, and the vulnerability fingerprints in the vulnerability fingerprint library as the second set, and divide the intersection of the first set and the second set by the union of the first set and the second set to calculate a similarity value. If the similarity value is higher than the similarity threshold, it is determined that the traffic characteristics of the abnormal network communication traffic are similar to the corresponding vulnerability fingerprint.

[0020] The present invention also provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program executable by the processor. When the computer program is executed by the processor, any one of the power vulnerability location methods based on vulnerability fingerprints provided by the present invention is executed.

[0021] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any one of the power vulnerability locating methods based on vulnerability fingerprints provided by the present invention.

[0022] Beneficial effects: Compared with the prior art, the present invention has the following significant advantages: it can accurately and comprehensively discover the location of loopholes in the power system. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 This is a flow chart of the power vulnerability location method based on vulnerability fingerprint provided by the present invention. DETAILED DESCRIPTION

[0024] The technical solution of the present invention will be further described below with reference to the accompanying drawings.

[0025] See Figure 1 , which is a flow chart of the power vulnerability locating method based on vulnerability fingerprint provided by the present invention.

[0026] In an embodiment of the present invention, specific network communication traffic of each system structure in the power monitoring system is obtained.

[0027] In the embodiment of the present invention, the system structure includes at least one of the following system layers: a network layer; a transport layer; and an application layer.

[0028] In an embodiment of the present invention, the specific network communication traffic includes traffic of at least one of the following data types: IP address; network port; service content; network link (URL); running time of the device or service; and user access frequency.

[0029] In specific implementation, through active and passive collaborative multi-level and multi-granular power system detection solutions, information data of target equipment or services can be collected to identify information, data and traffic within the same network space (power equipment participating in the same network interaction).

[0030] In specific implementation, multi-level detection means that the power monitoring system performs detection at the network layer, transport layer and application layer.

[0031] In practice, network layer detection verifies the target device's liveness and operating system type. First, an ICMP echo request packet is sent to the target. Receiving an ICMP echo reply packet indicates that the target is alive. Furthermore, ICMP echo requests are sent to detect network asset information, test network connectivity, and analyze the returned TTL value to determine the target's operating system type.

[0032] In the specific implementation, transport layer detection: Since the data interaction between power equipment and power equipment is achieved through open ports, in terms of port detection, the TCP SYN Scan (TCP Synchronous Sequence Number Scan) solution is used to detect the target open ports, port services and operating systems. TCP SYN Scan scans the incomplete TCP three-way handshake connection process, that is, the detecting party and the detected object only complete the first two steps of the three-way handshake. Regardless of whether the port of the detected object is open, when performing the third step, the detecting party will send a RST data packet to actively disconnect from the detected object. The scanning speed of TCP half-connection scanning is fast and is not easily discovered by the target object. In addition, based on the port detection, the operating system type and model of the target detection object can be determined by analyzing the differences and characteristics of some fields in the SYN+ACK response data packet returned by the TCP half-connection scan.

[0033] In specific implementations, application-layer detection involves detecting operating system types and application services at the application layer. A constructed HTTP request packet is sent to the detected object. Upon receiving the request packet, the detected object responds with a specially formatted response packet. The Server field in the HTTP response packet header contains a description of the target object's operating system. Furthermore, the specific name, version, and other network asset information of the target object's web server are retrieved from the Server field in the HTTP response packet header and from characteristic keywords in the response body.

[0034] In practice, the transmission of system-structured information data within a power monitoring system includes traffic associated with specific data types, such as IP addresses, network ports, service content, network links, device or service uptime, and user access frequency. This traffic is known as specific network communication traffic. By monitoring this specific network communication traffic for anomalies, it's possible to more accurately determine potential network attacks, pinpoint vulnerabilities, and uncover hidden vulnerabilities.

[0035] In the specific implementation, more asset attribute information is obtained at the granularity of IP, port, service, URL, running time, user access frequency, vulnerability information, etc., providing a basis for subsequent active and passive collaborative detection. First, the pcap file can be regarded as a set P = {p 1 ...p p}, the i-th data frame in the set P is defined as p i =(x i , b i , t i ), where x i It is the data element group of the data frame (source IP, destination IP, source port, destination port, protocol number), b i is the number of bytes in the data frame, t i is the start time of data frame transmission, and the frame-level granularity is the element p in the set P i The elements in set P can be sorted according to t i Sort from small to large, and its subset is recorded as f=(x,b,d t , t), where x represents the data element, b represents the total number of bytes contained in the data frame in the subset, and d t is the duration, and t represents the time when the first data frame in the subset starts to be transmitted. It can be seen that the set P can be transformed into F = {f 1 ...f n}.

[0036] In an embodiment of the present invention, the specific network communication traffic of each system structure is monitored in real time and the corresponding information entropy characteristics are calculated. If the monitoring finds that the information entropy characteristics deviate from the corresponding standard threshold range (which can be set according to the actual application scenario), it is determined that a network anomaly has occurred, and the specific network communication traffic corresponding to the information entropy characteristics that deviate from the standard threshold range is queried and determined to be abnormal network communication traffic.

[0037] In an embodiment of the present invention, a corresponding information entropy calculation model is established for the specific network communication traffic of each system structure, the specific network communication traffic is collected within a unit time period (which can be set according to the actual application scenario), and the information entropy characteristics of the specific network communication traffic corresponding to the unit time period are calculated through the information entropy calculation model.

[0038] In practice, information entropy can be used to measure the degree of uncertainty or the average amount of information. In the process of anomaly detection, information entropy is used to identify abnormal patterns in a data set, that is, data points or sequences that are significantly different from normal data.

[0039] In specific implementation, the anomaly detection of information entropy usually first requires data modeling (that is, the information entropy calculation model in the present invention). During this process, a certain type of variable can be selected to characterize the characteristics of the measured data (specific network communication traffic). Generally, time, data volume, frequency, and time distribution or change rate of content can be selected (which can be selected according to actual conditions). Then, the specific network communication traffic in a unit time period is monitored, and the information entropy characteristics are calculated by the information entropy calculation model. The information entropy characteristics also characterize the degree of uncertainty of the specific network communication traffic in a unit time period or the average amount of information.

[0040] In specific implementations, by monitoring the information entropy of specific network communication traffic rather than screening for vulnerabilities themselves, it is possible to more accurately and in real time discover whether there are potential and hidden vulnerabilities.

[0041] In an embodiment of the present invention, a corresponding long short-term memory network model is established and trained for the specific network communication traffic of each system structure, and the predicted traffic of the current unit time period is predicted by the long short-term memory network model (LSTM), and the predicted traffic is compared with the corresponding abnormal network communication traffic. If the comparison result is outside a reasonable deviation range (which can be set according to the actual application scenario), it is officially recognized that a network anomaly has occurred, and the corresponding specific network communication traffic is officially recognized as abnormal network communication traffic; if the comparison result is within a reasonable deviation range, the network anomaly is no longer recognized, and the corresponding specific network communication traffic is no longer recognized as abnormal network communication traffic.

[0042] In specific implementation, in order to be able to more accurately and reasonably judge whether there are actual anomalies in network communication traffic, on the basis of information entropy, it is also possible to predict specific network communication traffic for the same unit time period, and compare the predicted value with the actual value, so as to further confirm whether there are anomalies, and avoid the difficulty of information entropy in correctly identifying periodic and normal changes in specific network communication traffic.

[0043] In specific implementations, abnormal traffic is confirmed through a long short-term memory network model (LSTM). First, the network traffic data is preprocessed to construct a training data set, where each training sample can be composed of several continuous time series. The parameters for constructing the LSTM time series prediction model can mainly include the characteristic dimensions of the input vector and output vector in the network, the number of hidden layers in the network, the number of hidden units in each layer, and the batch size used for training. Then, an LSTM neural network is constructed and trained on the training data set to obtain a time series prediction model based on LSTM to predict the next time series. The time series prediction model obtained above is used to predict the traffic sequence to be tested. After obtaining the predicted value, it is compared with the actual value to determine whether the traffic anomaly has occurred. If the comparison result is outside the reasonable deviation range, the network anomaly is officially confirmed to have occurred, and the corresponding specific network communication traffic (that is, the abnormal network communication traffic previously identified) is officially identified as abnormal network communication traffic.

[0044] In an embodiment of the present invention, when a network anomaly is determined to have occurred, the traffic characteristics of the abnormal network communication traffic are extracted, and a similarity calculation is performed with the vulnerability fingerprints in a pre-established vulnerability fingerprint library. If there is a vulnerability fingerprint in the vulnerability fingerprint library that is similar to the traffic characteristics of the abnormal network communication traffic, it is determined that a power vulnerability exists.

[0045] In a specific implementation, the traffic characteristics of the abnormal network communication traffic can generally be calculated for similarity with all vulnerability fingerprints in the vulnerability fingerprint library one by one.

[0046] In the embodiment of the present invention, the principal component analysis (PCA) method is used to select and extract traffic features serving as the principal components of abnormal network communication traffic.

[0047] In specific implementations, the principal component analysis method collects network traffic data and converts it into a numerical matrix, which includes various traffic features such as packet length, arrival time, source and destination IP addresses, port numbers, etc. The data is then standardized so that each column of features has zero mean and unit variance. By calculating the eigenvectors and eigenvalues ​​of the covariance matrix, it is possible to determine which directions (principal components) carry the most information in the data. Then, based on the size of the eigenvalues ​​(the size standard can be set according to the actual application scenario), the top k principal components are selected. These principal components represent the most important directions in the data.

[0048] In practice, PCA's benefit in traffic analysis lies in its ability to reduce data complexity while preserving the most information. This involves extracting a minimum number of principal components to reduce the dimensionality of the data space. The extracted principal components must maximize the characteristics of the original traffic data while minimizing the loss of information. This allows for the discovery of the most important characteristics of traffic while simultaneously reducing dimensionality.

[0049] In an embodiment of the present invention, the traffic characteristics of the abnormal network communication traffic are taken as the first set, and the vulnerability fingerprints in the vulnerability fingerprint library are taken as the second set. The intersection of the first set and the second set is divided by the union of the first set and the second set to calculate the similarity value. If the similarity value is higher than the similarity threshold (which can be set according to the actual application scenario), it is determined that the traffic characteristics of the abnormal network communication traffic are similar to the corresponding vulnerability fingerprint.

[0050] In a specific implementation, the main features of the abnormal traffic obtained can be used to calculate the similarity between the traffic features and the vulnerability fingerprint using the Jaccard similarity algorithm (the intersection of the first set and the second set is divided by the union of the first set and the second set to obtain the similarity value). That is, the larger the intersection between the first set and the second set, the higher the similarity between the two.

[0051] In an embodiment of the present invention, in a system structure corresponding to abnormal network communication traffic, a potential vulnerability location associated with a transmission process of the abnormal network communication traffic is queried, and the potential vulnerability location is output.

[0052] In specific implementation, the traffic characteristics of abnormal network communication traffic can generally be calculated one by one for similarity with all vulnerability fingerprints in the vulnerability fingerprint library. In some cases, the traffic characteristics of abnormal network communication traffic are similar to multiple vulnerability fingerprints. Among them, one or several vulnerability fingerprints with the most similarity or a fixed number of similarities (which can be set accordingly) are selected and identified as the vulnerability types existing in the power system.

[0053] In the specific implementation, based on the previous similarity calculation, the vulnerability fingerprints in the vulnerability fingerprint library that are similar to the abnormal traffic characteristics can be determined, that is, the type of vulnerability existing in the power system can be determined. According to the characteristics of the vulnerability type, that is, the attack target and attack method of the vulnerability type, combined with the ports, servers, target locations, etc. associated with the abnormal network communication traffic in the transmission process, corresponding screening can be performed to output the potential vulnerability location.

[0054] The present invention also provides a power vulnerability locating device based on vulnerability fingerprints, comprising: a flow acquisition unit, an abnormality identification unit, a similarity comparison unit and a vulnerability locating unit, wherein: the flow acquisition unit is used to obtain the specific network communication flow of each system structure in the power monitoring system; the abnormality identification unit is used to monitor the specific network communication flow of each system structure in real time and calculate the corresponding information entropy characteristics. If the monitoring finds that the information entropy characteristics deviate from the corresponding standard threshold range, it is determined that a network abnormality has occurred, and the specific network communication flow corresponding to the information entropy characteristics that deviate from the standard threshold range is queried and identified as abnormal network communication flow; the similarity comparison unit is used to extract the flow characteristics of the abnormal network communication flow when it is determined that a network abnormality has occurred, and perform similarity calculation with the vulnerability fingerprint in a pre-established vulnerability fingerprint library. If there is a vulnerability fingerprint in the vulnerability fingerprint library that is similar to the flow characteristics of the abnormal network communication flow, it is determined that a power vulnerability exists; in the system structure corresponding to the abnormal network communication flow, the potential vulnerability position associated with the transmission process of the abnormal network communication flow is queried, and the potential vulnerability position is output.

[0055] In the embodiment of the present invention, the system structure includes at least one of the following system layers: a network layer; a transport layer; and an application layer.

[0056] In an embodiment of the present invention, the specific network communication traffic includes traffic of at least one of the following data types: IP address; network port; service content; network link; running time of equipment or service; and user access frequency.

[0057] In an embodiment of the present invention, the abnormality identification unit is used to establish a corresponding information entropy calculation model for the specific network communication traffic of each system structure, collect the specific network communication traffic within a unit time period, and calculate the information entropy characteristics of the specific network communication traffic corresponding to the unit time period through the information entropy calculation model.

[0058] In an embodiment of the present invention, the abnormality identification unit is used to establish and train a corresponding long-short-term memory network model for the specific network communication traffic of each system structure, predict the predicted traffic of the current unit time period through the long-short-term memory network model, and compare the predicted traffic with the corresponding abnormal network communication traffic. If the comparison result is outside the reasonable deviation range, it is officially determined that a network abnormality has occurred, and the corresponding specific network communication traffic is officially identified as abnormal network communication traffic; if the comparison result is within the reasonable deviation range, the determination that a network abnormality has occurred is lifted, and the corresponding specific network communication traffic is no longer identified as abnormal network communication traffic.

[0059] In the embodiment of the present invention, the similarity comparison unit is used to select and extract traffic features serving as principal components of abnormal network communication traffic through a principal component analysis method.

[0060] In an embodiment of the present invention, the similarity comparison unit is used to take the traffic characteristics of the abnormal network communication traffic as the first set, and the vulnerability fingerprints in the vulnerability fingerprint library as the second set, and divide the intersection of the first set and the second set by the union of the first set and the second set to calculate a similarity value. If the similarity value is higher than the similarity threshold, it is determined that the traffic characteristics of the abnormal network communication traffic are similar to the corresponding vulnerability fingerprint.

[0061] The present invention also provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program executable by the processor. When the computer program is executed by the processor, any one of the power vulnerability location methods based on vulnerability fingerprints provided by the present invention is executed.

[0062] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any one of the power vulnerability locating methods based on vulnerability fingerprints provided by the present invention.

[0063] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0064] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0065] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0066] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

Claims

1. A power vulnerability location method based on vulnerability fingerprint, characterized in that: include: Acquiring specific network communication traffic of each system structure in the power monitoring system; the system structure includes at least one of the following system layers: a network layer; Transport layer; Application layer; A corresponding information entropy calculation model is established for the specific network communication traffic of each system structure, and the specific network communication traffic is monitored in real time and collected within a unit time period. The information entropy characteristics of the corresponding specific network communication traffic are calculated through the information entropy calculation model. If the monitoring finds that the information entropy characteristics deviate from the corresponding standard threshold range, it is determined that a network anomaly has occurred, and the specific network communication traffic corresponding to the information entropy characteristics that deviate from the standard threshold range is queried and identified as abnormal network communication traffic; a corresponding long-short-term memory network model is established and trained for the specific network communication traffic of each system structure, and the predicted traffic of the current unit time period is predicted through the long-short-term memory network model, and the predicted traffic is compared with the corresponding specific network communication traffic. If the comparison result is outside a reasonable deviation range, it is officially determined that a network anomaly has occurred, and the corresponding specific network communication traffic is officially identified as abnormal network communication traffic; if the comparison result is within a reasonable deviation range, the determination that the network anomaly has occurred is lifted, and the corresponding specific network communication traffic is no longer identified as abnormal network communication traffic; When a network anomaly is identified, the traffic characteristics of the abnormal network communication traffic are extracted and similarity is calculated with the vulnerability fingerprints in the pre-established vulnerability fingerprint library. If a vulnerability fingerprint similar to the traffic characteristics of the abnormal network communication traffic exists in the vulnerability fingerprint library, it is determined that a power vulnerability exists; In a system structure corresponding to the abnormal network communication traffic, a potential vulnerability position associated with a transmission process of the abnormal network communication traffic is searched, and the potential vulnerability position is output.

2. The power vulnerability location method based on vulnerability fingerprint according to claim 1 is characterized in that: The specific network communication traffic includes traffic of at least one of the following data types: IP address; network port; service content; network link; running time of equipment or service; and user access frequency.

3. The power vulnerability location method based on vulnerability fingerprint according to claim 1 is characterized in that: The extracting of traffic characteristics of abnormal network communication traffic includes: The traffic features as the main components of abnormal network communication traffic are selected and extracted through the principal component analysis method.

4. The power vulnerability location method based on vulnerability fingerprint according to claim 1 is characterized in that: The similarity calculation is performed with vulnerability fingerprints in a pre-established vulnerability fingerprint library, including: The traffic characteristics of the abnormal network communication traffic are taken as the first set, and the vulnerability fingerprints in the vulnerability fingerprint library are taken as the second set. The similarity value is calculated by dividing the intersection of the first set and the second set by the union of the first set and the second set. If the similarity value is higher than the similarity threshold, it is determined that the traffic characteristics of the abnormal network communication traffic are similar to the corresponding vulnerability fingerprint.

5. A power vulnerability location device based on vulnerability fingerprint, characterized in that: include: Traffic acquisition unit, anomaly identification unit, similarity comparison unit and vulnerability location unit, including: The traffic acquisition unit is used to acquire specific network communication traffic of each system structure in the power monitoring system; the system structure includes at least one of the following system layers: network layer; transport layer; application layer; The abnormality identification unit is used to establish a corresponding information entropy calculation model for the specific network communication traffic of each system structure, monitor in real time and collect the specific network communication traffic within a unit time period, and calculate the information entropy characteristics of the corresponding specific network communication traffic through the information entropy calculation model. If the monitoring finds that the information entropy characteristics deviate from the corresponding standard threshold range, it is determined that a network abnormality has occurred, and the specific network communication traffic corresponding to the information entropy characteristics that deviate from the standard threshold range is queried and identified as abnormal network communication traffic; a corresponding long-short-term memory network model is established and trained for the specific network communication traffic of each system structure, and the predicted traffic of the current unit time period is predicted by the long-short-term memory network model, and the predicted traffic is compared with the corresponding specific network communication traffic. If the comparison result is outside a reasonable deviation range, it is officially determined that a network abnormality has occurred, and the corresponding specific network communication traffic is officially identified as abnormal network communication traffic; if the comparison result is within a reasonable deviation range, the determination of the network abnormality is lifted, and the corresponding specific network communication traffic is no longer identified as abnormal network communication traffic; The similarity comparison unit is used to extract the traffic characteristics of the abnormal network communication traffic when a network anomaly is determined to occur, and calculate the similarity with the vulnerability fingerprints in a pre-established vulnerability fingerprint library. If a vulnerability fingerprint similar to the traffic characteristics of the abnormal network communication traffic exists in the vulnerability fingerprint library, it is determined that a power vulnerability exists; The vulnerability locating unit is used to query the potential vulnerability location associated with the transmission process of the abnormal network communication traffic in the system structure corresponding to the abnormal network communication traffic, and output the potential vulnerability location.

6. An electronic device, characterized in that: The method comprises a memory and a processor, wherein a computer program executable by the processor is stored in the memory, and when the computer program is executed by the processor, the power vulnerability locating method based on vulnerability fingerprint described in any one of claims 1 to 4 is executed.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the power vulnerability locating method based on vulnerability fingerprints as claimed in any one of claims 1 to 4 are implemented.

Images