A method and system for detecting vulnerabilities in petroleum refining process control software

Abstract

The present invention discloses a vulnerability detection method and system for petroleum refining process control software, belonging to the technical field of security vulnerability detection; the present invention constructs a corresponding graph structure for a code block containing preset key variables, constructs nodes and edges in the graph structure in combination with prior information carried on important key points, and realizes node-to-edge and edge-to-node information aggregation through a graph neural network to obtain graph structure features. This process effectively captures the complex relationships between nodes, and identifies abnormal behaviors and mines potential security vulnerabilities by comparing the differences between the representation of a node and its neighbors. It can perceive more subtle data features and realize a more comprehensive and in-depth code feature representation; at the same time, the present invention also obtains the pattern features of the code block at the framework level based on the code vulnerability template, and combines them with the graph structure features to realize a more comprehensive and accurate feature expression, which can efficiently and accurately detect vulnerabilities in petroleum refining process control software.

Description

Technical Field

[0001] The present invention belongs to the technical field of security vulnerability detection, and more specifically, relates to a vulnerability detection method and system for oil refining process control software. Background Art

[0002] Petroleum refining process control software is a computer system designed to monitor and manage the petroleum refining process. It plays a vital role in overseeing production processes, improving efficiency, ensuring product quality, and ensuring operational safety, helping petroleum refining companies achieve automated and intelligent production. As petroleum refining process control systems become increasingly connected to the internet, the cybersecurity threats they face are also increasing. Among them, security vulnerabilities in petroleum refining process control software can be maliciously exploited, leading to serious consequences such as production interruptions, data leaks, and physical damage. Therefore, detecting and hardening security vulnerabilities in petroleum refining process control software has become a crucial component of ensuring the cybersecurity of petroleum refining facilities.

[0003] Traditional software vulnerability detection methods primarily rely on expert experience and static analysis techniques. Static analysis tools examine program code and can identify common security vulnerability patterns without running the program. However, static analysis can produce numerous false positives and struggles to understand complex program semantics. Expert systems, on the other hand, leverage domain knowledge to build a rule base and detect anomalies by matching system behavior with patterns in the rule base. While expert systems are effective at addressing known threats, they are less responsive to emerging threats. Consequently, existing software vulnerability detection methods often suffer from low efficiency and high false positive rates. Summary of the Invention

[0004] In response to the above defects or improvement needs of the existing technology, the present invention provides a vulnerability detection method and system for petroleum refining process control software, which is used to solve the technical problem that the existing technology cannot efficiently and accurately detect vulnerabilities in petroleum refining process control software.

[0005] To achieve the above-mentioned object, the present invention provides a method for detecting vulnerabilities in petroleum refining process control software, comprising:

[0006] For each code block in the oil refining process control software, different code vulnerability templates with different preset vulnerability types are used for pattern matching to obtain the corresponding preliminary vulnerability detection results;

[0007] Each code block and the corresponding preliminary vulnerability detection results are vectorized, concatenated, and input into the feature extraction module to obtain the pattern features of each code block;

[0008] For each code block containing a preset key variable, a corresponding graph structure is constructed. The nodes in the graph structure include: the preset key variable in the code block, and other variables or constants in the control flow where the preset key variable is located. The edges in the graph structure are used to connect two adjacent nodes that appear simultaneously in the control flow with an execution order relationship, and the node that appears first points to the node that appears later.

[0009] For each graph structure, the node information and edge information on it are vectorized and input into the graph neural network to obtain the features of each node in the graph structure, and the average value of each node feature is used as the graph structure feature of the corresponding code block;

[0010] For each code block containing preset key variables, its pattern features are fused with graph structure features and then input into the first classifier to obtain the corresponding final vulnerability detection result; for each code block that does not contain preset key variables, its pattern features are input into the second classifier to obtain the corresponding final vulnerability detection result.

[0011] Further preferably, the node information includes: the name of the variable or constant corresponding to the node, the function name where the node is located, the node location information and the preset vulnerability risk level;

[0012] The edge information includes: the logical conditions of the control flow of the two connected nodes.

[0013] Further preferably, each preset key variable corresponds to a vulnerability risk level;

[0014] When a node is a preset key variable, its preset vulnerability risk level is the vulnerability risk level corresponding to the preset key variable;

[0015] When a node is not a preset key variable, its preset vulnerability risk level is the lowest vulnerability risk level.

[0016] Further preferably, the message passing function of the graph neural network is:

[0017]

[0018] is the message information received by node v at the k+1th time step; N(v) is the set of all neighbor nodes pointing to node v; W and b are the corresponding weight parameters and bias parameters respectively; is the node feature of node w at time step k; the node feature of node w at the initial time step is the node information of node w; is the edge information carried by the edge between node v and node w at time step k;

[0019] The node update function of the graph neural network is:

[0020]

[0021] is the node feature of node v at the k+1th time step; is the node feature of node v at the kth time step; U and Z are the corresponding weight parameters; b' is the corresponding bias parameter; f(·) is the activation function.

[0022] Further preferably, after the graph structure completes node-to-edge and edge-to-node information aggregation in the graph neural network, the obtained node features of each node are respectively input into the first neural network and the second neural network to obtain the first intermediate feature and the second intermediate feature, and the result of multiplying the two is processed by the first activation layer as the final node feature of the node;

[0023] The first neural network and the second neural network include one or more cascaded fully connected layers, and a softmax layer connected after the last fully connected layer;

[0024] When there are multiple fully connected layers, a second activation layer is provided between two adjacent fully connected layers.

[0025] Further preferably, for each code block containing preset key variables, the pattern features are fused with the graph structure features, including:

[0026] The pattern features and graph structure features of each code block containing preset key variables are adjusted to the same dimension and then spliced.

[0027] Further preferably, the feature extraction module is a pre-trained feature extraction module, and its training process includes:

[0028] Obtain a first training set; the first training set includes: multiple code blocks and corresponding vulnerability detection labels;

[0029] Each code block and the corresponding vulnerability detection label in the first training set are vectorized and spliced ​​together, and then input into the first learning model including a cascaded feature extraction module and a third classifier to obtain the vulnerability detection result of the code block. By minimizing the difference loss between the vulnerability detection result and the corresponding label, the first learning model is trained to obtain a trained feature extraction module.

[0030] Further preferably, the graph neural network is a pre-trained graph neural network, and its training process includes:

[0031] Obtain a second training set; the second training set includes: multiple code blocks containing preset key variables and corresponding vulnerability detection labels;

[0032] For each code block in the second training set, a corresponding graph structure is constructed. The nodes in the graph structure include: the preset key variables in the code block, and other variables or constants in the control flow where the preset key variables are located. The edges in the graph structure are used to connect two adjacent nodes that appear simultaneously in the control flow with an execution order relationship, and the first node points to the later node.

[0033] For the graph structure corresponding to each code block in the second training set, the node information and edge information on it are vectorized respectively and input into the second learning model including the cascaded graph neural network and the fourth classifier to obtain the corresponding vulnerability detection results. By minimizing the difference loss between the vulnerability detection results and the corresponding labels, the second learning model is trained to obtain a trained graph neural network.

[0034] In a second aspect, the present invention provides a vulnerability detection system for petroleum refining process control software, a memory and a processor, including: the memory stores a computer program, and the processor executes the vulnerability detection method for petroleum refining process control software provided by the first aspect of the present invention when executing the computer program.

[0035] In a third aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the vulnerability detection method for the petroleum refining process control software provided in the first aspect of the present invention is executed.

[0036] In general, the above technical solutions conceived by the present invention can achieve the following beneficial effects:

[0037] 1. The present invention provides a vulnerability detection method for petroleum refining process control software. Some key variables are pre-set, and a corresponding graph structure is constructed for the code block containing the preset key variables. The nodes and edges in the graph structure are constructed in combination with the prior information carried by important key points. The node-to-edge and edge-to-node information aggregation is realized through a graph neural network to obtain graph structure features. This process effectively captures the complex relationships between nodes, and identifies abnormal behaviors and explores potential security vulnerabilities by comparing the differences between the representation of the node and its neighbors. It can perceive more subtle data features, realize a more comprehensive and in-depth code feature representation, and can discover potential vulnerabilities in complex logic. At the same time, the present invention also obtains pattern features at the framework level for the code block based on the code vulnerability template, and integrates them with the graph structure features to perform vulnerability detection. The present invention expresses the features of the code block from both the macro and micro levels, realizes a more comprehensive and accurate feature expression, and can efficiently and accurately detect vulnerabilities in the petroleum refining process control software.

[0038] 2. Furthermore, in the vulnerability detection method for petroleum refining process control software provided by the present invention, the node information carried on the node includes: the name of the variable or constant corresponding to the node, the function name of the node, the node location information and the preset vulnerability risk level; the edge information includes: the logical conditions of the control flow where the two connected nodes are located; wherein the preset vulnerability risk level is set according to the vulnerability risk level of the preset key variable, and prior information can be fully utilized; at the same time, the edge also carries the logical conditions of the control flow where the two connected nodes are located, further focusing on the logic within the code, with rich information, and can achieve more accurate graph structure feature extraction, further improving the accuracy of vulnerability detection.

[0039] 3. Furthermore, the vulnerability detection method for petroleum refining process control software provided by the present invention fully integrates the edge information carried by the edge when transmitting messages in the graph neural network, further improving the accuracy of vulnerability detection.

[0040] 4. Furthermore, the vulnerability detection method for petroleum refining process control software provided by the present invention, after the graph structure completes the node-to-edge and edge-to-node information aggregation in the graph neural network, further extracts and expresses the obtained node features using two neural networks respectively, and the result of multiplying the two is processed by the first activation layer as the final node feature of the node, so as to further achieve more in-depth and comprehensive feature expression, further improving the accuracy of vulnerability detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A flowchart of a method for detecting vulnerabilities in petroleum refining process control software provided by an embodiment of the present invention;

[0042] Figure 2 A flow chart of the pattern feature extraction process provided by an embodiment of the present invention;

[0043] Figure 3 A flowchart of the feature fusion and vulnerability detection process for each code block containing preset key variables provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0044] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely for the purpose of explaining the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below may be combined with each other as long as they do not conflict with each other.

[0045] In order to achieve the above objectives, firstly, Figure 1As shown, the present invention provides a vulnerability detection method for oil refining process control software, comprising:

[0046] For each code block in the oil refining process control software, different code vulnerability templates with different preset vulnerability types are used for pattern matching to obtain the corresponding preliminary vulnerability detection results (i.e., preliminary detection results of whether there are vulnerabilities);

[0047] Each code block and the corresponding preliminary vulnerability detection results are vectorized, concatenated, and input into the feature extraction module to obtain the pattern features of each code block;

[0048] For each code block containing a preset key variable, a corresponding graph structure is constructed. The nodes in the graph structure include: the preset key variable in the code block, and other variables or constants in the control flow where the preset key variable is located. The edges in the graph structure are used to connect two adjacent nodes that appear simultaneously in the control flow with an execution order relationship, and the node that appears first points to the node that appears later. Among them, the preset key variables are variables that may cause vulnerabilities. They often exist simultaneously in multiple code segments. In this invention, they are selected based on experience.

[0049] For each graph structure, the node information and edge information on it are vectorized and input into the graph neural network for graph convolution operation to achieve node-to-edge and edge-to-node information aggregation, obtain the node features in the graph structure, and use the average value of each node feature as the graph structure feature of the corresponding code block;

[0050] For each code block containing preset key variables, its pattern features are fused with the graph structure features and then input into the first classifier to obtain the corresponding final vulnerability detection result (i.e., the final detection result of whether a vulnerability exists); for each code block that does not contain the preset key variables, its pattern features are input into the second classifier to obtain the corresponding final vulnerability detection result (i.e., the final detection result of whether a vulnerability exists).

[0051] In an optional implementation manner, the node information includes: the name of the variable or constant corresponding to the node, the function name where the node is located, the node location information and the preset vulnerability risk level;

[0052] The edge information includes: the logical conditions of the control flow of the two connected nodes.

[0053] In an optional implementation, each preset key variable corresponds to a vulnerability risk level;

[0054] When a node is a preset key variable, its preset vulnerability risk level is the vulnerability risk level corresponding to the preset key variable;

[0055] When a node is not a preset key variable, its preset vulnerability risk level is the lowest vulnerability risk level.

[0056] In an optional implementation, the message passing function of the graph neural network is:

[0057]

[0058] is the message information received by node v at the k+1th time step; N(v) is the set of all neighbor nodes pointing to node v; W and b are the corresponding weight parameters and bias parameters respectively; is the node feature of node w at time step k; the node feature of node w at the initial time step is the node information of node w; is the edge information carried by the edge between node v and node w at time step k;

[0059] The node update function of the graph neural network is:

[0060]

[0061] is the node feature of node v at the k+1th time step; is the node feature of node v at the kth time step; U and Z are the corresponding weight parameters; b' is the corresponding bias parameter; f(·) is the activation function.

[0062] In an optional implementation, after the graph structure completes node-to-edge and edge-to-node information aggregation in the graph neural network, the obtained node features of each node are input into the first neural network and the second neural network respectively to obtain the first intermediate feature and the second intermediate feature. The result of multiplying the two is processed by the first activation layer and used as the final node feature of the node;

[0063] The first neural network and the second neural network include one or more cascaded fully connected layers, and a softmax layer connected after the last fully connected layer;

[0064] When there are multiple fully connected layers, a second activation layer is provided between two adjacent fully connected layers.

[0065] In an optional implementation manner, for each code block containing preset key variables, the pattern features are fused with the graph structure features, including:

[0066] The pattern features and graph structure features of each code block containing preset key variables are adjusted to the same dimension and then spliced.

[0067] It should be noted that the above method is only one of the feature fusion methods. The feature fusion method can also be weighted summation, element-by-element multiplication, adaptive adjustment of weight addition with fusion attention mechanism, etc.

[0068] In an optional implementation, the feature extraction module is a pre-trained feature extraction module, and its training process includes:

[0069] Obtain a first training set; the first training set includes: multiple code blocks and corresponding vulnerability detection labels;

[0070] Each code block and the corresponding vulnerability detection label in the first training set are vectorized and spliced ​​together, and then input into the first learning model including a cascaded feature extraction module and a third classifier to obtain the vulnerability detection result of the code block. By minimizing the difference loss between the vulnerability detection result and the corresponding label, the first learning model is trained to obtain a trained feature extraction module.

[0071] In an optional implementation, the graph neural network is a pre-trained graph neural network, and its training process includes:

[0072] Obtain a second training set; the second training set includes: multiple code blocks containing preset key variables and corresponding vulnerability detection labels;

[0073] For each code block in the second training set, a corresponding graph structure is constructed. The nodes in the graph structure include: the preset key variables in the code block, and other variables or constants in the control flow where the preset key variables are located. The edges in the graph structure are used to connect two adjacent nodes that appear simultaneously in the control flow with an execution order relationship, and the first node points to the later node.

[0074] For the graph structure corresponding to each code block in the second training set, the node information and edge information on it are vectorized respectively and input into the second learning model including the cascaded graph neural network and the fourth classifier to obtain the corresponding vulnerability detection results. By minimizing the difference loss between the vulnerability detection results and the corresponding labels, the second learning model is trained to obtain a trained graph neural network.

[0075] To further illustrate the vulnerability detection method for oil refining process control software provided by the present invention, a specific embodiment is described below in detail:

[0076] 1) Pattern feature extraction:

[0077] For each code block in the oil refining process control software, pattern matching is performed using different preset code vulnerability templates of different vulnerability types to obtain the corresponding preliminary vulnerability detection results. Each code block and the corresponding preliminary vulnerability detection results are vectorized, spliced ​​together, and input into the feature extraction module to obtain the pattern characteristics of each code block.

[0078] In this embodiment, if Figure 2 As shown, the whole process is as follows:

[0079] (1) According to the vulnerability type you want to find, formulate a corresponding code vulnerability template; use the formulated code vulnerability template to perform pattern matching on each code block in the oil refining process control software; it should be noted that there may be more than one code vulnerability template here, and each code vulnerability template needs to be used to perform pattern matching on the code block respectively. If there is a vulnerability pattern that meets the code vulnerability template, it is preliminarily determined that there is a vulnerability, and the preliminary vulnerability detection result is set to 1 accordingly; otherwise, if there is no vulnerability pattern that meets the code vulnerability template, it is preliminarily determined that there is no vulnerability, and the preliminary vulnerability detection result is set to 0 accordingly;

[0080] In this embodiment, when formulating a code vulnerability template, the corresponding domain knowledge is searched according to the expected functions to be completed by the software code. Domain knowledge can come from expert knowledge, which is the ability to solve specific problems in a certain field, obtained through long-term research and practice. Domain knowledge can also come from process files saved during previous vulnerability detection processes. The process files store how to detect and prevent the vulnerability. Based on the neighborhood knowledge, code patterns that may lead to security vulnerabilities are analyzed, and corresponding code vulnerability templates are formulated based on the code patterns.

[0081] Combined with domain knowledge, consider the various possible forms of vulnerabilities. Generally, a vulnerability can exist in multiple forms. For example, one domain knowledge of a circular call vulnerability is: loop to obtain each line of the current code block, remove text spaces, and check whether the current function name plus the left function bracket is in the current line. If it is in the current line, it means that the function calls itself, and there is a circular call vulnerability. In this case, it is preliminarily determined that a vulnerability exists, and then traverse the next code block.

[0082] Each code block and the corresponding preliminary vulnerability detection results are vectorized, concatenated, and input into the feature extraction module to obtain the pattern feature Pr of each code block;

[0083] It should be noted that the feature extraction module can be a feedforward neural network, CNN, Transformer, etc., which will not be described here.

[0084] The feature extraction module used in this embodiment is a pre-trained feature extraction module, and its training process includes:

[0085] Obtain a first training set; the first training set includes: multiple code blocks and corresponding vulnerability detection labels;

[0086] Each code block and the corresponding vulnerability detection label in the first training set are vectorized and spliced ​​together, and then input into the first learning model including a cascaded feature extraction module and a third classifier to obtain the vulnerability detection result of the code block. By minimizing the difference loss between the vulnerability detection result and the corresponding label, the first learning model is trained to obtain a trained feature extraction module.

[0087] There can be multiple third classifiers, such as softmax classifier, neural network classifier, svm, Bayesian classifier, etc., which are not limited here.

[0088] 2) Graph structure feature extraction:

[0089] For each code block containing a preset key variable, a corresponding graph structure is constructed. The nodes in the graph structure include: the preset key variable in the code block, and other variables or constants in the control flow where the preset key variable is located. The edges in the graph structure are used to connect two adjacent nodes that appear simultaneously in the control flow with an execution order relationship, and the node that appears first points to the node that appears later.

[0090] In this embodiment, the preset key variables are entity variables that may exist in multiple code segments, such as Tag, Point, Timestamp in the data flow; Setpoint, Command, Actuator in the control process; Status, Alarm, Indicator in the state control; these variables can all be used as key variables. When constructing the node, pay special attention to the appearance of these variable names, as these variables may cause vulnerabilities.

[0091] In this embodiment, the information carried on the node includes: "node name", "function name", "location information", "risk level", "node type" and "additional information". The node name is the corresponding variable name or constant name, the function name is the function name of the function body where the variable or constant name is located, and the location information is the names of the two variables before and after the variable. The risk level is the preset vulnerability risk level of the variable, which is used to reflect the possible vulnerability risk situation. The node type describes the type information of the node, mainly including: controller node, HMI node, main server node, sensor and actuator node, and network device node. The controller node represents the PLC and RTU type controllers in the system, and its function is used to transmit the controller's execution instructions and control logic; the HMI node represents the human-computer interaction interface, and its function is used to receive operator input and transmit display system output; the sensor node represents various temperature, pressure, and flow sensors at the automated control process site, and its function is responsible for receiving operation data and transmitting sensor data; the main server node represents the core node of the oil refining process control software, and its function is responsible for collecting data from the controller, sensor, and HMI device and completing data processing; the additional information is the custom information of the vulnerability corresponding to the variable.

[0092] In this embodiment, the information carried by the edge includes: "starting node", "target node", "associated information" and "logical condition";

[0093] Among them, the starting node is the starting node of the edge, and the target node is the starting node of the edge. For example, if the call of variable V affects the important variable W, then the starting node is V and the target node is W; the associated information is the function name or variable name related to this edge, which can help locate the edge and identify which logical part of the code this edge is in; the logical condition is the code logic condition formulated according to the execution of the code flow. For example, FW represents the normal sequence or logical flow, such as a simple direct relationship from function to function or function to variable; AH represents the relationship between the assert statement and its condition or related variables; FOR represents the process of conditional judgment, such as the logic in the if statement.

[0094] The constructed nodes and edges are used to construct the graph structure, and the graph structure is stored for the start node and target node of the edge.

[0095] For each graph structure, the node information and edge information on it are vectorized and input into the graph neural network to obtain the features of each node in the graph structure, and the average value of each node feature is used as the graph structure feature of the corresponding code block.

[0096] The vectorization process in this embodiment is:

[0097] (a) Develop a word encoding tool to convert variable or operation names into integer form to perform embedding operations;

[0098] (b) Develop a word embedding tool to convert the encoded integers into one-hot encoded vectors;

[0099] (c) extracting node information such as node type, node name, and node location information for each node;

[0100] (d) The extracted node information is fused and encoded, embedded and stored in sequence using word encoding and embedding tools.

[0101] In this embodiment, a message passing graph neural network is used to extract graph structure features Gr based on the graph structure. Specifically, the message passing graph neural network includes the following sub-steps:

[0102] Hidden state initialization: When the time step is 0, the hidden state of each node uses its own information and message passing is enabled;

[0103] At time step k, the message m k Through the edge k To transmit, the message m k and edge k The starting node and the logical conditions of the edge are related;

[0104] After the next node receives the message, it updates the hidden state of the node by the state of the current message and the previous state.

[0105] The hidden state here is the node feature.

[0106] In this embodiment, the message passing function of the graph neural network is:

[0107]

[0108] is the message information received by node v at the k+1th time step; N(v) is the set of all neighbor nodes pointing to node v; W and b are the corresponding weight parameters and bias parameters respectively; is the node feature of node w at time step k; the node feature of node w at the initial time step is the node information of node w; is the edge information carried by the edge between node v and node w at time step k;

[0109] The node update function of the graph neural network is:

[0110]

[0111] is the node feature of node v at the k+1th time step; is the node feature of node v at the kth time step; U and Z are the corresponding weight parameters; b' is the corresponding bias parameter; f(·) is the activation function, and the tanh function is used in this embodiment.

[0112] After the graph structure completes node-to-edge and edge-to-node information aggregation in the graph neural network, the node features of each node are input into the first neural network and the second neural network respectively to obtain the first intermediate feature and the second intermediate feature. The result of multiplying the two is processed by the first activation layer as the final node feature of the node;

[0113] The first neural network and the second neural network include one or more cascaded fully connected layers, and a softmax layer connected after the last fully connected layer;

[0114] When there are multiple fully connected layers, a second activation layer is provided between two adjacent fully connected layers.

[0115] In this embodiment, the first neural network and the second neural network include two cascaded fully connected layers and a softmax layer connected after the last fully connected layer; a second activation layer is provided between two adjacent fully connected layers, and the activation function of the second activation layer is the tanh function; the activation function of the first activation layer is the sigmoid function. Specifically, the node feature s of a node v after information aggregation is v , proceed as follows:

[0116] g v =softmax(W g2 (tanh(W g1 s v +b g1 ))+b g2 )

[0117] ov=softmax(Wo2(tanh(Wo1sv+bo1))+bo2)

[0118]

[0119] W g1 and W g2 are the weight parameters of the first level fully connected layer and the second level fully connected layer of the first neural network respectively; b g1 and b g2 are the bias parameters of the first and second fully connected layers of the first neural network; W o1 and W o2 are the weight parameters of the first and second fully connected layers of the second neural network respectively; b o1 and bo2 are the bias parameters of the first and second fully connected layers of the second neural network; is the final node feature of node v.

[0120] The graph structure characteristics of the code block are:

[0121]

[0122] Among them, N V is the total number of nodes in the graph structure corresponding to the code block; V is the set of all nodes in the graph structure corresponding to the code block.

[0123] The graph neural network used in this embodiment is a pre-trained graph neural network, and its training process includes:

[0124] Obtain a second training set; the second training set includes: multiple code blocks containing preset key variables and corresponding vulnerability detection labels;

[0125] For each code block in the second training set, a corresponding graph structure is constructed. The nodes in the graph structure include: the preset key variables in the code block, and other variables or constants in the control flow where the preset key variables are located. The edges in the graph structure are used to connect two adjacent nodes that appear simultaneously in the control flow with an execution order relationship, and the first node points to the later node.

[0126] For the graph structure corresponding to each code block in the second training set, the node information and edge information on it are vectorized respectively and input into the second learning model including the cascaded graph neural network and the fourth classifier to obtain the corresponding vulnerability detection results. By minimizing the difference loss between the vulnerability detection results and the corresponding labels, the second learning model is trained to obtain a trained graph neural network.

[0127] There can be multiple types of fourth classifiers, such as softmax classifier, neural network classifier, svm, Bayesian classifier, etc., which are not limited here.

[0128] 3) Feature fusion and vulnerability detection:

[0129] For each code block containing preset key variables, its pattern features are fused with graph structure features and then input into the first classifier to obtain the corresponding final vulnerability detection result; for each code block that does not contain preset key variables, its pattern features are input into the second classifier to obtain the corresponding final vulnerability detection result.

[0130] In this embodiment, for each code block containing preset key variables, the feature fusion and vulnerability detection process is as follows: Figure 3 As shown, including:

[0131] The pattern feature Pr and graph structure feature Gr of the code block are dimensionalized and scaled to the same dimension. Specifically, convolution and pooling operations are performed on the pattern feature Pr and graph structure feature Gr, respectively. After the operations, high-level feature targets can be better obtained. After pooling, the two are scaled to the same dimension.

[0132] The pattern feature Pr and the graph structure feature Gr after the convolution operation and the pooling operation are subjected to a feature fusion operation to obtain a fused feature; specifically, the pattern feature Pr and the graph structure feature Gr after the convolution operation and the pooling operation are subjected to a splicing operation to obtain a fused feature;

[0133] The fused features are input into the first classifier to obtain the final vulnerability detection results.

[0134] There are many types of first classifiers, such as softmax classifier, neural network classifier, svm, Bayesian classifier, etc., which are not limited here. In this embodiment, the first classifier includes: a cascaded ReLU layer, a fully connected layer and a sigmoid layer.

[0135] It should be noted that the first classifier is a pre-trained first classifier, and its training process includes:

[0136] Obtain a third training set; the third training set includes: multiple code blocks containing preset key variables and corresponding vulnerability detection labels;

[0137] The above-mentioned pattern feature extraction method and graph structure feature extraction method are respectively used to obtain the pattern features and graph structure features of each code block in the third training set. After feature fusion of the pattern features and graph structure features, they are input into the first classifier to obtain the vulnerability detection result of the code block. By minimizing the difference loss between the vulnerability detection result and the corresponding label, the first classifier is trained to obtain a trained first classifier.

[0138] In this embodiment, for each code block that does not contain the preset key variables, its pattern features are directly input into the second classifier to obtain the final vulnerability detection result.

[0139] It should be noted that there can be many types of second classifiers, such as softmax classifier, neural network classifier, svm, Bayesian classifier, etc., which are not limited here.

[0140] It should be noted that the second classifier is a pre-trained second classifier, and its training process includes:

[0141] Obtain a fourth training set; the fourth training set includes: multiple code blocks and corresponding vulnerability detection labels;

[0142] The above-mentioned pattern feature extraction method is used to extract the pattern features of each code block in the fourth training set, and its pattern features are input into the second classifier to obtain the vulnerability detection results of the code block. By minimizing the difference loss between the vulnerability detection results and the corresponding labels, the second classifier is trained to obtain a trained second classifier.

[0143] It should be noted that, when dividing the code blocks in the oil refining process control software, this embodiment can consider the possible location of the corresponding vulnerability code based on the vulnerability to be found, formulate location rules based on the possible location of the vulnerability code, and segment the vulnerability code according to the location rules. The segmentation result is the code segment of the specific location where the vulnerability may exist. Alternatively, each line of code in the oil refining process control software can be read from top to bottom to check whether the line begins with "function". If it does, the current line is added to the list, and each "(" that appears is saved, and each ")" that follows is checked against it. When the number of "(" and ")" is the same, it represents the end of the function body, and a code block is obtained, and then the next function is checked.

[0144] In a second aspect, the present invention provides a vulnerability detection system for petroleum refining process control software, a memory and a processor, including: the memory stores a computer program, and the processor executes the vulnerability detection method for petroleum refining process control software provided by the first aspect of the present invention when executing the computer program.

[0145] The related technical solutions are the same as the vulnerability detection method for petroleum refining process control software provided by the first aspect of the present invention, and will not be described in detail here.

[0146] In a third aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the vulnerability detection method for the petroleum refining process control software provided in the first aspect of the present invention is executed.

[0147] The related technical solutions are the same as the vulnerability detection method for petroleum refining process control software provided by the first aspect of the present invention, and will not be described in detail here.

[0148] It will be easily understood by those skilled in the art that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for detecting vulnerabilities in petroleum refining process control software, characterized in that: include: For each code block in the oil refining process control software, different code vulnerability templates with different preset vulnerability types are used for pattern matching to obtain the corresponding preliminary vulnerability detection results; Each code block and the corresponding preliminary vulnerability detection results are vectorized, concatenated, and input into the feature extraction module to obtain the pattern features of each code block; For each code block containing a preset key variable, a corresponding graph structure is constructed. The nodes in the graph structure include: the preset key variable in the code block, and other variables or constants in the control flow where the preset key variable is located. The edges in the graph structure are used to connect two adjacent nodes that appear simultaneously in the control flow with an execution order relationship, and the node that appears first points to the node that appears later. For each graph structure, the node information and edge information on it are vectorized and input into the graph neural network to obtain the features of each node in the graph structure, and the average value of each node feature is used as the graph structure feature of the corresponding code block; For each code block containing preset key variables, its pattern features are fused with graph structure features and then input into the first classifier to obtain the corresponding final vulnerability detection result; for each code block that does not contain preset key variables, its pattern features are input into the second classifier to obtain the corresponding final vulnerability detection result.

2. The method for detecting vulnerabilities in petroleum refining process control software according to claim 1, characterized in that: The node information includes: the name of the variable or constant corresponding to the node, the function name where the node is located, the node location information and the preset vulnerability risk level; The edge information includes: the logical conditions of the control flow of the two connected nodes.

3. The method for detecting vulnerabilities in petroleum refining process control software according to claim 2, characterized in that: A preset key variable corresponds to a vulnerability risk level; When a node is a preset key variable, its preset vulnerability risk level is the vulnerability risk level corresponding to the preset key variable; When a node is not a preset key variable, its preset vulnerability risk level is the lowest vulnerability risk level.

4. The method for detecting vulnerabilities in petroleum refining process control software according to claim 1, wherein: The message passing function of the graph neural network is: is the message information received by node v at the k+1th time step; N(v) is the set of all neighbor nodes pointing to node v; W and b are the corresponding weight parameters and bias parameters respectively; is the node feature of node w at time step k; the node feature of node w at the initial time step is the node information of node w; is the edge information carried by the edge between node v and node w at time step k; The node update function of the graph neural network is: is the node feature of node v at the k+1th time step; is the node feature of node v at the kth time step; U and Z are the corresponding weight parameters; b' is the corresponding bias parameter; f(·) is the activation function.

5. The method for detecting vulnerabilities in petroleum refining process control software according to claim 1, characterized in that: After the graph structure completes node-to-edge and edge-to-node information aggregation in the graph neural network, the node features of each node are input into the first neural network and the second neural network respectively to obtain the first intermediate feature and the second intermediate feature. The result of multiplying the two is processed by the first activation layer as the final node feature of the node; The first neural network and the second neural network include one or more cascaded fully connected layers, and a softmax layer connected after the last fully connected layer; When there are multiple fully connected layers, a second activation layer is provided between two adjacent fully connected layers.

6. The method for detecting vulnerabilities in petroleum refining process control software according to any one of claims 1 to 5, characterized in that: For each code block containing preset key variables, its pattern features are fused with graph structure features, including: The pattern features and graph structure features of each code block containing preset key variables are adjusted to the same dimension and then spliced.

7. The method for detecting vulnerabilities in petroleum refining process control software according to any one of claims 1 to 5, characterized in that: The feature extraction module is a pre-trained feature extraction module, and its training process includes: Obtain a first training set; the first training set includes: multiple code blocks and corresponding vulnerability detection labels; Each code block and the corresponding vulnerability detection label in the first training set are vectorized separately, spliced ​​together, and input into a first learning model including the cascaded feature extraction module and the third classifier to obtain the vulnerability detection result of the code block. The first learning model is trained by minimizing the difference loss between the vulnerability detection result and the corresponding label to obtain the trained feature extraction module.

8. The method for detecting vulnerabilities in petroleum refining process control software according to claim 1, wherein: The graph neural network is a pre-trained graph neural network, and its training process includes: Obtain a second training set; the second training set includes: a plurality of code blocks containing preset key variables and corresponding vulnerability detection labels; For each code block in the second training set, a corresponding graph structure is constructed; the nodes in the graph structure include: preset key variables in the code block, and other variables or constants in the control flow where the preset key variables are located; the edges in the graph structure are used to connect two adjacent nodes that appear simultaneously in the control flow with an execution order relationship, with the first-appearing node pointing to the later-appearing node; For the graph structure corresponding to each code block in the second training set, the node information and edge information on it are vectorized respectively and input into the second learning model including the cascaded graph neural network and the fourth classifier to obtain the corresponding vulnerability detection results. By minimizing the difference loss between the vulnerability detection results and the corresponding labels, the second learning model is trained to obtain the trained graph neural network.

9. A vulnerability detection system for oil refining process control software, characterized in that: include: A memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method for detecting vulnerabilities in petroleum refining process control software according to any one of claims 1 to 8 is executed.

10. A computer-readable storage medium, characterized in that A computer program is stored thereon, and when the computer program is executed by a processor, the vulnerability detection method for oil refining process control software according to any one of claims 1 to 8 is executed.

Images