Information security protection method and system for electric power monitoring system of hydraulic power plant

Abstract

The embodiment of the invention relates to the technical field of information security protection, and provides an information security protection method and system for a hydraulic power plant electric power monitoring system, and the method comprises the steps: carrying out the semantic analysis of a to-be-detected software code in the hydraulic power plant electric power monitoring system through employing an artificial intelligence technology based on deep learning; a control flow graph of a software code to be detected is constructed, advanced semantic extraction and information transfer aggregation are performed on each node and a control flow edge in the control flow graph, and an internal logic and behavior mode of the code is deeply mined, so that accurate identification and prevention of potential malicious codes are realized; the information safety protection capability of the hydraulic power plant electric power monitoring system is effectively improved, and stable operation of the electric power system is ensured.

Description

Technical Field

[0001] The present disclosure relates to the technical field of information security protection, and in particular to an information security protection method and system for a power monitoring system of a hydropower plant. Background Art

[0002] With the rapid development of science and technology, hydropower plants, as important energy supply bases, have increasingly prominent information security issues in their power monitoring systems. In recent years, the attack techniques and means against the production control systems of power companies have been constantly upgraded, and various malicious software such as viruses, Trojans, worms, and hacker attacks have emerged in an endless stream, bringing severe security threats and challenges to the production control systems of hydropower plants.

[0003] The network structure of a hydropower plant usually adopts a hierarchical distribution and open network system structure, including a typical three-layer structure of the main control layer, the communication layer, and the ground layer. Hydropower plants are gradually developing in the direction of intelligence and wisdom. However, while this intelligent construction improves production efficiency, it also brings significant information security risks. For example, attackers may destroy the normal operation of the power monitoring system by implanting malicious code, thereby affecting the stability and security of the power grid.

[0004] At present, existing malicious code prevention methods mostly rely on traditional signature detection and feature matching technology, which is often difficult to deal with new and variant malicious code attacks, and seems powerless when facing rapidly evolving network threats. Summary of the invention

[0005] The present disclosure aims to solve at least one of the problems existing in the prior art and to provide an information security protection method and system for a hydropower plant power monitoring system.

[0006] In one aspect of the present disclosure, there is provided an information security protection method for a hydropower plant power monitoring system, the information security protection method comprising:

[0007] Obtain the software code to be tested in the power monitoring system of the hydropower plant;

[0008] Constructing a control flow graph of the software code to be detected;

[0009] Performing semantic feature extraction and feature association optimization on each node in the control flow graph to obtain a set of node optimized semantic coding feature vectors;

[0010] Performing one-hot encoding on each edge in the control flow graph to obtain a set of one-hot encoded feature vectors of the control flow edges;

[0011] Performing information transfer aggregation on the set of node optimization semantic coding feature vectors and the set of control flow edge one-hot coding feature vectors to obtain a control flow semantic coding feature matrix of the software code to be detected;

[0012] Based on the control flow semantic encoding feature matrix of the software code to be detected, it is determined whether to delete the software code to be detected.

[0013] Optionally, semantic feature extraction and feature association optimization are performed on each node in the control flow graph to obtain a set of node optimized semantic coding feature vectors, including:

[0014] Performing semantic coding on each node in the control flow graph to obtain a set of node semantic coding feature vectors;

[0015] The set of node semantic coding feature vectors is input into a feature association optimization network based on sequence endogenous correlation semantic measurement to obtain the set of node optimized semantic coding feature vectors.

[0016] Optionally, semantic encoding is performed on each node in the control flow graph to obtain a set of node semantic encoding feature vectors, including:

[0017] Each node in the control flow graph is input into a semantic encoder based on the Bert model to obtain a set of semantic encoding feature vectors of the node.

[0018] Optionally, the set of node semantic coding feature vectors is input into a feature association optimization network based on sequence endogenous correlation semantic measurement to obtain the set of node optimized semantic coding feature vectors, including:

[0019] Calculating a semantic association score vector between any two node semantic encoding feature vectors in the set of node semantic encoding feature vectors to obtain a set of semantic association score vectors;

[0020] Determining a sequence endogenous correlation global representation vector based on the set of semantic association score vectors;

[0021] Based on the sequence endogenous correlation global representation vector, calculating the association optimization factor of each node semantic coding feature vector in the set of node semantic coding feature vectors to obtain a set of association optimization factors;

[0022] Inputting the set of association optimization factors into a Softmax activation function to obtain a set of association optimization weight factors;

[0023] Taking each associated optimization weight factor in the set of associated optimization weight factors as a weight, each node semantic coding feature vector in the set of node semantic coding feature vectors is weighted respectively to obtain the set of node optimized semantic coding feature vectors.

[0024] Optionally, calculating a semantic association score vector between any two node semantic encoding feature vectors in the set of node semantic encoding feature vectors to obtain a set of semantic association score vectors includes:

[0025] Any two node semantic coding feature vectors in the set of node semantic coding feature vectors are cascaded and multiplied by a weight coefficient matrix, and then added to a bias vector to obtain the semantic association score vector.

[0026] Optionally, determining a sequence endogenous correlation global representation vector based on the set of semantic association score vectors includes:

[0027] The mean vector of the set of the semantic association score vectors is calculated to obtain the global representation vector of the sequence endogenous correlation.

[0028] Optionally, based on the sequence endogenous correlation global representation vector, calculating the association optimization factor of each node semantic encoding feature vector in the set of node semantic encoding feature vectors to obtain a set of association optimization factors includes:

[0029] The node semantic coding feature vector and the sequence endogenous correlation global representation vector are multiplied by different weight coefficient vectors respectively and then added to obtain a semantic correlation coefficient;

[0030] The semantic association coefficient is added with a bias parameter and then activated by a sigmoid function to obtain the association optimization factor.

[0031] Optionally, information transfer aggregation is performed on the set of node optimization semantic coding feature vectors and the set of control flow edge one-hot coding feature vectors to obtain a control flow semantic coding feature matrix of the software code to be detected, including:

[0032] The set of node optimization semantic coding feature vectors and the set of control flow edge one-hot coding feature vectors are input into a software code global semantic encoder based on a graph convolutional neural network model to obtain the control flow semantic coding feature matrix of the software code to be detected.

[0033] Optionally, determining whether to delete the software code to be detected based on the control flow semantic coding feature matrix of the software code to be detected includes:

[0034] Inputting the control flow semantic encoding feature matrix of the software code to be detected into a classifier-based code detector to obtain a code detection result, wherein the code detection result is used to indicate whether the software code to be detected is malicious code;

[0035] In response to the code detection result indicating that the software code to be detected is malicious code, the software code to be detected is deleted.

[0036] Another aspect of the present disclosure provides an information security protection system for a hydropower plant power monitoring system, the information security protection system comprising:

[0037] An acquisition module, used to acquire the software code to be detected in the power monitoring system of the hydropower plant;

[0038] A construction module, used for constructing a control flow graph of the software code to be detected;

[0039] An optimization module, used for performing semantic feature extraction and feature association optimization on each node in the control flow graph to obtain a set of node optimized semantic coding feature vectors;

[0040] An encoding module, used for performing one-hot encoding on each edge in the control flow graph to obtain a set of one-hot encoded feature vectors of the control flow edges;

[0041] An aggregation module, used for performing information transfer aggregation on the set of node optimization semantic coding feature vectors and the set of control flow edge one-hot coding feature vectors to obtain a control flow semantic coding feature matrix of the software code to be detected;

[0042] The determination module is used to determine whether to delete the software code to be detected based on the control flow semantic coding feature matrix of the software code to be detected.

[0043] Compared with the prior art, the present invention adopts artificial intelligence technology based on deep learning to perform semantic analysis on the software code to be detected in the power monitoring system of a hydropower plant. By constructing a control flow graph of the software code to be detected and performing high-level semantic extraction and information transmission aggregation on each node and control flow edge in the control flow graph, the inherent logic and behavior pattern of the code are deeply excavated to achieve accurate identification and prevention of potential malicious code, effectively improving the information security protection capability of the power monitoring system of the hydropower plant and ensuring the stable operation of the power system. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplifications do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0045] Figure 1 A flowchart of an information security protection method for a hydropower plant power monitoring system provided in one embodiment of the present disclosure;

[0046] Figure 2 A data flow diagram of an information security protection method for a hydropower plant power monitoring system provided by another embodiment of the present disclosure;

[0047] Figure 3 A flowchart of step S3 in an information security protection method for a hydropower plant power monitoring system provided in another embodiment of the present disclosure;

[0048] Figure 4 A schematic structural diagram of an information security protection system for a hydropower plant power monitoring system provided in another embodiment of the present disclosure. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical scheme and advantages of the embodiments of the present disclosure clearer, the embodiments of the present disclosure will be described in detail below in conjunction with the accompanying drawings. However, it can be understood by those skilled in the art that in each embodiment of the present disclosure, many technical details are proposed in order to enable readers to better understand the present disclosure. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed for protection in the present disclosure can also be implemented. The division of the following embodiments is for the convenience of description and should not constitute any limitation on the specific implementation of the present disclosure. The various embodiments can be combined and referenced with each other without contradiction.

[0050] Unless the context clearly indicates an exception, the words "a", "an", "an" and / or "the" do not refer to the singular and may also include the plural. Generally speaking, the terms "include" and "comprise" only indicate the inclusion of the steps and elements that have been clearly identified, and these steps and elements do not constitute an exclusive list. The method or device may also include other steps or elements.

[0051] Although the present disclosure makes various references to certain modules in the system according to embodiments of the present disclosure, any number of different modules can be used and run on a user terminal and / or server. The modules are illustrative only, and different aspects of the systems and methods can use different modules.

[0052] The present disclosure uses a flow chart to illustrate the operations performed by the method according to the embodiments of the present disclosure. It should be understood that the preceding or following operations are not necessarily performed precisely in order. On the contrary, various steps may be processed in reverse order or simultaneously as required. At the same time, other operations may also be added to these processes, or one or more operations may be removed from these processes.

[0053] At present, the existing malicious code prevention methods mostly rely on traditional signature detection and feature matching technology, which is often difficult to deal with new and variant malicious code attacks, and is powerless in the face of rapidly evolving network threats. Therefore, the disclosed embodiment provides an information security protection method and system for a hydropower plant power monitoring system to enhance the information security protection capability of the hydropower plant power monitoring system and ensure the stable operation of the power system.

[0054] One embodiment of the present disclosure relates to an information security protection method for a hydropower plant power monitoring system, the process of which is as follows: Figure 1 As shown, the data flow is as follows Figure 2 shown.

[0055] Combined Figure 1 and Figure 2 The information security protection method of the hydropower plant power monitoring system provided in this embodiment includes the following steps:

[0056] Step S1, obtaining the software code to be detected in the power monitoring system of the hydropower plant.

[0057] Step S2: construct a control flow graph of the software code to be detected.

[0058] Specifically, software code is the cornerstone for executing various functions in the power monitoring system. In order to fully understand the logical structure, implemented functions and potential security risks of the software code to be detected, this embodiment deeply analyzes its internal logic by constructing a control flow graph of the software code to be detected in the power monitoring system of a hydropower plant. A control flow graph is a graphical representation method for representing the execution path of all basic blocks in a program. It has a unique entry node START and a unique exit node STOP. In addition to the entry node / exit node, the remaining intermediate nodes represent code statements or predicate expressions in the program, where the predicate refers to an operation that can return True or False. The edges in the control flow graph represent the control flow relationship between each basic block in the program, that is, the path to transfer to another basic block after a basic block is executed. By constructing a control flow graph of the software code to be detected, the execution process of the code can be clearly displayed, the logical relationship and data flow between each code block can be understood, and a deeper and more comprehensive view of code behavior is provided, which helps to dig out the potential malicious behavior of the code in depth to achieve accurate identification of malicious code.

[0059] Step S3, performing semantic feature extraction and feature association optimization on each node in the control flow graph to obtain a set of node optimized semantic coding feature vectors.

[0060] For example, Figure 3 As shown, step S3 specifically includes:

[0061] Step S31, semantically encode each node in the control flow graph to obtain a set of node semantic encoding feature vectors.

[0062] Specifically, each node in the control flow graph represents each execution statement in the program and has a specific code logic. In order to fully extract the semantic information of these nodes, step S31 can further use a pre-trained natural language processing model to semantically encode each node, convert the language description in the code into a high-level semantic feature representation, capture the content meaning of each code statement, and generate a set of node semantic encoding feature vectors to provide rich semantic information support for subsequent malicious code detection.

[0063] Exemplarily, step S31 may include: inputting each node in the control flow graph into a semantic encoder based on the Bert model to obtain a set of semantic encoding feature vectors of the node.

[0064] Specifically, the BERT model uses the Transformer architecture to learn contextual representations of text. Unlike previous language models (such as ELMo and GPT), BERT is bidirectional, which means it can consider both the left and right contexts of the text.

[0065] For example, in step S31, when each node in the control flow graph is input into a semantic encoder based on the Bert model to obtain a set of semantic encoding feature vectors of the node, it can be specifically implemented by the following steps: input the control flow graph; for each node, extract its corresponding text content; input the extracted text into the BERT semantic encoder; obtain the semantic encoding feature vector of the node text from the BERT semantic encoder to obtain the set of semantic encoding feature vectors of the node.

[0066] Step S32: input the set of node semantic coding feature vectors into a feature association optimization network based on sequence endogenous correlation semantic measurement to obtain the set of node optimized semantic coding feature vectors.

[0067] Considering that each statement in the code does not exist in isolation, but has a certain intrinsic semantic connection. Therefore, in order to improve the accuracy of feature representation and avoid the influence of interference technologies such as code obfuscation and shelling, step S32 introduces a feature association optimization network based on the semantic measurement of endogenous correlation of the sequence to process the set of node semantic coding feature vectors, and optimizes the features based on the semantic association relationship between each node, so as to more accurately express the semantic information of each code statement. Specifically, the feature association optimization network first quantifies the similarity or difference between any two node semantic coding feature vectors by calculating the semantic association between them, so as to understand the semantic structure inside the sequence and generate a set of semantic association score vectors. Then, the aggregate information of the set of semantic association score vectors is used as the overall context information to calculate the association optimization factor of each node semantic coding feature vector, and the consistency or deviation of the semantic feature quantity of each node and the overall semantic structure of the sequence is quantitatively described, so as to serve as a guide for feature association optimization. Furthermore, after the association optimization factor is normalized, it is used as a weight coefficient to perform weighted optimization on the original set of node semantic coding feature vectors, so as to improve the representativeness and discrimination of the feature, and obtain a set of node optimized semantic coding feature vectors.

[0068] In other words, step S32 may specifically include: calculating the semantic association score vector between any two node semantic coding feature vectors in the set of node semantic coding feature vectors to obtain a set of semantic association score vectors; determining the global representation vector of sequence intrinsic correlation based on the set of semantic association score vectors; calculating the association optimization factor of each node semantic coding feature vector in the set of node semantic coding feature vectors based on the global representation vector of sequence intrinsic correlation to obtain a set of association optimization factors; inputting the set of association optimization factors into the Softmax activation function to obtain a set of association optimization weight factors; using each association optimization weight factor in the set of association optimization weight factors as a weight, weighting each node semantic coding feature vector in the set of node semantic coding feature vectors respectively to obtain the set of node optimized semantic coding feature vectors.

[0069] Among them, calculating the semantic association score vector between any two node semantic coding feature vectors in the set of node semantic coding feature vectors to obtain the set of semantic association score vectors further includes: cascading any two node semantic coding feature vectors in the set of node semantic coding feature vectors and multiplying them by a weight coefficient matrix, and then adding them with a bias vector to obtain the semantic association score vector.

[0070] Determining a global representation vector of sequence intrinsic correlation based on the set of semantic association score vectors further includes: calculating a mean vector of the set of semantic association score vectors to obtain the global representation vector of sequence intrinsic correlation.

[0071] Based on the global representation vector of the intrinsic correlation of the sequence, the association optimization factor of each node semantic coding feature vector in the set of node semantic coding feature vectors is calculated to obtain a set of association optimization factors, further including: multiplying the node semantic coding feature vector and the global representation vector of the intrinsic correlation of the sequence by different weight coefficient vectors and then performing addition operations to obtain semantic association coefficients; adding a bias parameter to the semantic association coefficient and then passing the result through a sigmoid activation function to obtain the association optimization factor.

[0072] That is, step S32 may include: processing the set of node semantic coding feature vectors according to the following semantic feature association optimization formula to obtain the set of node optimized semantic coding feature vectors, wherein the semantic feature association optimization formula is:

[0073] X={x1,x2,...,x n}

[0074] r h =W h [x i ;x j ]+b h

[0075]

[0076] G i =Softmax[Sigmoid(M m R+H m x i +b m )]

[0077] {f 1i}={G i ·x i}

[0078] Where X represents the set of node semantic encoding feature vectors, x1, x2, x i 、x j and x n represents the first, second, i-th, ith and n-th node semantic coding feature vectors in the set of node semantic coding feature vectors respectively, the value of n is the number of feature vectors in the set of node semantic coding feature vectors, [·,·] represents a cascade operation, W h is the weight coefficient matrix, b his the bias vector, r h is the hth basic information word granularity semantic association score vector in the set of semantic association score vectors, the value of T is the number of vectors in the set of semantic association score vectors, R is the global representation vector of the sequence endogenous correlation, M m and H m Represent different weight coefficient vectors, b m is the bias parameter, Sigmoid is the sigmoid activation function, Softmax is the normalized exponential function, G i is the i-th correlation optimization factor, f 1i Represents the optimized semantic encoding feature vector of the i-th node.

[0079] Step S4, performing one-hot encoding on each edge in the control flow graph to obtain a set of control flow edge one-hot encoding feature vectors.

[0080] Specifically, considering that each edge in the control flow graph represents a jump or conditional branch in the program execution process, and these edges are usually discrete and non-numerical, in order to convert these discrete jump information into numerical features that can be used for subsequent analysis to meet the input requirements of the machine learning algorithm, step S4 uses the one-hot encoding technology to encode each edge in the control flow graph. By assigning a unique binary vector to each possible discrete information, it has a unique feature representation in the vector space, thereby obtaining the numerical feature representation of the edge, that is, the set of one-hot encoding feature vectors of the control flow edge. It is worth mentioning that one-hot encoding is an encoding method that converts categorical variables into binary vectors. For categorical variables with N different categories, one-hot encoding creates a binary vector of length N, in which only the elements corresponding to the variable category are 1, and the rest of the elements are 0.

[0081] Step S5, performing information transfer aggregation on the set of node optimization semantic coding feature vectors and the set of control flow edge one-hot coding feature vectors to obtain a control flow semantic coding feature matrix of the software code to be detected.

[0082] Specifically, by combining the node information and edge information in the control flow graph, a global understanding of the overall execution logic and behavior pattern of the code to be detected can be achieved.

[0083] For example, step S5 can use a software code global semantic encoder based on a graph convolutional neural network (GCN) model to process the set of node optimization semantic encoding feature vectors and the set of control flow edge one-hot encoding feature vectors. The graph convolutional neural network updates the representation of the current node by aggregating the information of neighboring nodes layer by layer, and takes into account the edge information in this process. It can effectively mine a wider range of contextual information, capture the local connection relationship between nodes and the global structural characteristics of the control flow graph, thereby generating a control flow semantic encoding feature matrix of the software code to be detected, providing more comprehensive and in-depth code behavior information for malicious code detection. It is worth mentioning that the graph convolutional neural network is a deep learning model specifically used to process graph structured data. The basic idea of ​​GCN is to generalize the convolution operation from Euclidean data (such as images) to graph data. In Euclidean data, the convolution operation extracts local features by applying a filter on a sliding window on the data. In graph data, GCN uses a graph convolution layer to extract local features of nodes and their neighbors.

[0084] Exemplarily, step S5 includes: inputting the set of node optimization semantic encoding feature vectors and the set of control flow edge one-hot encoding feature vectors into a software code global semantic encoder based on a graph convolutional neural network model to obtain the control flow semantic encoding feature matrix of the software code to be detected.

[0085] For example, step S5 can be performed by the following steps: inputting the set of node optimized semantic encoding feature vectors and the set of control flow edge one-hot encoding feature vectors into the software code global semantic encoder based on the graph convolutional neural network model to obtain the control flow semantic encoding feature matrix of the software code to be detected: inputting the set of node optimized semantic encoding feature vectors and the set of control flow edge one-hot encoding feature vectors; representing the control flow graph as a graph, wherein the nodes are optimized semantic encoding feature vectors and the edges are one-hot encoded control flow edge feature vectors; inputting the created graph into the GCN model and performing forward propagation; obtaining the embedding of each node from the GCN model, i.e., the control flow semantic encoding feature vector; merging the embeddings of all nodes into a matrix to obtain the control flow semantic encoding feature matrix of the software code to be detected.

[0086] Step S6: determining whether to delete the software code to be detected based on the control flow semantic coding feature matrix of the software code to be detected.

[0087] Exemplarily, step S6 may include: inputting the control flow semantic coding feature matrix of the software code to be detected into a code detector based on a classifier to obtain a code detection result, wherein the code detection result is used to indicate whether the software code to be detected is malicious code. This step may specifically include: expanding the control flow semantic coding feature matrix of the software code to be detected into a classification feature vector based on a row vector or a column vector; performing full connection encoding on the classification feature vector using multiple fully connected layers of the classifier to obtain an encoded classification feature vector; processing the encoded classification feature vector through the Softmax classification function of the classifier to obtain the code detection result.

[0088] Specifically, the label of the classifier may include deleting the software code to be detected (first label), and not deleting the software code to be detected (second label), wherein the classifier determines which classification label the control flow semantic encoding feature matrix of the software code to be detected belongs to through a soft maximum function. It is worth noting that the first label p1 and the second label p2 here do not contain artificially set concepts. In fact, during the training process, the computer model does not have the concept of "whether to delete the software code to be detected". It only has two classification labels and the probability of outputting features under these two classification labels, that is, the sum of p1 and p2 is one. Therefore, the classification result of whether to delete the software code to be detected is actually converted into a binary classification class probability distribution that conforms to the laws of nature through the classification label. In essence, the physical meaning of the natural probability distribution of the label is used, rather than the linguistic text meaning of "whether to delete the software code to be detected".

[0089] Step S6 may further include: in response to the code detection result indicating that the software code to be detected is malicious code, deleting the software code to be detected.

[0090] Specifically, a classifier-based code detector is used to classify the control flow semantic encoding feature matrix of the software code to be detected, and the software code to be detected can be divided into two categories: malicious code and normal code, and a code detection result is generated. If the code detection result indicates that the software code to be detected is malicious code, the software code to be detected is deleted to prevent it from threatening the safe operation of the power monitoring system.

[0091] Compared with the prior art, the information security protection method for the power monitoring system of a hydropower plant provided in the embodiment of the present disclosure adopts artificial intelligence technology based on deep learning to perform semantic analysis on the software code to be detected in the power monitoring system of a hydropower plant. By constructing a control flow graph of the software code to be detected and performing high-level semantic extraction and information transfer aggregation on each node and control flow edge in the control flow graph, the inherent logic and behavior pattern of the code are deeply excavated to achieve accurate identification and prevention of potential malicious code, thereby effectively improving the information security protection capability of the power monitoring system of a hydropower plant and ensuring the stable operation of the power system.

[0092] Another embodiment of the present disclosure relates to an information security protection system for a hydropower plant power monitoring system, such as Figure 4 As shown, including:

[0093] The acquisition module 410 is used to acquire the software code to be detected in the power monitoring system of the hydropower plant.

[0094] The construction module 420 is used to construct a control flow graph of the software code to be detected.

[0095] The optimization module 430 is used to extract semantic features and optimize feature association of each node in the control flow graph to obtain a set of node optimized semantic coding feature vectors.

[0096] The encoding module 440 is used to perform one-hot encoding on each edge in the control flow graph to obtain a set of one-hot encoded feature vectors of the control flow edges.

[0097] The aggregation module 450 is used to perform information transfer aggregation on the set of node optimization semantic coding feature vectors and the set of control flow edge one-hot coding feature vectors to obtain a control flow semantic coding feature matrix of the software code to be detected.

[0098] The determination module 460 is used to determine whether to delete the software code to be detected based on the control flow semantic coding feature matrix of the software code to be detected.

[0099] The specific implementation method of the information security protection system of the hydropower plant power monitoring system provided in the embodiment of the present disclosure can be found in the information security protection method of the hydropower plant power monitoring system provided in the embodiment of the present disclosure, and will not be repeated here.

[0100] Compared with the prior art, the information security protection system of the hydropower plant power monitoring system provided in the embodiment of the present disclosure adopts artificial intelligence technology based on deep learning to perform semantic analysis on the software code to be detected in the hydropower plant power monitoring system, constructs a control flow graph of the software code to be detected, and performs high-level semantic extraction and information transfer aggregation on each node and control flow edge in the control flow graph, so as to deeply explore the inherent logic and behavior pattern of the code, so as to realize the accurate identification and prevention of potential malicious code, effectively improve the information security protection capability of the hydropower plant power monitoring system, and ensure the stable operation of the power system.

[0101] The basic principles of the technical solutions provided by the present disclosure are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present disclosure are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. must be possessed by each embodiment of the present disclosure. In addition, the specific details of the above embodiments are only for the purpose of illustration and ease of understanding, rather than limitation, and the above details do not limit the present disclosure to being implemented by adopting the above specific details.

[0102] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, please refer to the relevant description of other embodiments. In the several embodiments provided in the present disclosure, it should be understood that the disclosed system and method can be implemented in other ways. For example, the system embodiment described above is only schematic. For example, the module division is only a logical function division, and there may be other division methods in actual implementation. The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0103] In addition, each functional module in each embodiment of the present disclosure may be integrated into one processing unit, each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional modules.

[0104] Those skilled in the art will appreciate that the above-mentioned embodiments are specific embodiments for implementing the present disclosure, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present disclosure.

[0105] In addition, it is obvious that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. The multiple units included in the system can also be implemented by one unit through software or hardware.

[0106] Finally, it should be noted that the above description has been given for the purpose of illustration and description. In addition, the above embodiments are only used to illustrate the technical solution of the present disclosure and are not intended to limit it. Although the present disclosure is described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solution of the present disclosure can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present disclosure.

Claims

1. An information security protection method for a hydropower plant power monitoring system, characterized in that: The information security protection method comprises: Obtain the software code to be tested in the power monitoring system of the hydropower plant; Constructing a control flow graph of the software code to be detected; Performing semantic feature extraction and feature association optimization on each node in the control flow graph to obtain a set of node optimized semantic coding feature vectors; Performing one-hot encoding on each edge in the control flow graph to obtain a set of one-hot encoded feature vectors of the control flow edges; Performing information transfer aggregation on the set of node optimization semantic coding feature vectors and the set of control flow edge one-hot coding feature vectors to obtain a control flow semantic coding feature matrix of the software code to be detected; Based on the control flow semantic coding feature matrix of the software code to be detected, it is determined whether to delete the software code to be detected.

2. The information security protection method according to claim 1, characterized in that: Semantic feature extraction and feature association optimization are performed on each node in the control flow graph to obtain a set of node optimized semantic coding feature vectors, including: Performing semantic coding on each node in the control flow graph to obtain a set of node semantic coding feature vectors; The set of node semantic coding feature vectors is input into a feature association optimization network based on sequence endogenous correlation semantic measurement to obtain the set of node optimized semantic coding feature vectors.

3. The information security protection method according to claim 2, characterized in that: Semantically encode each node in the control flow graph to obtain a set of node semantic encoding feature vectors, including: Each node in the control flow graph is input into a semantic encoder based on the Bert model to obtain a set of semantic encoding feature vectors of the node.

4. The information security protection method according to claim 2, characterized in that: Inputting the set of node semantic coding feature vectors into a feature association optimization network based on sequence endogenous correlation semantic measurement to obtain the set of node optimized semantic coding feature vectors, including: Calculating a semantic association score vector between any two node semantic encoding feature vectors in the set of node semantic encoding feature vectors to obtain a set of semantic association score vectors; Determining a sequence endogenous correlation global representation vector based on the set of semantic association score vectors; Based on the sequence endogenous correlation global representation vector, calculating the association optimization factor of each node semantic coding feature vector in the set of node semantic coding feature vectors to obtain a set of association optimization factors; Inputting the set of association optimization factors into a Softmax activation function to obtain a set of association optimization weight factors; Taking each associated optimization weight factor in the set of associated optimization weight factors as a weight, each node semantic coding feature vector in the set of node semantic coding feature vectors is weighted respectively to obtain the set of node optimized semantic coding feature vectors.

5. The information security protection method according to claim 4, characterized in that: Calculating the semantic association score vector between any two node semantic encoding feature vectors in the set of node semantic encoding feature vectors to obtain a set of semantic association score vectors, including: Any two node semantic coding feature vectors in the set of node semantic coding feature vectors are cascaded and multiplied by a weight coefficient matrix, and then added to a bias vector to obtain the semantic association score vector.

6. The information security protection method according to claim 4, characterized in that: Determining a sequence endogenous correlation global representation vector based on the set of semantic association score vectors includes: The mean vector of the set of the semantic association score vectors is calculated to obtain the global representation vector of the sequence endogenous correlation.

7. The information security protection method according to claim 4, characterized in that: Based on the sequence endogenous correlation global representation vector, the association optimization factor of each node semantic coding feature vector in the set of node semantic coding feature vectors is calculated to obtain a set of association optimization factors, including: The node semantic coding feature vector and the sequence endogenous correlation global representation vector are multiplied by different weight coefficient vectors respectively and then added to obtain a semantic correlation coefficient; The semantic association coefficient is added with a bias parameter and then activated by a sigmoid function to obtain the association optimization factor.

8. The information security protection method according to claim 1, characterized in that: The set of the node optimization semantic coding feature vectors and the set of the control flow edge one-hot coding feature vectors are aggregated by information transfer to obtain a control flow semantic coding feature matrix of the software code to be detected, including: The set of node optimization semantic coding feature vectors and the set of control flow edge one-hot coding feature vectors are input into a software code global semantic encoder based on a graph convolutional neural network model to obtain a control flow semantic coding feature matrix of the software code to be detected.

9. The information security protection method according to claim 1, characterized in that: Determining whether to delete the software code to be detected based on the control flow semantic coding feature matrix of the software code to be detected includes: Inputting the control flow semantic encoding feature matrix of the software code to be detected into a code detector based on a classifier to obtain a code detection result, wherein the code detection result is used to indicate whether the software code to be detected is malicious code; In response to the code detection result indicating that the software code to be detected is malicious code, the software code to be detected is deleted.

10. An information security protection system for a hydropower plant power monitoring system, characterized in that: The information security protection system comprises: An acquisition module, used to acquire the software code to be detected in the power monitoring system of the hydropower plant; A construction module, used for constructing a control flow graph of the software code to be detected; An optimization module, used for performing semantic feature extraction and feature association optimization on each node in the control flow graph to obtain a set of node optimized semantic coding feature vectors; An encoding module, used for performing one-hot encoding on each edge in the control flow graph to obtain a set of one-hot encoded feature vectors of the control flow edges; An aggregation module, used for performing information transfer aggregation on the set of node optimization semantic coding feature vectors and the set of control flow edge one-hot coding feature vectors to obtain a control flow semantic coding feature matrix of the software code to be detected; The determination module is used to determine whether to delete the software code to be detected based on the control flow semantic coding feature matrix of the software code to be detected.

Images