Power grid system safety detection, tuning and maintenance method, system, medium and equipment

Abstract

The invention provides a power grid system safety detection, tuning and maintenance method and system, a medium and equipment, and belongs to the field of motor testing. The method comprises the steps of obtaining program data of a target power grid system, and determining an operation program of the target power grid system based on the program data; analyzing the running program by using a static analysis technology to obtain an object pointed by a pointer and a reachable boundary of a variable, and analyzing relevance between the pointer and the variable as well as between the pointer and the object; according to the source code, determining a detectable program execution path having homology with the to-be-maintained program; decompiling the to-be-maintained program, and determining a target gene segment; constructing a semantic segmentation model based on the target gene segment; based on the relevance between the variables and the objects, a program execution path and a semantic segmentation model can be detected, and safety monitoring is carried out on a target power grid system. According to the invention, the requirement of rapid and safe online of the information system can be met.

Description

Technical Field

[0001] The present invention relates to the technical field of motor testing, and in particular to a method, system, medium and equipment for safety detection, tuning and maintenance of a power grid system. Background Art

[0002] In recent years, network security incidents in power grid infrastructure have emerged one after another. As a national critical information infrastructure, the power industry is related to national security and the lifeline of the national economy. The information system of power companies is the basic element supporting the safe and stable operation of the power grid. Conducting in-depth security testing on the information system of power companies is an important measure to ensure the high-quality development of the power system.

[0003] With the rapid advancement of the company's digital transformation, various new applications have been launched in the new power system with new energy as the main body. The existence of security vulnerabilities and undeclared functions (backdoors) in the software is the root cause of frequent security incidents. Only by ensuring the security of the software source code itself through management and technical means can the safe and stable operation of the information system be ensured. At this stage, with the continuous evolution of development models and changes in information security trends, the software source code security defect analysis technology has been put forward to scale, automation and intelligence. Traditional source code detection technology can no longer meet the needs of rapid and safe launch of information systems. Summary of the invention

[0004] The embodiments of the present invention provide a method, system, medium and device for power grid system security detection, tuning and maintenance to solve the problem that traditional source code detection technology can no longer meet the requirements for rapid and secure online launch of information systems.

[0005] In a first aspect, an embodiment of the present invention provides a power grid system security detection method, comprising:

[0006] Acquiring program data of the target power grid system, and determining an operating program of the target power grid system based on the program data; wherein the program data includes source code;

[0007] Use static analysis technology to analyze the running program, obtain the objects pointed to by pointers and the reachable boundaries of variables, and analyze the association between pointers and variables and objects;

[0008] Based on the source code, determine the detectable program execution path that is homologous to the program to be maintained;

[0009] Decompile the program to be maintained and determine the target gene fragment; build a semantic segmentation model based on the target gene fragment;

[0010] Based on the correlation between variables and objects, detectable program execution paths and semantic segmentation models, the target power grid system is monitored for safety.

[0011] In a possible implementation, static analysis techniques are used to analyze program data to obtain objects pointed to by pointers and reachable boundaries of variables, and to analyze the associations between pointers and variables and objects, including:

[0012] Convert the source code in the program data into an abstract syntax tree, and construct a symbol table based on the abstract syntax tree; wherein the symbol table is used to record variables, pointers and objects in the program when the program data is running;

[0013] Track the flow of variables and pointers in the program when the program data is running, obtain the correlation between pointers and variables during the execution of program data, and the reachable boundaries of variables;

[0014] Analyze the reference relationship, the object pointed to, and the change relationship of the pointer to obtain the correlation between the pointer and the object.

[0015] In a possible implementation, converting source code in program data into an abstract syntax tree includes:

[0016] Inputting source code in the program data into a lexical analyzer to divide the source code into at least one lexical unit; wherein each lexical unit is different;

[0017] According to a preset grammar rule and a preset grammar definition, at least one lexical unit is arranged in sequence to form a tree-like data structure; wherein each node in the data structure represents a corresponding grammar structure;

[0018] Perform semantic processing on each node, detect semantic errors in the data structure, and correct the semantic errors to obtain an abstract syntax tree.

[0019] In a possible implementation, building a symbol table according to the abstract syntax tree includes:

[0020] Traverse the abstract syntax tree, identify and record information related to variables, pointers, and objects in each node, and build multiple linked list structures;

[0021] The relevant information of variables with the same name is entered into the same linked list structure, and multiple linked list structures after the relevant information of the variables are entered are combined into a symbol table for output.

[0022] In a possible implementation, after determining, according to the source code, a detectable program execution path having homology with the program to be maintained, the method further includes:

[0023] Establish multiple subtasks according to program data, and run the multiple subtasks in parallel to obtain a running program; wherein the multiple subtasks include key data structure detection, buffer overflow detection, memory leak detection and null pointer reference detection;

[0024] The detectable program execution paths with homology in the running program are analyzed respectively, and the multiple analysis results are summarized and fed back to the program development end to maintain the target power grid system.

[0025] In a possible implementation, the key data structure detection includes: detecting the data structure of the scope, detecting the data structure corresponding to the pointer and the variable, and extracting the pointer attribute information;

[0026] The scoped data structure detection includes: identifying the data structure with scope in the running program, and detecting whether there is a conflict between data structures with the same name in different scopes;

[0027] The data structure detection corresponding to the pointer and the variable includes: identifying the pointer and the variable in the running program, and obtaining the data structure type pointed to by the pointer and the variable;

[0028] Extracting the pointer attribute information includes: extracting the attribute information of the pointer variable from the running program.

[0029] In a possible implementation, the buffer overflow detection includes: inferring the boundary range of the buffer in the running program, analyzing the overflow possibility of the buffer by recursive solution for the program involving recursive calls therein;

[0030] Detect buffer overflow conditions in a program at run time based on the bounds and overflow probability of the program data.

[0031] In one possible implementation, memory leak detection includes:

[0032] Track memory allocation and deallocation operations;

[0033] Record the relevant information of allocated and released memory respectively;

[0034] Check the recorded memory allocation information and find the memory that has not been released;

[0035] After the detection is completed, the data structure used to record the memory allocation information is released.

[0036] In one possible implementation, null pointer reference detection includes:

[0037] In the static analysis phase, the source code is scanned, and if the first probability of a null pointer reference occurring in the source code is greater than a first preset probability, then there is a possibility of a null pointer reference occurring in the source code;

[0038] In the dynamic analysis phase, the value of the pointer variable is checked when the code is running through the instrumentation technology. If a null pointer is referenced, an error is reported;

[0039] During the compiler detection phase, null pointer reference checks are performed by the compiler;

[0040] During the unit testing phase, write test cases for possible null pointer references to check the robustness of the code.

[0041] In a possible implementation, the program to be maintained is decompiled to determine the target gene fragment; and a semantic segmentation model is constructed based on the target gene fragment, including:

[0042] Decompile the program to be maintained into the corresponding assembly code file;

[0043] Use assembly code analysis tools to perform pattern matching and control flow analysis on assembly code files, identify and extract target gene fragments with different functional characteristics, and create attribute vectors for each target gene fragment;

[0044] The attribute vector corresponding to the target gene fragment is used as training data to build a semantic segmentation model.

[0045] In a second aspect, an embodiment of the present invention provides a power grid system maintenance method, including:

[0046] Acquiring program data of the target power grid system, and determining an operating program of the target power grid system based on the program data; wherein the program data includes source code;

[0047] Use static analysis technology to analyze the running program, obtain the objects pointed to by pointers and the reachable boundaries of variables, and analyze the association between pointers and variables and objects;

[0048] Based on the source code, determine the detectable program execution path that is homologous to the program to be maintained;

[0049] Decompile the program to be maintained and determine the target gene fragment; build a semantic segmentation model based on the target gene fragment;

[0050] Based on the association between variables and objects, detectable program execution paths, and semantic segmentation models, maintenance operations are performed on the target power grid system.

[0051] In a third aspect, an embodiment of the present invention provides a method for adaptive tuning of a power grid system, which is applied to the power grid system security detection method of the first aspect, including:

[0052] According to the grammatical rules of different programming languages, the parser of the corresponding language is used; the code is formatted in the preprocessing stage to remove the content that does not affect the semantics; data flow analysis and control flow analysis are introduced, combined with the subtree matching optimization algorithm, to compare the code similarity.

[0053] In a possible implementation, data flow analysis and control flow analysis are introduced, combined with a subtree matching optimization algorithm, to perform code similarity comparison, including:

[0054] Obtaining an abstract syntax tree corresponding to the target power grid system source code; wherein the abstract syntax tree is generated by the power grid system security detection method provided in the first aspect;

[0055] Normalizing the source code to be compared by reducing the redundancy of the syntax tree, and converting the preprocessed source code to be compared into an abstract syntax tree corresponding to the source code to be compared;

[0056] The abstract syntax tree corresponding to the target power grid system source code and the abstract syntax tree to be compared are processed respectively by a hash function to obtain a first hash syntax tree and a second hash syntax tree;

[0057] Compare the first hash syntax tree and the second hash syntax tree to find subtrees with the same number of nodes, and map the same part of the syntax tree nodes back to the original code lines according to the syntax tree generation rules;

[0058] The similarity between the target power grid system source code and the source code to be compared is calculated using the similarity calculation formula. After the similarity value is obtained, it is compared with the preset threshold to determine whether the obtained similarity exceeds the preset threshold. If it exceeds the threshold, the two code segments are considered similar, otherwise they are considered dissimilar.

[0059] In a fourth aspect, an embodiment of the present invention provides a power grid system maintenance system, including:

[0060] An acquisition module, used to acquire program data of a target power grid system and determine an operation program of the target power grid system based on the program data; wherein the program data includes source code;

[0061] The correlation analysis module is used to analyze the running program using static analysis technology to obtain the objects pointed to by the pointer and the reachable boundaries of the variables, and analyze the correlation between the pointer and the variables and objects;

[0062] A source code pointing analysis module is used to determine a detectable program execution path that has homology with the program to be maintained based on the source code;

[0063] Software gene safety detection module, used to decompile the program to be maintained, determine the target gene fragments; and build a semantic segmentation model based on the target gene fragments;

[0064] The software genetic safety detection module is also used to perform maintenance operations on the target power grid system based on the correlation between variables and objects, detectable program execution paths and semantic segmentation models.

[0065] In a fifth aspect, an embodiment of the present invention provides an electronic device, comprising a processor and a memory communicatively connected to the processor and used to store processor executable instructions, wherein the processor is used to execute the method described in the first aspect, the second aspect or the third aspect above.

[0066] In the sixth aspect, an embodiment of the present invention provides a server, comprising at least one processor, and a memory communicatively connected to the processor, the memory storing instructions executable by the at least one processor, the instructions being executed by the processor so that the at least one processor executes the method described in the first aspect, the second aspect, or the third aspect above.

[0067] In the seventh aspect, an embodiment of the present invention provides a computer-readable storage medium storing a computer program, characterized in that: when the computer program is executed by a processor, it is used to implement the method described in the first aspect, the second aspect, or the third aspect above.

[0068] The embodiment of the present invention provides a method, system, medium and equipment for safety detection, tuning and maintenance of a power grid system, which has the following beneficial effects: through static analysis technology and analysis of compiled program information, the system can better understand the correlation between pointers, variables and objects, thereby improving the safety of the power grid system; using compiled program information to analyze detectable program execution paths with homology, it is helpful to discover potential safety hazards and perform timely maintenance, thereby improving the stability and reliability of the system; by decompiling the program to be maintained to obtain assembly code and extract gene fragments, marking the attribute vectors of the gene fragments, and constructing a semantic segmentation model, it is possible to achieve safety detection and effective maintenance of system genes, thereby reducing the risk of system vulnerabilities; with the help of the semantic segmentation model, the system can more intelligently understand and process the characteristics of gene fragments, realize intelligent maintenance of the power grid system, and improve the maintainability and sustainability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0070] Figure 1 is a flow chart of an implementation method of a power grid system safety detection method provided by an embodiment of the present invention;

[0071] Figure 2 is a flowchart of an implementation method of a power grid system maintenance method provided by an embodiment of the present invention;

[0072] Figure 3 is a flow chart of an implementation method of a power grid system adaptive tuning method provided by an embodiment of the present invention;

[0073] Figure 4 It is a structural schematic diagram of a power grid system maintenance system based on genetic safety detection provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0074] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present invention. However, it should be clear to those skilled in the art that the present invention may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present invention.

[0075] In order to make the purpose, technical solutions and advantages of the present invention more clear, specific embodiments will be described below in conjunction with the accompanying drawings.

[0076] Embodiment 1:

[0077] Figure 1 is a flowchart of the implementation of the power grid system security detection method provided by the embodiment of the present invention; Figure 1 As shown, the power grid system safety detection method includes:

[0078] Step 110: Acquire program data of the target power grid system, and determine an operating program of the target power grid system based on the program data; wherein the program data includes source code.

[0079] In this embodiment, the program data includes source code and running program data, and the running program data is run to obtain the running program of the target power grid system.

[0080] Step 120: Use static analysis technology to analyze the running program, obtain the object pointed to by the pointer and the reachable boundary of the variable, and analyze the correlation between the pointer and the variable and the object.

[0081] In this embodiment, static analysis technology is used to analyze pointers and variables in the system program to obtain the objects pointed to by the pointers and the reachable boundaries of the variables, and to analyze the associations between the pointers, variables and objects. Through static analysis technology and post-compilation program information analysis, the system can better understand the associations between pointers, variables and objects, thereby improving the security of the power grid system.

[0082] In some optional embodiments, in step 120, the program data is analyzed using static analysis technology to obtain the objects pointed to by the pointers and the reachable boundaries of the variables, and the associations between the pointers and the variables and objects are analyzed, which may include:

[0083] Step 121: Convert the source code in the program data into an abstract syntax tree, and construct a symbol table according to the abstract syntax tree; wherein the symbol table is used to record variables, pointers and objects in the program when the program data is running.

[0084] Step 122: Track the flow of variables and pointers in the program when the program data is running, obtain the correlation between the pointers and variables during the execution of the program data, and the reachable boundaries of the variables.

[0085] Step 123: Analyze the reference relationship, the object pointed to, and the change relationship of the pointer to obtain the association between the pointer and the object.

[0086] In this embodiment, the source code of the system program is converted into an abstract syntax tree, and a symbol table is constructed based on the abstract syntax tree to record all variables, pointers and objects in the program; by tracing the flow of variables and pointers in the program (tracing the flow of variables and pointers in the program can parse the execution process of the program and the data transfer path. The technology used in this embodiment is data flow analysis technology. Data flow analysis technology is a static analysis method that tracks the assignment, transfer and use of variables and pointers by constructing data flow graphs or data flow equations), the association between pointers and variables and the reachable boundaries of variables during program execution are obtained; and the reference relationship of the pointer, the object it points to and the change situation are analyzed to obtain the association between the pointer and the object.

[0087] In some optional embodiments, converting the source code in the program data into an abstract syntax in step 121 may include:

[0088] The source code in the program data is input into a lexical analyzer and divided into at least one lexical unit; wherein each lexical unit is different.

[0089] According to preset grammar rules and preset grammar definitions, at least one lexical unit is arranged in sequence to form a tree-like data structure; wherein each node in the data structure represents a corresponding grammar structure.

[0090] Perform semantic processing on each node, detect semantic errors in the data structure, and correct the semantic errors to obtain an abstract syntax tree.

[0091] In this embodiment, the source code of the system program is input into the lexical analyzer and divided into different lexical units, each of which stores corresponding keywords, identifiers, and operators. The lexical units are arranged in sequence to form a tree-like data structure according to preset grammatical rules and preset grammatical definitions using a grammatical analyzer, and each node in the data structure represents a corresponding grammatical structure (the grammatical structure includes expressions, statements, and functions). The semantic analyzer is used to perform semantic processing on each node, detect semantic errors in the data structure, and correct the errors. When the semantic errors of the data structure cannot be detected, the data structure is output as an abstract syntax tree.

[0092] Preset grammar rules and preset grammar definitions are used to define the legal structure and grammatical structure of a program. Preset grammar rules are a set of rules that define the legal statements and structures of a programming language. These rules describe the grammatical specifications that must be followed when writing code. Grammar rules are usually expressed in a formal way, and formal grammars or formal grammar representations such as Backus Normal Form (BNF) can be used. These rules define the combination of keywords, operators, statements, expressions, etc. in the language. Preset grammar definitions are documents or specifications that formally describe the grammatical rules of a programming language. They detail the grammatical structure and usage of each component of a programming language. Syntax definitions usually include the usage of keywords, the structure of statements, the form of expressions, etc. These definitions provide guidance for writing code that conforms to language specifications.

[0093] In some optional embodiments, constructing a symbol table according to an abstract syntax tree may include:

[0094] Traverse the abstract syntax tree, identify and record information related to variables, pointers, and objects in each node, and build multiple linked list structures.

[0095] The relevant information of variables with the same name is entered into the same linked list structure, and multiple linked list structures after the relevant information of the variables are entered are combined into a symbol table for output.

[0096] In this embodiment, the abstract syntax tree is traversed to identify and record declaration information, scope information, and type information between variables, pointers, and objects in each node; multiple linked list structures are constructed and relevant information of variables with the same name is entered into the same linked list structure, multiple linked lists are input into a hash table as values ​​of key-value pairs, corresponding variable names are input into the hash table as keys of key-value pairs, and the hash table is output as a symbol table.

[0097] Step 130: Determine, based on the source code, a detectable program execution path that is homologous to the program to be maintained.

[0098] In this embodiment, after the source code is compiled, the program information generated after the compilation is used to analyze the detectable program execution paths that are homologous to the program to be maintained; using the compiled program information to analyze the detectable program execution paths that are homologous helps to discover potential security risks and perform timely maintenance, thereby improving the stability and reliability of the system.

[0099] Since the program information generated after compilation includes: function call relationship, control flow information, variable alias information, pointer information, data dependency relationship and program interface, etc., it is necessary to detect the program data. Accordingly, after step 130, the following may also be included:

[0100] Multiple subtasks are established according to program data, and the multiple subtasks are run in parallel to obtain a running program; wherein the multiple subtasks include key data structure detection, buffer overflow detection, memory leak detection and null pointer reference detection.

[0101] The detectable program execution paths with homology in the running program are analyzed respectively, and the multiple analysis results are summarized and fed back to the program development end to maintain the target power grid system.

[0102] In this embodiment, the key data structure detection includes: data structure detection of scope, data structure detection corresponding to pointers and variables, and extraction of pointer attribute information.

[0103] Among them, the scoped data structure detection includes: traversing the abstract syntax tree generated according to the running program, identifying the data structure declaration statements with scope in the running program, querying and recording the data range of the corresponding data structure according to the data structure declaration statements, and detecting whether there are conflicts in data structures with the same name in different scopes.

[0104] The detection of data structures corresponding to pointers and variables includes: identifying pointer and variable declaration statements in the running program, analyzing the dereference operation of the pointer, obtaining the data structure type pointed to by the pointer variable, and recording the association between the pointer and the variable and the data structure it points to.

[0105] Extraction of pointer attribute information includes: identifying pointer variable declaration statements, obtaining pointer attribute information, analyzing pointer usage context, determining whether the pointer is frequently modified, checking whether the pointer points to statically allocated memory or dynamically allocated memory, and extracting pointer variable attribute information from the running program.

[0106] Buffer overflow detection includes: inferring the boundary range of the buffer in the running program, and analyzing the possibility of buffer overflow through recursive solution for the program involving recursive calls. Based on the boundary range and overflow possibility, the buffer overflow is detected in the program when the program data is running. That is, buffer overflow detection includes interval operation, recursive solution and overflow detection.

[0107] Specifically, interval operations: identify operations involving buffers in the running program, such as array access, string operations, etc.; perform interval operations based on the variable and constant information in the running program to infer the boundary range of the buffer; compare the boundary range of the buffer with the actual access location to detect whether there is a possibility of buffer overflow.

[0108] Recursive solution: Identify recursive calls in the running program, determine the termination conditions of the recursion and the law of recursive parameter changes; infer the boundary range of the buffer based on the law of recursive parameter changes; compare the boundary range of the buffer with the parameter values ​​in the actual recursive call to detect whether there is a possibility of buffer overflow.

[0109] Overflow detection: Determine the boundary range of the buffer based on the results of interval operations and recursive solutions; check the buffer access operations in the running program and compare the access position with the buffer boundary range; if the access position exceeds the buffer boundary range, a buffer overflow warning or error is issued.

[0110] Memory leak detection includes:

[0111] Allocation and deallocation tracking: Rewrite the standard memory allocation and deallocation functions (such as `malloc` and `free`) to use memory allocation and deallocation hook functions.

[0112] Record memory allocation information: Each time memory allocation is performed, the following information is recorded: the starting address of the memory block; the size of the memory block; the location information such as the file name and line number used for allocation.

[0113] Record memory release information: Each time memory is released, the validity of the release is confirmed by matching the address of the released memory block. The recorded release information includes: the starting address of the released memory block; if the released memory block cannot find a corresponding item in the record, it may indicate a memory leak.

[0114] Detect unreleased memory: Detect memory leaks at appropriate times during program execution, such as before the program exits or at regular checkpoints, including: checking whether there are unreleased memory blocks in the recorded memory allocation information; outputting warning or error messages to indicate that a memory leak has been found.

[0115] Report memory leaks: If a memory leak is detected, a corresponding report is generated. The report should include: the location information of the memory leak, i.e. the file name and line number; the size of the leaked memory block; other relevant context information; these reports can be output to the console, log file or other specified location for developers to view and fix.

[0116] Cleaning up and releasing resources: After the memory leak detection is completed, the data structure used to record memory allocation information and other related resources need to be released; this ensures that the memory leak detection itself does not introduce additional memory leaks; other related resources may include:

[0117] File handles: If a program has opened files, it needs to close these file handles when they are no longer in use to prevent resource leaks.

[0118] Network connections: If your program establishes network connections (such as sockets), you should ensure that these connections are closed properly when you terminate.

[0119] Threads: If your program creates threads, make sure to use appropriate methods to wait for the threads to end and release related resources before terminating.

[0120] Database connections: If your program interacts with a database, make sure you close the database connection when you are finished.

[0121] Graphics or audio resources: In graphics or audio programming, you may need to release resources such as textures, sound buffers, etc.

[0122] System resources: such as timers, events, semaphores, etc., which also need to be released when no longer needed.

[0123] Memory-mapped files: If you use memory-mapped files, make sure you unmap them when they are no longer needed.

[0124] User-defined resources: If you use custom data structures or resources, make sure all parts of them are properly released.

[0125] Null pointer reference detection requires different processes at different stages, specifically:

[0126] Static analysis phase: During the coding phase, a static code analysis tool is used to scan the source code. If the first probability of a null pointer reference in the source code is greater than the first preset probability, then there is a possibility of a null pointer reference in the source code. Static analysis tools identify potential null pointer reference issues by checking the control flow, data flow, and syntax structure of the code, and discover some issues that can be determined at compile time, but cannot cover all dynamic situations.

[0127] Dynamic analysis phase: During the runtime phase, the value of the pointer variable is checked by using the instrumentation technology while the code is running. If a null pointer is referenced, an error is reported.

[0128] Dynamic analysis tools monitor the value of pointer variables by inserting inspection code at key code locations. If a null pointer is found to be referenced, an error report will be triggered, which can capture some situations that are difficult to detect during static analysis, but may introduce some runtime overhead.

[0129] Compiler detection phase: During the compilation phase, null pointer reference checking is performed by the compiler.

[0130] The compiler will identify some obvious null pointer reference situations at compile time based on grammatical rules and static analysis information, such as direct null pointer dereference, providing a basic layer of protection, but it does not cover all situations.

[0131] During the unit testing phase, write test cases for possible null pointer references to check the robustness of the code.

[0132] Unit test cases should cover a variety of situations, including edge cases and special inputs that may lead to null pointer dereferences. Test cases can simulate null pointer situations and verify that the code handles these situations correctly.

[0133] Step 140: Decompile the program to be maintained to determine the target gene fragment; and construct a semantic segmentation model based on the target gene fragment.

[0134] In this embodiment, the program to be maintained is decompiled to obtain the corresponding assembly code, gene fragments carrying different functional characteristics are extracted from the assembly code, the attribute vectors of the gene fragments are marked, and a semantic segmentation model is constructed; by decompiling the program to be maintained to obtain the assembly code and extract the gene fragments, the attribute vectors of the gene fragments are marked, and the semantic segmentation model is constructed, the safety detection and effective maintenance of the system genes can be achieved, thereby reducing the risk of system vulnerabilities; and with the help of the semantic segmentation model, the system can understand and process the characteristics of the gene fragments more intelligently, realize the intelligent maintenance of the power grid system, and improve the maintainability and sustainability of the system.

[0135] In some optional embodiments, decompiling the program to be maintained in step 140 to determine the target gene fragment; and constructing a semantic segmentation model based on the target gene fragment may include:

[0136] Decompile the program to be maintained into the corresponding assembly code file.

[0137] The assembly code analysis tool is used to perform pattern matching and control flow analysis operations on the assembly code file, identify and extract target gene fragments with different functional characteristics, and create an attribute vector for each target gene fragment.

[0138] The attribute vector corresponding to the target gene fragment is used as training data to build a semantic segmentation model.

[0139] In this embodiment, step 140 can be described as: decompiling the program to be maintained: selecting an appropriate decompiling tool to decompile the program to be maintained into a corresponding assembly code file.

[0140] Extract target gene fragments with different functional characteristics: Use assembly code analysis tools to perform pattern matching, control flow analysis and other operations to identify and extract code fragments with different functional characteristics. This can be achieved by defining rules and patterns for functional characteristics.

[0141] Label the attribute vector of the target gene fragments: Create an attribute vector for each extracted target gene fragment, which should contain information about instruction type, register usage, memory access, etc.

[0142] Build a semantic segmentation model: Select an appropriate deep learning architecture (such as CNN, RNN) to build a semantic segmentation model, use the labeled target gene fragments as training data, and train the model to understand the semantics of the gene fragments.

[0143] Step 150: Based on the correlation between variables and objects, the detectable program execution path and the semantic segmentation model, the target power grid system is security monitored.

[0144] In this embodiment, step 150 can be implemented in the following manner:

[0145] Maintain the power grid system: Use the constructed semantic segmentation model to maintain the source code of the power grid system, including detecting potential defects, optimizing code structure, and improving code security. The semantic segmentation model will help to more accurately understand the functions and effects of code snippets.

[0146] Memory slicing technology: In the static code analysis phase, memory slicing technology is applied to locate memory-related code fragments, narrow the scope of detection targets, and reduce the complexity of analysis;

[0147] Semantic slicing technology: Semantic slicing technology is used to further narrow the scope of detection targets and consider the semantic relationship between code fragments to improve the accuracy of detection. This is achieved by comparing the semantic information of gene fragments.

[0148] Multi-layer type analysis: In the inter-procedural analysis phase, multi-level type information is used for analysis. Through in-depth type analysis, the understanding of the program is enhanced and the accuracy of slice construction is improved.

[0149] Accordingly, step 150 can integrate the target power grid system with the real-time data stream of the power grid, analyze the correlation between variables and objects in real time, and monitor the detectable program execution path. These two operations are to better find the fault point associated with the current fault, which is convenient for troubleshooting and maintenance.

[0150] After determining the fault point, the real-time data of the fault point is analyzed based on the constructed semantic segmentation model to identify abnormal conditions or potential security threats. Once an abnormality is detected, the alarm mechanism is triggered to notify relevant personnel for further inspection and response.

[0151] Embodiment 2:

[0152] Figure 2 is a flowchart of the implementation of the power grid system maintenance method provided by the embodiment of the present invention; Figure 2 As shown, the power grid system maintenance method includes:

[0153] Step 210: Acquire program data of the target power grid system, and determine an operating program of the target power grid system based on the program data; wherein the program data includes source code.

[0154] Step 220: Use static analysis technology to analyze the running program, obtain the objects pointed to by the pointers and the reachable boundaries of the variables, and analyze the associations between the pointers and the variables and objects.

[0155] Step 230: Determine, based on the source code, a detectable program execution path that is homologous to the program to be maintained.

[0156] Step 240: Decompile the program to be maintained to determine the target gene fragment; and construct a semantic segmentation model based on the target gene fragment.

[0157] Step 250: Perform maintenance operations on the target power grid system based on the association between variables and objects, the detectable program execution path and the semantic segmentation model.

[0158] Among them, this embodiment can refer to Figure 1 The relevant embodiments of the method for detecting the safety of the power grid system will not be described in detail here.

[0159] Embodiment three:

[0160] Figure 3 is a flowchart of the implementation of the power grid system adaptive tuning method provided by the embodiment of the present invention; the method is applicable to Figure 1 The power grid system security detection method shown in FIG. Figure 3 As shown, the adaptive tuning method of the power grid system includes:

[0161] Step 310: Use the parser of the corresponding language according to the grammatical rules of different programming languages.

[0162] Step 320: Format the code in the preprocessing stage to remove content that does not affect the semantics.

[0163] Step 330: Introduce data flow analysis and control flow analysis, and combine with subtree matching optimization algorithm to perform code similarity comparison.

[0164] In this embodiment, different programming languages ​​have different grammatical rules, so the characteristics of the language need to be considered when generating an abstract syntax tree. For example, although C++ and Java have similar syntax, there are still differences when generating an abstract syntax tree. Although AST can ignore the influence of code format to a certain extent, some changes in code format may change the structure of AST, such as blank characters, comments, etc. Therefore, the code needs to be preprocessed to make the format consistent. Simply comparing the structure of AST may not accurately determine the similarity of the code, because different codes may have the same AST structure. Therefore, it is necessary to combine other semantic analysis techniques, such as data flow analysis, control flow analysis, etc., to improve the accuracy of detection. Generating and comparing AST may require a lot of computing resources, especially for large code bases, it may take a long time. Therefore, it is necessary to consider the efficiency of the algorithm, and some optimization algorithms may need to be applied, such as tree hashing, subtree matching, etc. When judging whether two pieces of code are similar, a threshold needs to be set. The setting of the threshold needs to comprehensively consider factors such as the purpose of detection and the complexity of the code, and cannot be generalized. When generating AST, syntax errors in the code may be encountered. A corresponding error handling mechanism should be set to ensure that the error code does not affect the results of the similarity detection. Taking other efficiency factors into consideration, the project team found that in addition to the factors mentioned above, there are also several other factors that affect execution efficiency during the project research process, and they are followed and implemented throughout the project: the calling method of the interface; the efficiency of the parameters of functions and methods; and the efficiency of the data engine running the database.

[0165] In some optional embodiments, data flow analysis and control flow analysis are introduced, combined with a subtree matching optimization algorithm, to perform code similarity comparison, and the specific process includes:

[0166] Obtain the abstract syntax tree corresponding to the target power grid system source code; wherein the abstract syntax tree is obtained by Figure 2 The provided power grid system security detection method is generated.

[0167] The source code to be compared is normalized by reducing the redundancy of the syntax tree, and the preprocessed source code to be compared is converted into an abstract syntax tree to be compared.

[0168] The abstract syntax tree corresponding to the target power grid system source code and the abstract syntax tree to be compared are processed respectively by a hash function to obtain a first hash syntax tree and a second hash syntax tree.

[0169] The first hash syntax tree and the second hash syntax tree are compared to find subtrees with the same number of nodes, and according to the syntax tree generation rules, the same part of the syntax tree nodes are mapped back to the original code lines.

[0170] The similarity between the target power grid system source code and the source code to be compared is calculated using the similarity calculation formula. After the similarity value is obtained, it is compared with the preset threshold to determine whether the obtained similarity exceeds the preset threshold. If it exceeds the threshold, the two code segments are considered similar, otherwise they are considered dissimilar.

[0171] In this embodiment, the source code is converted into an abstract syntax tree through syntax parsing, and the similarity of two pieces of code is indirectly compared by comparing the similarity of the abstract syntax trees; by comparing the similarity with known vulnerability codes, potential security vulnerabilities are identified and repaired and reinforced in a timely manner.

[0172] Specifically, the source code is first preprocessed, and then the source code is normalized by reducing the redundancy of the syntax tree. During the normalization process, it is necessary to ensure that the semantics before and after the transformation are the same; the syntax tree is processed by the Hash function to obtain the Hash syntax trees of the two code fragments, and the tree structure is compressed into their respective array linked lists according to the relevant information of the syntax tree; the subtrees with the same number of nodes in the code fragment to be tested and the vulnerable code fragment are searched, and the two subtrees are compared using the Hash comparison algorithm to find the parts with the same species in the two trees, and then the code lines corresponding to the nodes in the syntax tree are found according to the syntax tree generation rules; the code similarity is judged by the similarity of the similarity calculation formula, and then compared with the threshold to make a judgment.

[0173] The similarity calculation includes:

[0174] The node definition format is as follows:

[0175] InfoNode k ∈{InfoNode k |N∈{T,N}};

[0176] The formula for calculating code snippet similarity is as follows:

[0177]

[0178] Among them, f(SNi ,ST i ) represents the i-th group of code fragments SN i and ST i The output of this function is usually a numerical value indicating the similarity between two pieces of code. i is the current program fragment to be detected, ST i It is a vulnerability program fragment recorded in history. i It is a fragment SN i LC is the number of valid lines of code in the target source code.

[0179] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0180] The following is a system embodiment of the present invention. For details not described in detail therein, reference may be made to the corresponding method embodiment described above.

[0181] Embodiment 4:

[0182] Figure 4 The following is a schematic diagram showing the structure of a power grid system maintenance system provided by an embodiment of the present invention. For ease of explanation, only the parts related to the embodiment of the present invention are shown, which are described in detail as follows:

[0183] like Figure 4 As shown, the power grid system maintenance system 4 includes:

[0184] An acquisition module (not marked in the figure), used to acquire program data of the target power grid system and determine the operating program of the target power grid system based on the program data; wherein the program data includes source code;

[0185] The correlation analysis module is used to analyze the running program using static analysis technology to obtain the objects pointed to by the pointer and the reachable boundaries of the variables, and analyze the correlation between the pointer and the variables and objects;

[0186] A source code pointing analysis module is used to determine a detectable program execution path that has homology with the program to be maintained based on the source code;

[0187] Software gene safety detection module, used to decompile the program to be maintained, determine the target gene fragments; and build a semantic segmentation model based on the target gene fragments;

[0188] The software genetic safety detection module is also used to perform maintenance operations on the target power grid system based on the correlation between variables and objects, detectable program execution paths and semantic segmentation models.

[0189] Embodiment five:

[0190] An embodiment of the present invention further provides an electronic device, comprising a processor and a memory that is communicatively connected to the processor and is used to store instructions executable by the processor, wherein the processor is used to execute the method described in any one of the above-mentioned embodiments 1, 2 or 3.

[0191] Embodiment six:

[0192] A server, characterized in that it includes at least one processor and a memory communicatively connected to the processor, the memory storing instructions executable by the at least one processor, the instructions being executed by the processor so that the at least one processor executes the method described in any one of Embodiment 1, Embodiment 2, or Embodiment 3.

[0193] Embodiment seven:

[0194] A computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the method described in any one of Embodiment 1, Embodiment 2, or Embodiment 3 is implemented.

[0195] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0196] Those of ordinary skill in the art will appreciate that the templates, units, and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0197] If the module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, it can implement the steps of the above-mentioned various power grid system security detection methods, power grid system adaptive tuning methods and power grid system maintenance method embodiments. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device that can carry the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory, random access memory, electrical carrier signal, telecommunication signal and software distribution medium.

[0198] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A power grid system security detection method, characterized in that: include: Acquire program data of a target power grid system, and determine an operation program of the target power grid system based on the program data; wherein the program data includes source code; Analyze the running program using static analysis technology to obtain the object pointed to by the pointer and the reachable boundary of the variable, and analyze the correlation between the pointer and the variable and the object; Determine, based on the source code, a detectable program execution path having homology with the program to be maintained; Decompiling the program to be maintained to determine the target gene fragment; and constructing a semantic segmentation model based on the target gene fragment; Based on the correlation between the variable and the object, the detectable program execution path and the semantic segmentation model, the target power grid system is security monitored.

2. The power grid system security detection method according to claim 1, characterized in that: The using of static analysis technology to analyze the program data to obtain the object pointed to by the pointer and the reachable boundary of the variable, and analyzing the association between the pointer and the variable and the object, includes: Converting source code in the program data into an abstract syntax tree, and constructing a symbol table according to the abstract syntax tree; wherein the symbol table is used to record variables, pointers and objects in the program when the program data is running; Tracking the flow of the variable and the pointer in the program when the program data is running, obtaining the association between the pointer and the variable during the execution of the program data, and the reachable boundary of the variable; The reference relationship, the object pointed to and the change relationship of the pointer are analyzed to obtain the association between the pointer and the object.

3. The power grid system safety detection method according to claim 2, characterized in that: The converting the source code in the program data into an abstract syntax tree includes: Inputting the source code in the program data into a lexical analyzer to divide it into at least one lexical unit; wherein each lexical unit is different; According to a preset grammar rule and a preset grammar definition, the at least one lexical unit is arranged in sequence to form a tree-like data structure; wherein each node in the data structure represents a corresponding grammar structure; Each node is semantically processed to detect semantic errors in the data structure, and the semantic errors are corrected to obtain an abstract syntax tree.

4. The power grid system safety detection method according to claim 2, characterized in that: The step of constructing a symbol table according to the abstract syntax tree comprises: Traversing the abstract syntax tree, identifying and recording information related to variables, pointers, and objects in each node, and constructing multiple linked list structures; The relevant information of variables with the same name is entered into the same linked list structure, and multiple linked list structures after the relevant information of the variables are entered are combined into a symbol table for output.

5. The power grid system security detection method according to claim 1, characterized in that: After determining the detectable program execution path having homology with the program to be maintained according to the source code, the method further includes: Establishing a plurality of subtasks according to the program data, and running the plurality of subtasks in parallel to obtain a running program; wherein the plurality of subtasks include key data structure detection, buffer overflow detection, memory leak detection and null pointer reference detection; Analyze the detectable program execution paths with homology in the running program respectively, summarize and feed back the obtained multiple analysis results to the program development end, so as to maintain the target power grid system.

6. The power grid system safety detection method according to claim 5, characterized in that: The key data structure detection includes: scope data structure detection, pointer and variable corresponding data structure detection, and pointer attribute information extraction; The scope data structure detection includes: identifying the data structure with scope in the running program, and detecting whether there is a conflict between data structures with the same name in different scopes; The data structure detection corresponding to the pointer variable includes: identifying the pointer and the variable in the running program, and obtaining the data structure type pointed to by the pointer and the variable; The extracting of the pointer attribute information includes: extracting the attribute information of the pointer variable from the running program.

7. The power grid system safety detection method according to claim 5, characterized in that: The buffer overflow detection includes: inferring the boundary range of the buffer in the running program, and analyzing the overflow possibility of the buffer by recursive solution for the program involving recursive calls; The buffer overflow situation is detected in the program when the program data is running based on the boundary range and the overflow possibility.

8. The power grid system safety detection method according to claim 5, characterized in that: The memory leak detection includes: Track memory allocation and deallocation operations; Recording the relevant information of the memory allocated and released respectively; Check the recorded memory allocation information and find the memory that has not been released; After the detection is completed, the data structure used to record the memory allocation information is released.

9. The power grid system safety detection method according to claim 5, characterized in that: The null pointer reference detection includes: In the static analysis stage, the source code is scanned, and if a first probability of a null pointer reference occurring in the source code is greater than a first preset probability, then a null pointer reference may occur in the source code; In the dynamic analysis phase, the value of the pointer variable is checked when the code is running through the instrumentation technology. If a null pointer is referenced, an error is reported; During the compiler detection phase, null pointer reference checks are performed by the compiler; During the unit testing phase, write test cases for possible null pointer references to check the robustness of the code.

10. The power grid system safety detection method according to claim 1, characterized in that: Decompiling the program to be maintained to determine the target gene fragment; Constructing a semantic segmentation model based on the target gene fragment includes: Decompiling the program to be maintained into a corresponding assembly code file; Using an assembly code analysis tool, performing pattern matching and control flow analysis operations on the assembly code file, identifying and extracting target gene fragments with different functional characteristics, and creating an attribute vector for each target gene fragment; The attribute vector corresponding to the target gene fragment is used as training data to construct a semantic segmentation model.

11. A method for maintaining a power grid system, characterized in that: include: Acquire program data of a target power grid system, and determine an operation program of the target power grid system based on the program data; wherein the program data includes source code; Analyze the running program using static analysis technology to obtain the object pointed to by the pointer and the reachable boundary of the variable, and analyze the correlation between the pointer and the variable and the object; Determine, based on the source code, a detectable program execution path having homology with the program to be maintained; Decompiling the program to be maintained to determine the target gene fragment; and constructing a semantic segmentation model based on the target gene fragment; Based on the association between the variable and the object, the detectable program execution path and the semantic segmentation model, a maintenance operation is performed on the target power grid system.

12. A method for adaptive tuning of a power grid system, applied to the power grid system security detection method as claimed in claim 2, characterized in that: include: According to the grammatical rules of different programming languages, use the parser of the corresponding language; Format the code in the preprocessing stage to remove content that does not affect the semantics; Data flow analysis and control flow analysis are introduced, combined with subtree matching optimization algorithm, to perform code similarity comparison.

13. The method for adaptive tuning of a power grid system according to claim 12, characterized in that: The data flow analysis and control flow analysis are introduced, combined with the subtree matching optimization algorithm, to perform code similarity comparison, including: Obtaining an abstract syntax tree corresponding to the target power grid system source code; wherein the abstract syntax tree is generated by the power grid system security detection method according to claim 2; Normalizing the source code to be compared by reducing the redundancy of the syntax tree, and converting the preprocessed source code to be compared into an abstract syntax tree to be compared; The abstract syntax tree corresponding to the target power grid system source code and the abstract syntax tree to be compared are processed respectively by a hash function to obtain a first hash syntax tree and a second hash syntax tree; Compare the first hash syntax tree and the second hash syntax tree to find subtrees with the same number of nodes, and map the same part of the syntax tree nodes back to the original code lines according to the syntax tree generation rule; The similarity between the target power grid system source code and the source code to be compared is calculated by a similarity calculation formula. After the similarity value is obtained, it is compared with a preset threshold to determine whether the obtained similarity exceeds the preset threshold. If it exceeds the preset threshold, the two code segments are determined to be similar, otherwise they are considered to be dissimilar.

14. A power grid system maintenance system based on genetic safety detection, characterized in that: include: An acquisition module, configured to acquire program data of a target power grid system and determine an operation program of the target power grid system based on the program data; wherein the program data includes source code; A correlation analysis module, used to analyze the running program using static analysis technology, obtain the object pointed to by the pointer and the reachable boundary of the variable, and analyze the correlation between the pointer and the variable and the object; A source code pointing analysis module is used to determine, based on the source code, a detectable program execution path having homology with the program to be maintained; A software gene safety detection module is used to decompile the program to be maintained, determine the target gene fragment, and construct a semantic segmentation model based on the target gene fragment; The software gene safety detection module is also used to perform maintenance operations on the target power grid system based on the correlation between the variable and the object, the detectable program execution path and the semantic segmentation model.

15. An electronic device, comprising a processor and a memory connected to the processor for storing instructions executable by the processor, characterized in that: The processor is used to execute the method described in any one of claims 1-10 or 11 or 12-13.

16. A server, characterized in that: It includes at least one processor and a memory communicatively connected to the processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the processor so that the at least one processor executes the method according to any one of claims 1-10 or 11 or 12-13.

17. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 10 or 11 or 12 to 13 is implemented.

Images