A method for extracting power device protocol vulnerability features

Abstract

This invention discloses a method for extracting vulnerability features from power equipment protocols, belonging to the field of vulnerability feature extraction technology. This method applies power equipment protocols with vulnerability features one by one to power equipment security testing; obtains test datasets of the power equipment during the security testing process; and determines whether the power equipment is abnormal based on the test datasets. If the power equipment is abnormal, the vulnerability features of the power equipment protocols with vulnerability features corresponding to that power equipment security test are extracted and stored in a vulnerability feature database. This method achieves the ability to determine whether the power equipment is normal or not by comprehensively analyzing the equipment status, network stability, and system performance, thereby determining whether to store the corresponding vulnerability features of the power equipment protocols in the database. This allows for the extraction of vulnerability features from power equipment protocols based on the actual situation of the power equipment.

Description

Technical Field

[0001] This invention relates to the field of vulnerability feature extraction technology, specifically a method for extracting vulnerability features of power equipment protocols. Background Technology

[0002] To ensure network security, traffic analysis and detection of vulnerability attacks are indispensable. In current business operations, the feature extraction of vulnerability attack traffic mainly relies on security researchers reverse engineering sample code to obtain relatively fixed parts of the sample communication protocol as features, which are then written into rules according to the corresponding product language and added to the product. Typically, a mid-to-senior level analyst spends anywhere from a few hours to several days analyzing software vulnerabilities, but after the analysis is completed, the features may not be added to the product due to reasons such as product engine incompatibility or protocol encryption, resulting in a waste of time and resources.

[0003] Chinese invention patent application CN115701020A discloses a vulnerability feature extraction system and method for network traffic based on the HTTP protocol, including a collection module, a clustering module, a feature extraction module, and a conversion module. The collection module is used to acquire payload data; the clustering module is used to obtain a set of payload data belonging to the same vulnerability; the feature extraction module is used to extract the valid feature strings of the vulnerability; and the conversion module is used to convert the valid feature strings and their related information into corresponding Yara rules.

[0004] However, existing vulnerability feature extraction methods are not suitable for extracting protocol vulnerability features in accordance with actual use cases, which means that the extracted vulnerability features may not be applicable to actual devices. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a method for extracting protocol vulnerability features in power equipment. This method solves the problem that existing vulnerability feature extraction methods are not suitable for actual use cases, which may result in the extracted vulnerability features being unapplicable to real-world devices.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a method for extracting vulnerability features from power equipment protocols, comprising the following steps: obtaining several power equipment protocols with vulnerability features from an authorized database; applying each power equipment protocol with vulnerability features to a power equipment security test; obtaining a test dataset of the power equipment during the security test; determining whether the power equipment is abnormal based on the test dataset of the power equipment during the security test: if the power equipment is abnormal, extracting the vulnerability features from the power equipment protocols with vulnerability features corresponding to the current power equipment security test and storing them in a vulnerability feature database; if the power equipment is not abnormal, not extracting the vulnerability features from the power equipment protocols with vulnerability features corresponding to the current power equipment security test.

[0007] Furthermore, the method of determining whether power equipment is abnormal based on the test dataset during the safety testing process includes the following steps: obtaining a parameterized test dataset stored in a database; performing a fusion analysis between the parameterized test dataset and the test dataset stored in the database to obtain a test anomaly assessment index, which serves as the analytical basis for determining whether power equipment is abnormal; obtaining a test anomaly assessment threshold stored in the database; and determining whether power equipment is abnormal based on the test anomaly assessment threshold and the test anomaly assessment index stored in the database.

[0008] Furthermore, the step of determining whether the power equipment is abnormal based on the test anomaly evaluation threshold and test anomaly evaluation index stored in the database includes the following steps: determining whether the test anomaly evaluation threshold stored in the database is greater than the test anomaly evaluation index; if the test anomaly evaluation threshold stored in the database is greater than the test anomaly evaluation index, then the power equipment is determined to be abnormal; if the test anomaly evaluation threshold stored in the database is not greater than the test anomaly evaluation index, then the power equipment is determined to be normal.

[0009] Furthermore, the test dataset includes device status data, network communication data, and performance index data, and the parameter test dataset stored in the database includes device status parameter data, network communication parameter data, and performance index parameter data.

[0010] Furthermore, the step of fusing and analyzing the parameterized test dataset and the test dataset stored in the database to obtain the test anomaly evaluation index includes the following steps: fusing and analyzing the device status data and the device status parameterized data to obtain the device status evaluation coefficient; fusing and analyzing the network communication data and the network communication parameterized data to obtain the network communication evaluation coefficient; fusing and analyzing the performance index data and the performance index parameterized data to obtain the performance index evaluation coefficient; and performing any analysis on the device status evaluation coefficient, the network communication evaluation coefficient, and the performance index evaluation coefficient to obtain the test anomaly evaluation index.

[0011] Furthermore, the formula for calculating the test anomaly evaluation index is as follows:

[0012] ;

[0013] In the formula, To test the anomaly assessment index, This is the equipment condition assessment coefficient. This is a network communication evaluation coefficient. This is a performance evaluation coefficient. The weighting factors for the equipment status evaluation coefficients stored in the database. The weighting factors for network communication evaluation coefficients stored in the database. Weighting factors for performance metrics stored in the database.

[0014] Furthermore, the device status data includes energy consumption within a set time period and the number of alarms within the set time period, and the device status parameter data includes energy parameter consumption within a set interval and the number of alarm parameter times within the set time period; the step of fusing and analyzing the device status data and the device status parameter data to obtain the device status evaluation coefficient includes the following steps: obtaining the difference between the energy consumption within a set time period and the energy parameter consumption within a set interval; obtaining the ratio of the number of alarms within a set time period to the number of alarm parameter times within a set time period; determining the device status evaluation coefficient based on the difference between the energy consumption within a set time period and the energy parameter consumption within a set interval, and the ratio of the number of alarms within a set time period to the number of alarm parameter times within a set time period.

[0015] Further, the network communication data includes communication frequency, number of incomplete TCP three-way handshakes, and number of reconnections; the network communication parameter data includes parameterized communication frequency, number of incomplete TCP three-way handshakes, and number of parameterized reconnections. The step of fusing and analyzing the network communication data and the network communication parameter data to obtain the network communication evaluation coefficient includes the following steps: obtaining the difference between the communication frequency and the parameterized communication frequency; obtaining the ratio of the number of incomplete TCP three-way handshakes to the number of incomplete TCP three-way handshakes under parameterized conditions; obtaining the ratio of the number of reconnections to the number of parameterized reconnections; and determining the network communication evaluation coefficient based on the difference between the communication frequency and the parameterized communication frequency, the ratio of the number of incomplete TCP three-way handshakes to the number of incomplete TCP three-way handshakes under parameterized conditions, and the ratio of the number of reconnections to the number of parameterized reconnections.

[0016] Furthermore, the performance indicator data includes CPU utilization and response latency, and the performance indicator parameter data includes CPU parameter utilization and parameter response latency. The step of fusing and analyzing the performance indicator data and the performance indicator parameter data to obtain the performance indicator evaluation coefficient includes the following steps: obtaining the difference between CPU utilization and CPU parameter utilization; obtaining the ratio of response latency to parameter response latency; and determining the performance indicator evaluation coefficient based on the difference between CPU utilization and CPU parameter utilization and the ratio of response latency to parameter response latency.

[0017] Furthermore, the calculation formula for the performance index evaluation coefficient is as follows:

[0018] ;

[0019] In the formula, This is a performance evaluation coefficient. This is the difference between CPU utilization and the CPU default utilization. The ratio of response delay time to the specified response delay time. It is a natural constant.

[0020] The present invention has the following beneficial effects:

[0021] This method for extracting vulnerability features from power equipment protocols enables the determination of whether a power equipment is functioning properly by comprehensively analyzing its equipment status, network stability, and system performance. This allows for the storage of corresponding vulnerability features in the power equipment protocol in a database, enabling the extraction of vulnerability features from the power equipment protocol based on the actual situation of the power equipment.

[0022] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0023] Figure 1 This is a flowchart of the method for extracting vulnerabilities in power equipment protocols according to the present invention. Detailed Implementation

[0024] This application embodiment, through a method for extracting vulnerability features of power equipment protocols, achieves the determination of whether a power equipment is functioning properly by comprehensively analyzing its equipment status, network stability, and system performance. This allows for the determination of whether to store the corresponding vulnerability features in the power equipment protocol in a database, thereby enabling the extraction of vulnerability features from the power equipment protocol based on the actual situation of the power equipment.

[0025] Please see Figure 1This invention provides a technical solution: a method for extracting vulnerability features from power equipment protocols, comprising the following steps: obtaining several power equipment protocols with vulnerability features from an authorized database; applying each power equipment protocol with vulnerability features to a power equipment security test; obtaining a test dataset of the power equipment during the security test; determining whether the power equipment is abnormal based on the test dataset of the power equipment during the security test: if the power equipment is abnormal, extracting the vulnerability features from the power equipment protocols with vulnerability features corresponding to the current power equipment security test and storing them in a vulnerability feature database; if the power equipment is not abnormal, not extracting the vulnerability features from the power equipment protocols with vulnerability features corresponding to the current power equipment security test.

[0026] This method extracts known power equipment protocols with vulnerability characteristics from an authorized database and applies these protocols one by one to security tests of actual power equipment, simulating possible attack or failure scenarios to examine the equipment's response. During security testing, response and performance data of the power equipment are collected to form a test dataset. If the power equipment behaves abnormally during the test, it indicates that the protocol used in the test has successfully triggered a potential vulnerability. In this case, the vulnerability characteristics of this protocol are extracted and stored in a vulnerability characteristic database. If the equipment behaves normally, it indicates that the protocol has not triggered any vulnerabilities, and no characteristic extraction is performed. This method effectively solves the problem of vulnerability identification and management in power equipment security testing. By identifying abnormal behavior from the test dataset and associating these anomalies with specific vulnerability characteristics, this method can help build a more complete vulnerability characteristic database, thereby improving the security of power equipment and reducing security risks caused by protocol vulnerabilities.

[0027] Specifically, the method of determining whether a power equipment is abnormal based on the test dataset during the safety testing process includes the following steps: obtaining a parameterized test dataset stored in a database; performing a fusion analysis between the parameterized test dataset and the test dataset stored in the database to obtain a test anomaly assessment index, which serves as the analytical basis for determining whether the power equipment is abnormal; obtaining a test anomaly assessment threshold stored in the database; and determining whether the power equipment is abnormal based on the test anomaly assessment threshold and the test anomaly assessment index stored in the database.

[0028] Specifically, the step of determining whether power equipment is abnormal based on the test anomaly evaluation threshold and test anomaly evaluation index stored in the database includes the following steps: determining whether the test anomaly evaluation threshold stored in the database is greater than the test anomaly evaluation index; if the test anomaly evaluation threshold stored in the database is greater than the test anomaly evaluation index, then the power equipment is determined to be abnormal; if the test anomaly evaluation threshold stored in the database is not greater than the test anomaly evaluation index, then the power equipment is determined to be normal.

[0029] Specifically, the test dataset includes device status data, network communication data, and performance index data, and the parameter test dataset stored in the database includes device status parameter data, network communication parameter data, and performance index parameter data.

[0030] In this implementation plan, a pre-defined parameter test dataset is first retrieved from the database. This data typically includes the expected response and performance indicators of the equipment under normal operating conditions. The actual test dataset is then fused and analyzed with the parameter test dataset. Through comparison and calculation, a test anomaly assessment index is obtained. This index reflects the degree of deviation between the actual test data and the expected standard. A set test anomaly assessment threshold is extracted from the database; this threshold defines what level of deviation is considered abnormal. If the test anomaly assessment threshold stored in the database is greater than the test anomaly assessment index, the power equipment is judged to be abnormal; if the test anomaly assessment threshold stored in the database is not greater than the test anomaly assessment index, the power equipment is judged to be normal.

[0031] The test anomaly assessment thresholds stored in the database are determined by collecting and evaluating data from power equipment during normal operation and historical fault events. Statistical methods are used to calculate the mean, variance, and other statistical indicators of this data to establish the boundary between normal and abnormal equipment behavior. Based on this, test anomaly assessment thresholds are set to accurately identify equipment status in future tests and ensure timely detection and response to potential equipment problems.

[0032] By setting specific anomaly assessment thresholds, we can more accurately identify which device behaviors may indicate security issues or vulnerabilities, avoiding overgeneralization and misjudgment. Numerical test anomaly assessment indices and thresholds can quantify the security status of devices, making the assessment process more objective and standardized.

[0033] The process of fusing and analyzing the parameterized test dataset and the test dataset stored in the database to obtain a test anomaly evaluation index includes the following steps: fusing and analyzing equipment status data and equipment status parameterized data to obtain equipment status evaluation coefficients; fusing and analyzing network communication data and network communication parameterized data to obtain network communication evaluation coefficients; fusing and analyzing performance index data and performance index parameterized data to obtain performance index evaluation coefficients; and performing any analysis on the equipment status evaluation coefficients, network communication evaluation coefficients, and performance index evaluation coefficients to obtain a test anomaly evaluation index.

[0034] The process involves collecting equipment status data and comparing it with predefined normal status data (equipment status parameter data) to calculate an equipment status evaluation coefficient. This coefficient reflects the deviation between the current equipment status and its normal operating status. Next, the equipment's network communication data is analyzed and compared with preset standard communication data (network communication parameter data) to obtain a network communication evaluation coefficient. This coefficient measures the equipment's communication health and data integrity. Finally, the equipment's performance indicators are evaluated and compared with established performance standards (performance indicator parameter data) to calculate a performance indicator evaluation coefficient. This coefficient shows the equipment's performance on key performance indicators. These three evaluation coefficients are then combined and weighted to calculate a comprehensive test anomaly evaluation index. This index comprehensively reflects the equipment's performance in various aspects and is used to determine whether the equipment exhibits any anomalies.

[0035] By evaluating equipment from three different perspectives—equipment status, network communication, and performance metrics—a comprehensive understanding of the equipment's health can be obtained, reducing misjudgments caused by evaluation based on a single metric.

[0036] The formula for calculating the test anomaly assessment index is as follows:

[0037] ;

[0038] In the formula, To test the anomaly assessment index, This is the equipment condition assessment coefficient. This is a network communication evaluation coefficient. This is a performance evaluation coefficient. The weighting factors for the equipment status evaluation coefficients stored in the database. The weighting factors for network communication evaluation coefficients stored in the database. Weighting factors for performance metrics stored in the database.

[0039] In this implementation scheme, each evaluation coefficient (equipment status evaluation coefficient, network communication evaluation coefficient, and performance index evaluation coefficient) is first multiplied by a corresponding weighting factor. These weighting factors are provided by a database and reflect the degree of influence of different evaluation coefficients on the final anomaly evaluation index. The sum of the weights is used as the power of the exponent to obtain the test anomaly evaluation index. The use of an exponential function can enhance the model's sensitivity to changes in evaluation coefficients, so that even small changes can significantly affect the final evaluation index, thereby enhancing discriminability.

[0040] These three sets of parameters provide comprehensive monitoring of equipment status from physical, network, and performance perspectives, offering a holistic equipment health assessment. For example, physical faults can lead to performance degradation, while network issues can affect the accuracy and timeliness of equipment status data. The physical condition of equipment not only impacts its own performance but can also indirectly affect network communication stability through communication failures. Furthermore, abnormal performance degradation may be due to physical wear and tear on the equipment or improper network data processing. The selection of these three parameters and their interrelationships provide a comprehensive, multi-dimensional assessment framework for the maintenance and management of power equipment, enabling more accurate and timely anomaly detection. This approach facilitates preventative maintenance, avoids major failures, optimizes equipment performance, and extends its lifespan.

[0041] Stored in the database , and This can be obtained through historical data analysis. This process involves collecting a large amount of historical operating data from power equipment, including data under normal operation and fault conditions. Statistical analysis methods, such as multiple regression analysis, are used to determine the contribution of different parameters (equipment status, network communication, performance indicators) to equipment anomalies, and weights are assigned accordingly. These weights reflect the relative importance of each evaluation coefficient to the final anomaly assessment index, ensuring accuracy and sensitivity in predicting equipment anomalies.

[0042] Specifically, the device status data includes energy consumption within a set time interval and the number of alarms within a set time interval; the device status parameter data includes energy parameter consumption within a set time interval and the number of alarms within a set time interval. The step of fusing and analyzing the device status data and the device status parameter data to obtain the device status evaluation coefficient includes the following steps: obtaining the difference between the energy consumption within a set time interval and the energy parameter consumption within a set time interval; obtaining the ratio of the number of alarms within a set time interval to the number of alarms within a set time interval; and determining the device status evaluation coefficient based on the difference between the energy consumption within a set time interval and the energy parameter consumption within a set time interval, and the ratio of the number of alarms within a set time interval to the number of alarms within a set time interval.

[0043] The actual energy consumption of the equipment within a set time period is obtained and compared with the predetermined (referenced) energy consumption within the same time period. The difference between the two is calculated, reflecting the deviation between the actual operation and expected performance of the equipment. The actual number of alarms within the set time period is counted and compared with the predetermined (referenced) number of alarms within the same time period. The ratio is calculated, revealing the difference between the frequency of abnormal activity during equipment operation and expectations. The energy consumption difference and the alarm frequency ratio are combined to determine the equipment status assessment coefficient. By considering both energy consumption and alarm frequency simultaneously, the operating status of the equipment can be evaluated from different perspectives. Energy consumption data provides an indicator of equipment efficiency, while the alarm frequency reflects the equipment's safety and stability. Combining these two parameters increases sensitivity to early equipment failures or anomalies; even if a single indicator does not show significant abnormalities, the combination of the two may reveal potential problems.

[0044] Energy consumption is monitored and recorded in real time using power sensors and metering devices over a set period. These devices can accurately measure parameters such as current and voltage to calculate energy consumption. The number of alarms can be detected by the device's built-in monitoring system. If the device's energy consumption suddenly increases, accompanied by an increase in the number of alarms, this may indicate reduced equipment efficiency or a malfunction. For example, increased friction or malfunction of mechanical parts may cause the system to require more energy to complete the same task, and the device's monitoring system may trigger an alarm as a result.

[0045] The formula for calculating the equipment condition assessment coefficient is as follows:

[0046] ;

[0047] In the formula, This is the equipment condition assessment coefficient. This is the difference between the energy consumption within a set time period and the energy consumption within a set interval. This is the ratio of the number of alarms within a set time period to the number of alarms set within the set time period. This is a weighting factor for the difference between the energy consumption stored in the database and the set energy consumption parameters. This is a weighting factor for the ratio of the number of alarms within a set time period to the number of alarm parameters within the set time period, stored in the database. It is a natural constant.

[0048] In this implementation, an exponential function is used to handle deviations in energy consumption. This approach is more sensitive to large deviations, amplifying their impact and making even small changes significant in the evaluation. The combination of exponentiation and square root smooths the data while maintaining high sensitivity to outliers. The natural logarithm is used to handle the ratio of alarm counts. This method addresses relative changes in alarm counts, especially when the ratio is large; the logarithmic transformation prevents the value from becoming excessively large, helping to maintain the stability of the evaluation coefficients. The logarithmic transformation also improves the skewed distribution of the ratio data, making it closer to a normal distribution, facilitating analysis and calculation.

[0049] Weight factors stored in the database and This can be obtained through historical data analysis, specifically by collecting a large amount of historical data on power equipment under normal and fault conditions. Statistical analysis or machine learning methods, such as multiple regression analysis, are then used to assess the sensitivity and importance of changes in energy consumption and alarm frequency on equipment performance. These analyses help determine the relative weight of each factor in the overall equipment condition assessment, ensuring... and This reflects the true impact of energy consumption and alarm frequency on equipment health, thus making condition assessment more accurate and effective.

[0050] Specifically, the network communication data includes communication frequency, number of incomplete TCP three-way handshakes, and number of reconnections; the network communication parameter data includes parameterized communication frequency, number of incomplete TCP three-way handshakes, and number of parameterized reconnections. The process of fusing and analyzing the network communication data and the network communication parameter data to obtain the network communication evaluation coefficient includes the following steps: obtaining the difference between the communication frequency and the parameterized communication frequency; obtaining the ratio of the number of incomplete TCP three-way handshakes to the number of incomplete TCP three-way handshakes under parameterized conditions; obtaining the ratio of the number of reconnections to the number of parameterized reconnections; and determining the network communication evaluation coefficient based on the difference between the communication frequency and the parameterized communication frequency, the ratio of the number of incomplete TCP three-way handshakes to the number of incomplete TCP three-way handshakes under parameterized conditions, and the ratio of the number of reconnections to the number of parameterized reconnections.

[0051] Calculate the difference between the actual communication frequency and the preset (referenced) communication frequency. This difference indicates increases or decreases in network activity, reflecting changes in network load and bandwidth usage. Calculate the ratio of incomplete TCP three-way handshakes to the preset number. This ratio helps identify potential problems during network connection establishment, such as network latency, excessive server load, or misconfiguration. Calculate the ratio of actual reconnection counts to the preset reconnection counts. Frequent reconnections may indicate network instability or problems with the server or network equipment.

[0052] Based on the analysis results of the above three parameters, a comprehensive network communication evaluation coefficient is determined. This coefficient provides a quantitative indicator of network communication health by comprehensively considering changes in communication frequency, connection establishment success rate, and connection stability.

[0053] Communication frequency reflects the intensity of network activity and the amount of data traffic. A high communication frequency may indicate a heavy network load, while an unusually low frequency may indicate impaired network activity or equipment failure. The TCP three-way handshake is the standard procedure for establishing a TCP connection; the number of incomplete handshakes reflects connection attempts being interrupted or failing. This can be due to network latency, server unresponsiveness, or configuration errors. The reconnection count refers to the number of attempts to re-establish a connection after an interruption. Frequent reconnections may indicate an unstable network connection, requiring investigation of network equipment, server status, or external network environment issues.

[0054] Generally, high network frequency can lead to network congestion, increasing the likelihood of incomplete TCP three-way handshakes. Similarly, a large number of incomplete handshakes can, in turn, affect overall communication frequency as packets fail to be sent or received. A sudden drop in network frequency may indicate network instability, requiring frequent reconnections. Conversely, frequent reconnection attempts can also reduce effective communication frequency as they consume network resources and bandwidth. A comprehensive evaluation of these three parameters allows for a more complete understanding of the current network condition, identification of potential problems, and the implementation of appropriate measures to improve network stability and performance.

[0055] The formula for calculating the network communication evaluation coefficient is as follows:

[0056] ;

[0057] In the formula, This is a network communication evaluation coefficient. This is the difference between the communication frequency and the reference communication frequency. This is the ratio of the number of incomplete TCP three-way handshakes to the number of incomplete TCP three-way handshake parameter settings. This is the ratio of the number of reconnections to the predetermined number of reconnections. It is a natural constant.

[0058] In this implementation, an exponential function is used to handle the absolute value of the communication frequency difference. The application of the exponential function enhances sensitivity to large frequency differences, ensuring that any significant deviation will significantly affect the evaluation coefficient. The sum of the reciprocals of these two ratios is then processed using the reciprocal of the exponential function. This approach emphasizes that even small ratios (i.e., relatively few incomplete handshakes and reconnections) can significantly affect the evaluation coefficient, thereby increasing the ability to identify situations with high network stability. The two calculation results are then added together and incremented by one, followed by the natural logarithm. The use of the natural logarithm helps to scale and balance the results, keeping the evaluation coefficient within a reasonable range and avoiding distortion of the evaluation results due to extreme values ​​of any single indicator.

[0059] Specifically, the performance metric data includes CPU utilization and response latency, and the performance metric reference data includes CPU reference utilization and reference response latency. The process of fusing and analyzing the performance metric data and the performance metric reference data to obtain the performance metric evaluation coefficient includes the following steps: obtaining the difference between CPU utilization and CPU reference utilization; obtaining the ratio of response latency to reference response latency; and determining the performance metric evaluation coefficient based on the difference between CPU utilization and CPU reference utilization and the ratio of response latency to reference response latency.

[0060] Calculate the difference between actual CPU utilization and the preset (reference) CPU utilization. This difference reflects the deviation between CPU load and expected settings, indicating overload or underutilization. Calculate the ratio of actual response latency to the preset (reference) response latency. This ratio helps understand how well the system's response efficiency meets predetermined standards, reflecting the speed at which the system processes requests. Combine the difference in CPU utilization and the ratio of response latency to form a comprehensive performance evaluation coefficient. This coefficient provides a quantitative indicator of performance health by integrating the analysis results of these two key performance indicators.

[0061] CPU utilization is a key metric for measuring system resource utilization. It reflects the CPU's ability to process tasks and its current load. High CPU utilization may indicate that the system is handling a large number of tasks, while low utilization may mean that resources are not being fully utilized. Response latency is an important metric for measuring system responsiveness and directly affects user experience. Long latency may lead to user dissatisfaction, while short latency usually means that the system responds quickly and provides a good user experience. When CPU utilization is extremely high, the system may not have sufficient processing power to respond to new requests quickly, resulting in increased response latency. Conversely, long response latency may be due to the CPU being under high load or improper allocation of system resources.

[0062] The formula for calculating the performance index evaluation coefficient is as follows:

[0063] ;

[0064] In the formula, This is a performance evaluation coefficient. This is the difference between CPU utilization and the CPU default utilization. The ratio of response delay time to the specified response delay time. It is a natural constant.

[0065] In this implementation, the square root of the absolute value of the CPU utilization difference is used as the power of the exponent. This approach reduces the over-amplification effect of large differences while maintaining sensitivity to smaller differences, ensuring that even small deviations are appropriately reflected in the evaluation coefficients. Adding one to the ratio of response latency and taking the natural logarithm mitigates the drastic impact of ratio fluctuations, especially when... When the data is large, logarithmic processing can prevent the evaluation results from becoming excessively large, maintaining data stability and manageability. The formula comprehensively considers CPU load and system responsiveness, both key aspects of system performance. Combining these two processing methods provides a more comprehensive reflection of the system's performance.

[0066] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0067] This invention is described with reference to flowchart illustrations and / or block diagrams of systems, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0068] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0069] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0070] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0071] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A method for extracting features of power equipment protocol vulnerabilities, characterized in that, Includes the following steps: Retrieve several power equipment protocols with vulnerability characteristics from the authorized database; The power equipment protocols with vulnerability characteristics are applied one by one in the power equipment security testing; Obtain test datasets for power equipment during safety testing; Determine whether the power equipment is abnormal based on the test dataset during the safety testing process: If the power equipment is abnormal, the vulnerability features in the power equipment protocol corresponding to the power equipment security test are extracted and stored in the vulnerability feature database. If the power equipment is not abnormal, the vulnerability features in the power equipment protocol corresponding to the power equipment security test will not be extracted. The method of determining whether power equipment is abnormal based on test datasets during the safety testing process includes the following steps: Retrieve the parameterized test dataset stored in the database; By fusing and analyzing the parameter test dataset and the test dataset stored in the database, a test anomaly evaluation index is obtained. The step of fusing and analyzing the parameter test dataset and the test dataset stored in the database to obtain the test anomaly evaluation index includes the following steps: By fusing and analyzing equipment status data with equipment status parameter data, an equipment status evaluation coefficient can be obtained. By fusing and analyzing network communication data with network communication parameter data, network communication evaluation coefficients are obtained. By integrating and analyzing performance index data with performance index parameter data, performance index evaluation coefficients are obtained. By integrating and analyzing the equipment status evaluation coefficient, network communication evaluation coefficient, and performance index evaluation coefficient, a test anomaly evaluation index is obtained. The process of fusing and analyzing equipment status data with equipment status parameter data to obtain equipment status evaluation coefficients includes the following steps: Obtain the difference between the energy consumption within a set time period and the energy consumption within a set interval; Get the ratio of the number of alarms within a set time period to the number of alarms within a set time period; The equipment status evaluation coefficient is determined based on the difference between the energy consumption within a set time period and the energy consumption within a set time interval, and the ratio of the number of alarms within a set time period to the number of alarms within a set time period. The process of fusing and analyzing network communication data with network communication parameter data to obtain network communication evaluation coefficients includes the following steps: Obtain the difference between the communication frequency and the predetermined communication frequency; Get the ratio of the number of incomplete TCP three-way handshakes to the number of incomplete TCP three-way handshake parameters; Get the ratio of the number of reconnections to the parameterized number of reconnections; The network communication evaluation coefficient is determined based on the difference between the communication frequency and the reference communication frequency, the ratio of the number of incomplete TCP three-way handshakes to the reference number of incomplete TCP three-way handshakes, and the ratio of the number of reconnections to the reference number of reconnections. The process of fusing and analyzing performance index data with performance index parameter data to obtain performance index evaluation coefficients includes the following steps: Obtain the difference between CPU utilization and CPU default utilization; Obtain the ratio of the response delay time to the parameterized response delay time; The performance evaluation coefficients are determined based on the difference between CPU utilization and CPU default utilization, and the ratio of response latency to default response latency. The formula for calculating the test anomaly assessment index is as follows: ； In the formula, CyZ is the test anomaly evaluation index, Sx is the equipment status evaluation coefficient, Wx is the network communication evaluation coefficient, Xx is the performance index evaluation coefficient, α1 is the weight factor of the equipment status evaluation coefficient stored in the database, α2 is the weight factor of the network communication evaluation coefficient stored in the database, and α3 is the weight factor of the performance index evaluation coefficient stored in the database. The calculation formula for the performance index evaluation coefficient is as follows: ； In the formula, Xx is the performance evaluation coefficient, CP is the difference between CPU utilization and CPU reference utilization, Bt is the ratio of response latency to reference response latency, and e is the natural constant. The formula for calculating the network communication evaluation coefficient is as follows: ； In the formula, This is a network communication evaluation coefficient. This is the difference between the communication frequency and the reference communication frequency. This is the ratio of the number of incomplete TCP three-way handshakes to the number of incomplete TCP three-way handshake parameter settings. This is the ratio of the number of reconnections to the predetermined number of reconnections.

2. The method for extracting features of power equipment protocol vulnerabilities according to claim 1, characterized in that, The method of determining whether power equipment is abnormal based on test datasets during the safety testing process also includes: The test anomaly assessment index serves as the analytical basis for determining whether power equipment is abnormal. Retrieve the test anomaly evaluation thresholds stored in the database; The system determines whether power equipment is abnormal based on the test anomaly assessment threshold and test anomaly assessment index stored in the database.

3. The method for extracting features of power equipment protocol vulnerabilities according to claim 2, characterized in that, The method of determining whether power equipment is abnormal based on the test anomaly evaluation threshold and test anomaly evaluation index stored in the database includes the following steps: Determine whether the test anomaly evaluation threshold stored in the database is greater than the test anomaly evaluation index: If the test anomaly assessment threshold stored in the database is greater than the test anomaly assessment index, then the power equipment is judged to be abnormal. If the test anomaly assessment threshold stored in the database is not greater than the test anomaly assessment index, then the power equipment is determined to be normal.

4. The method for extracting features of power equipment protocol vulnerabilities according to claim 2, characterized in that: The test dataset includes device status data, network communication data, and performance index data. The parameter test dataset stored in the database includes device status parameter data, network communication parameter data, and performance index parameter data.

5. The method for extracting features of power equipment protocol vulnerabilities according to claim 4, characterized in that, The device status data includes energy consumption within a set time period and the number of alarms within a set time period. The device status parameter data includes energy consumption within a set time period and the number of alarms within a set time period.

6. The method for extracting features of power equipment protocol vulnerabilities according to claim 1, characterized in that, The network communication data includes communication frequency, number of incomplete TCP three-way handshakes, and number of reconnections. The network communication parameter data includes parameterized communication frequency, parameterized number of incomplete TCP three-way handshakes, and parameterized number of reconnections.

7. The method for extracting features of power equipment protocol vulnerabilities according to claim 1, characterized in that, The performance metrics data include CPU utilization and response latency, and the performance parameter data includes CPU parameter utilization and parameter response latency.

Images