Business automation logic vulnerability detection method based on deep learning

Abstract

The invention discloses a business automation logic vulnerability detection method based on deep learning, and relates to the technical field of electric digital data processing. The business automation logic vulnerability detection method based on deep learning comprises the following steps of power data collection, model training, model function evaluation and parameter tuning. The method comprises the following steps: acquiring a logic vulnerability data set and a verification data set by collecting power data of a preset power grid, performing model training on a power dispatching vulnerability detection model, and then inputting a preset power data sample set into the power dispatching vulnerability detection model for vulnerability detection to obtain a model function evaluation index; finally, whether the model function evaluation index is larger than a set model function threshold value or not is judged, if yes, the detection result continues to be monitored, if not, parameter tuning is conducted on the power dispatching vulnerability detection model, the effect of improving the logic vulnerability detection accuracy is achieved, and the problem that in the prior art, logic vulnerability detection accuracy is low is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic digital data processing, and in particular to a business automation logic vulnerability detection method based on deep learning. Background Art

[0002] With the advent of the big data era and the significant improvement of computing power, deep learning, as an important branch of artificial intelligence, has gradually shown great potential in many fields with its powerful feature learning ability and complex pattern recognition ability, especially in image recognition, natural language processing and speech recognition. It learns and understands the complex characteristics of data through a multi-level neural network structure, and has the ability to process large-scale data and solve complex problems. In the field of information security, traditional logic vulnerability detection methods often rely on manual rules or expert experience, which is not only inefficient but also difficult to cope with increasingly complex business logic and diverse attack methods. Therefore, researchers have begun to explore the application of deep learning technology in business automation logic vulnerability detection. In recent years, combining machine learning and deep learning technology, researchers have begun to explore the use of neural networks to identify and analyze logical vulnerabilities in the system, and improve the accuracy and coverage of detection by learning a large number of code bases and vulnerability samples. The purpose is to improve the accuracy and efficiency of vulnerability detection through automation and intelligence, and provide a more solid guarantee for the security of business systems. This method trains deep learning models to automatically learn and identify potential logical vulnerabilities in the code, thereby achieving comprehensive and efficient security detection of business systems. At the same time, the development of these technologies and methods indicates that in the field of software development and security, the use of deep learning for automated logical vulnerability detection will become one of the important trends in the future.

[0003] In the prior art, deep mining and the use of the powerful feature extraction and complex pattern recognition capabilities of deep learning models are used to automatically detect logical vulnerabilities, where the deep learning model is trained to automatically analyze the source code, extract key code features, and identify logical errors or design defects that cause security risks. The deep learning model covers a wide range of code bases and business scenarios, timely discovers and reports potential security risks, and provides strong support for the company's information security defense line. Compared with traditional manual audits or rule-based detection methods, automated logical vulnerability detection based on deep learning has greatly improved detection efficiency and achieved improved information security work efficiency. For example, the software vulnerability anomaly intelligent detection system and method announced by the invention patent with announcement number: CN111353160B. For example, a vulnerability detection method and system based on deep learning is announced by the invention patent with announcement number: CN107885999B.

[0004] However, in the process of implementing the technical solution of the invention in the embodiments of the present application, the present application found that the above technology has at least the following technical problems:

[0005] In the prior art, the library call candidate code segments are first extracted from the training program, type labels are added to the candidate code segments, and the candidate code segments are converted into vectors. These vectors are then input into the neural network model for training, and finally a vulnerability classifier is output. The annotation quality of the data set directly affects the training effect of the neural network model. If the annotation is inaccurate or erroneous, the model will learn wrong information, which will affect the detection capability of the neural network model and result in low accuracy in logic vulnerability detection. Summary of the invention

[0006] The embodiments of the present application solve the problem of low accuracy of logic vulnerability detection in the prior art by providing a business automation logic vulnerability detection method based on deep learning, thereby improving the accuracy of logic vulnerability detection.

[0007] The embodiment of the present application provides a business automation logic vulnerability detection method based on deep learning, comprising the following steps: S1, collecting power data of a preset power grid during the power supply process and performing data processing to obtain a logic vulnerability data set and a verification data set; S2, using the logic vulnerability data set to train a power dispatch vulnerability detection model, and inputting a preset power data sample set into the power dispatch vulnerability detection model to perform vulnerability detection to obtain a vulnerability detection result; S3, comparing the vulnerability detection result with the known number of logic vulnerability samples of the preset power data sample set to obtain a model function evaluation index, and judging whether the model function evaluation index is greater than a set model function threshold, if so, continue to monitor the vulnerability detection result, otherwise execute S4, the model function evaluation index is used to evaluate the detection capability level of the power dispatch vulnerability detection model for the power dispatch vulnerability corresponding to the preset power data sample set; S4, by inputting the verification data set into the power dispatch vulnerability detection model, the power dispatch vulnerability detection model is parameter tuned, and the parameter tuning includes learning rate tuning and regularization parameter tuning. .

[0008] Furthermore, the specific steps for obtaining the number of preset power dispatching logic vulnerabilities are as follows: at each preset time point within the preset time period, the power generation of the preset power grid is obtained through the grid-side electric meter, the power generation of the preset power grid represents the power generation of the preset power grid generator set in the preset time period, and the power generation of the power grid is used to measure the power supply level of the preset power grid; at each preset time point within the preset time period, the power consumption of the preset power grid is obtained through the power consumption side electric meter, the power consumption represents the power consumption of the preset power grid in the preset time period; if the power generation of the power grid at the preset time point is 0, the power generation failure judgment value at the preset time point is 1, otherwise the power generation failure judgment value at the preset time point is 0; if the power generation of the power grid at the preset time point is not 0 and the power generation of the power grid is less than the power consumption, the power generation shortage judgment value at the preset time point is 1, otherwise the power generation shortage judgment value at the preset time point is 0; the preset power dispatching logic vulnerabilities are obtained according to the power generation shortage judgment value and the power generation failure judgment value at the preset time point, and the expression of the preset power dispatching logic vulnerabilities is:

[0009]

[0010] Where MX represents the number of preset power dispatch logic vulnerabilities, t represents the sequence number of the preset time point in the preset time period, t=1,2,...,T, T represents the total number of preset time points in the preset time period, and Z 1t represents the power generation shortage judgment value at the t-th preset time point, Z 2t Indicates the power generation failure judgment value at the t-th preset time point.

[0011] Furthermore, the specific steps for obtaining the model function evaluation index are as follows: within a preset time period, the preset power data sample set is input into the power dispatch vulnerability detection model to perform vulnerability detection to obtain the vulnerability detection result; the model function evaluation index is obtained based on the correct vulnerability detection amount, the incorrect vulnerability detection amount and the missing vulnerability detection amount obtained from the vulnerability detection result; the correct vulnerability detection amount represents the number of samples correctly detected as vulnerabilities by the power dispatch vulnerability detection model in the vulnerability detection result; the incorrect vulnerability detection amount represents the number of samples in the vulnerability detection result that the power dispatch vulnerability detection model mistakenly judges normal samples as vulnerabilities; the missing vulnerability detection amount represents the number of actual vulnerability samples in the vulnerability detection result that the power dispatch vulnerability detection model fails to detect.

[0012] Furthermore, the model function evaluation index is specifically calculated using the following formula:

[0013]

[0014] Where GN represents the model function evaluation index, e represents a natural constant, m represents the number of vulnerability detections within the preset time period, m = 1, 2, ..., M, M represents the total number of vulnerability detections, y 1m represents the correct detection amount of the vulnerability in the mth vulnerability detection, y 2m represents the number of false detections of the vulnerability in the mth vulnerability detection, y 3m Represents the vulnerability detection missing amount of the m-th vulnerability detection.

[0015] Furthermore, the specific steps for setting the model function threshold are as follows: using a current sensor to measure the maximum current and the minimum current of the preset power grid in a preset time period to obtain a power load value; inputting the preset power data sample set into the power dispatching vulnerability detection model for vulnerability detection, and obtaining a response time value based on the start time of the vulnerability detection and the result output time; obtaining a throughput value based on the output of the power dispatching vulnerability detection model within the preset time period, and combining the obtained throughput with the power load value and the response time value to obtain a model function threshold, wherein the throughput value represents the number of samples in the power data sample set detected by the power dispatching vulnerability detection model.

[0016] Furthermore, the model function threshold is specifically calculated using the following formula:

[0017]

[0018] In the formula, YZ represents the model function threshold, e represents the natural constant, k1 represents the power load value, k2 represents the response time value, k3 represents the throughput value, and k4 represents the preset time period.

[0019] One or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages:

[0020] 1. By collecting the power data of the preset power grid, a logical vulnerability data set and a verification data set are obtained, and the power dispatching vulnerability detection model is trained. Then, the preset power data sample set is input into the power dispatching vulnerability detection model for vulnerability detection to obtain the model function evaluation index. Finally, it is determined whether the model function evaluation index is greater than the set model function threshold. If so, the detection results are continued to be monitored. Otherwise, the parameters of the power dispatching vulnerability detection model are optimized, thereby improving the accuracy of logical vulnerability detection and effectively solving the problem of low accuracy of logical vulnerability detection in the prior art.

[0021] 2. By inputting the preset power data sample set into the power dispatch vulnerability detection model within a preset time period to perform vulnerability detection, the vulnerability detection results are obtained, and then the correct vulnerability detection amount, the incorrect vulnerability detection amount and the missing vulnerability detection amount are obtained according to the vulnerability detection results. Finally, the model function evaluation index is obtained according to the obtained data, thereby realizing the numerical evaluation of the power dispatch vulnerability detection model function, and then realizing a more accurate evaluation of the power dispatch vulnerability detection model function.

[0022] 3. The maximum current and the minimum current of the preset power grid in the preset time period are measured by the current sensor to obtain the power load value, and the preset power data sample set is input into the power dispatch vulnerability detection model for vulnerability detection. The response time value is obtained according to the start time of the vulnerability detection and the result output time, and then the throughput value is obtained according to the output of the power dispatch vulnerability detection model in the preset time period. Finally, the model function threshold is obtained by combining the power load value and the response time value, thereby realizing the numerical evaluation of logic vulnerability detection, and then realizing a more accurate evaluation of logic vulnerability detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 A flow chart of a business automation logic vulnerability detection method based on deep learning provided in an embodiment of the present application;

[0024] Figure 2 A statistical diagram of changes in the model function threshold provided in the embodiment of the present application;

[0025] Figure 3 A process diagram of parameter tuning provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] The embodiment of the present application solves the problem of low accuracy of logic vulnerability detection in the prior art by providing a business automation logic vulnerability detection method based on deep learning. The method collects power data of a preset power grid during the power supply process and performs data processing to obtain a logic vulnerability data set and a verification data set, and uses the logic vulnerability data set to train a power dispatch vulnerability detection model. At the same time, the preset power data sample set is input into the power dispatch vulnerability detection model to perform vulnerability detection to obtain a vulnerability detection result. The vulnerability detection result and the known number of logic vulnerability samples of the preset power data sample set are then compared to obtain a model function evaluation index. Finally, it is determined whether the model function evaluation index is greater than the set model function threshold. If so, the vulnerability detection result continues to be monitored. Otherwise, the parameters of the power dispatch vulnerability detection model are optimized, thereby improving the accuracy of logic vulnerability detection.

[0027] The technical solution in the embodiment of the present application is to solve the problem of low accuracy of the above-mentioned logic vulnerability detection, and the overall idea is as follows:

[0028] By collecting the power data of the preset power grid, the logical vulnerability data set and the verification data set are obtained, and the power dispatching vulnerability detection model is trained. Then, the preset power data sample set is input into the power dispatching vulnerability detection model for vulnerability detection to obtain the model function evaluation index. Finally, it is determined whether the model function evaluation index is greater than the set model function threshold. If so, the detection results are continued to be monitored. Otherwise, the parameters of the power dispatching vulnerability detection model are optimized, thereby achieving the effect of improving the accuracy of logical vulnerability detection.

[0029] In order to better understand the above technical solution, the above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0030] like Figure 1 As shown, it is a flow chart of a business automation logic vulnerability detection method based on deep learning provided by an embodiment of the present application, and the method includes the following steps: S1, collecting power data of a preset power grid during the power supply process and performing data processing to obtain a logic vulnerability data set and a verification data set, the logic vulnerability data set is used to perform model training on a power dispatching vulnerability detection model, the verification data set is used to perform model verification on the power dispatching vulnerability detection model, and the power dispatching vulnerability detection model is used to automatically detect logic vulnerabilities in power dispatching of a preset power grid; S2, using the logic vulnerability data set to perform model training on the power dispatching vulnerability detection model, and inputting the preset power data sample set into the power dispatching vulnerability detection model to perform vulnerability detection to obtain vulnerability detection results, the preset power sample data set includes a known number of logic vulnerability samples and normal samples without logic vulnerabilities; S3, comparing the vulnerability detection results with the preset power data The model function evaluation index is obtained according to the known number of logical vulnerability samples in the sample set, and it is determined whether the model function evaluation index is greater than the set model function threshold. If so, the vulnerability detection results continue to be monitored, otherwise S4 is executed. The function evaluation index is used to evaluate the detection capability level of the power dispatching vulnerability detection model for the power dispatching vulnerability corresponding to the preset power data sample set, and the model function threshold is used to determine the accuracy of the power dispatching vulnerability detection model in detecting logical vulnerabilities; S4, the parameters of the power dispatching vulnerability detection model are tuned by inputting the verification data set into the power dispatching vulnerability detection model. The parameter tuning includes learning rate tuning and regularization parameter tuning. Parameter tuning is used to optimize the performance level of the power dispatching vulnerability detection model. The learning rate tuning is used to control the amplitude of parameter updates of the power dispatching vulnerability detection model in each iteration, and the regularization parameter tuning is used to balance the feature complexity of the power dispatching vulnerability detection model.

[0031] In this embodiment, the power dispatch vulnerability detection model is a deep convolutional neural network in the deep learning model; it is preset that logical vulnerabilities may exist in each link of the power supply process of the power grid, including power production, transmission, distribution and management; the power production demand is closely coordinated with the power demand, but there may be errors in predicting the power demand, resulting in oversupply or undersupply of electricity, and the power generation equipment may be shut down due to improper maintenance or sudden failure, affecting the stable supply of electricity; the transmission line may fail due to natural disasters, man-made damage or equipment aging, resulting in power outages. As a key node for power transmission and distribution, the operating status of the substation directly affects the stability of the power supply; problems such as unreasonable layout of the distribution network, aging of equipment or insufficient capacity may lead to uneven power distribution and voltage fluctuations, affecting the user Household electricity quality; a large amount of power data stored in the power system may be leaked due to network attacks or poor internal management, posing a threat to user privacy and corporate security. The stable operation of the power information system is crucial to power supply. If the information system fails or is attacked, it may lead to power dispatch chaos, information distortion and other problems. Power companies may not have a complete emergency plan or the plan is poorly implemented, resulting in an inability to respond quickly and effectively when power emergencies occur. When a power failure occurs, if the maintenance team does not respond in time or handles it improperly, it may lead to consequences such as the expansion of the fault scope and prolonged power outage time. By judging whether the model function evaluation index is greater than the set model function threshold, if it is, continue to monitor the vulnerability detection results, otherwise perform parameter optimization, thereby improving the security of the preset power grid power supply.

[0032] Furthermore, the specific steps for obtaining the logical vulnerability data set and the verification data set are as follows: data processing is performed on the collected power data of the preset power grid during the power supply process and the processed power data is converted into a preset format, and the data processing includes deduplication and missing data processing; the power data converted into the preset format is randomly divided into a logical vulnerability data set and a verification data set according to a preset ratio.

[0033] In this embodiment, the power data includes load data, generator data, distribution network data and the number of preset power scheduling logic vulnerabilities, wherein the load data includes the total amount of power consumed by the power grid in a preset time period, wherein the generator data includes the speed, voltage, frequency and the total amount of power generated by the generator in the preset time period, wherein the distribution network data includes the power loss caused by the voltage, current and resistance of the preset power grid in the preset time period; deduplication refers to retaining only the first appearing data for repeated power data; for the missing data processing of power data, the mean, median or mode of the power data can be used to fill the missing values; the power data is randomly divided into a logic vulnerability data set and a verification data set in a ratio of (7:3), which is mainly considered to be balanced, practical experience and avoid overfitting. The ratio of 7:3) provides a relatively balanced distribution between the training set and the verification set. The training set accounts for a larger proportion, which can ensure that the power dispatch vulnerability detection model has enough samples for learning, and the validation set accounts for a smaller proportion, which is sufficient to evaluate the performance of the power dispatch vulnerability detection model while avoiding wasting too much data on validation. In the field of machine learning and deep learning, the data set division ratio usually follows certain practical experience. The ratio of (7:3) is a common and recommended one in these practices because it finds a better balance between training effect and power dispatch vulnerability detection model evaluation. A larger training set helps reduce the risk of overfitting of the power dispatch vulnerability detection model because the power dispatch vulnerability detection model has more opportunities to learn more generalized features from diverse samples, while an appropriate validation set can help discover possible problems with the power dispatch vulnerability detection model early so that it can be adjusted and optimized. The reliability of the power dispatch vulnerability detection model is improved.

[0034] Furthermore, the specific steps for obtaining the number of preset power dispatching logic vulnerabilities are as follows: at each preset time point within the preset time period, the power generation of the preset power grid is obtained through the grid-side electric meter, the power generation of the preset power grid represents the power generation of the preset power grid generator set in the preset time period, and the power generation of the power grid is used to measure the power supply level of the preset power grid; at each preset time point within the preset time period, the power consumption of the preset power grid is obtained through the power consumption side electric meter, the power consumption represents the power consumption of the preset power grid in the preset time period, and the power consumption is used to measure the power demand level of the preset power grid; if the power generation of the power grid at the preset time point is 0, the power generation failure judgment value at the preset time point is 1, otherwise the power generation failure judgment value at the preset time point is 0, and the power generation failure judgment value is used to judge the situation that the preset power grid fails to supply power; if the power generation of the power grid at the preset time point is not 0 and the power generation of the power grid is less than the power consumption, the power generation shortage judgment value at the preset time point is 1, otherwise the power generation shortage judgment value at the preset time point is 0, and the power generation shortage judgment value is used to judge the situation that the power generation of the power grid is insufficient to meet the power consumption; according to the power generation shortage judgment value and the power generation failure judgment value at the preset time point, the number of preset power dispatching logic vulnerabilities is obtained, and the expression of the number of preset power dispatching logic vulnerabilities is:

[0035]

[0036] Where MX represents the number of preset power dispatch logic vulnerabilities, t represents the sequence number of the preset time point in the preset time period, t=1,2,...,T, T represents the total number of preset time points in the preset time period, and Z 1t represents the power generation shortage judgment value at the t-th preset time point, Z 2t Indicates the power generation failure judgment value at the t-th preset time point.

[0037] In this embodiment, when the power generation of the preset power grid is insufficient to meet the demand, it is determined that there is a logic loophole in the preset power grid. The preset power grid needs to ensure the balance between power supply and demand. If the power generation of the preset power grid cannot meet the current power consumption, then this is obviously a loophole in system logic or planning. This loophole may lead to power shortages, power outages or other unstable power supply situations, affecting the safe operation of the power grid and the normal power consumption of users; when the preset power grid fails to supply power, but there is a power load in the preset power grid, it is determined that there is a logic loophole in the preset power grid. Under normal circumstances, the power grid should be able to supply power according to the load demand. If the preset power grid fails to supply power when there is a power load, then this is likely to indicate that there is some kind of logical or physical fault in the power grid, such as equipment failure, line failure, scheduling instruction error, etc. This fault will cause the power grid to fail to work normally, causing serious impact on the normal power consumption of users; by analyzing the logical loophole that the power generation of the preset power grid is insufficient to meet the demand, and the logical loophole that the power generation of the preset power grid cannot meet the current power consumption, it is ensured that the power supply can be stably provided as required, thereby reducing the inconvenience and risk caused by power supply problems, and achieving a more accurate analysis of the operating status of the preset power grid.

[0038] Furthermore, a specific method for obtaining a preset power data sample set is as follows: collecting power data of historical normal operation of a preset power grid to obtain a normal sample set, wherein the normal sample set represents a power data set that does not contain logical vulnerabilities; simulating a communication interruption scenario by shutting down a communication module of the preset power grid, and collecting power data of the simulated communication interruption scenario to obtain a communication interruption sample set, wherein the communication interruption sample set represents a power data set that contains known communication interruption vulnerabilities; the logical vulnerability data set includes a normal sample set and a communication interruption sample set.

[0039] In this embodiment, by controlling the monitoring and data acquisition system of the preset power grid, the preset remote control platform is used to shut down the communication module of the preset power grid to simulate the communication interruption scenario. The known communication interruption vulnerability in the communication interruption sample set is the number of times the communication module of the preset power grid is shut down. The monitoring and data acquisition system of the preset power grid is widely used in many places. The monitoring and data acquisition system allows power companies to remotely monitor and control facilities such as power plants, transmission lines, substations, and distribution networks; the normal sample set is the basis for building a power dispatching vulnerability detection model, which represents the power data characteristics of the power grid under normal operating conditions. Through these data, the power dispatching vulnerability detection model can learn the normal working mode of the power grid, and then be able to distinguish abnormal or vulnerability situations; communication interruption is one of the common vulnerabilities of the preset power grid, which may cause the preset power grid to operate unstable or even paralyzed. By simulating the communication interruption scenario and collecting relevant data, a power data set containing known communication interruption vulnerabilities can be constructed for training models to identify such vulnerabilities; the stability of vulnerability detection is improved.

[0040] Furthermore, a specific method for obtaining the model function evaluation index is as follows: within a preset time period, a preset power data sample set is input into the power dispatch vulnerability detection model for vulnerability detection to obtain a vulnerability detection result; the model function evaluation index is obtained based on the vulnerability detection results, the vulnerability error detection amount and the vulnerability detection missing amount of the vulnerability detection result; the vulnerability correct detection amount represents the number of samples correctly detected as vulnerabilities by the power dispatch vulnerability detection model in the vulnerability detection results, and the vulnerability correct detection amount is used to quantify the possibility level of correct judgment of logical vulnerabilities of the power dispatch vulnerability detection model; the vulnerability error detection amount represents the number of samples in the vulnerability detection results that the power dispatch vulnerability detection model mistakenly judges normal samples as vulnerabilities, and the vulnerability error detection amount is used to quantify the possibility level of wrong judgment of logical vulnerabilities of the power dispatch vulnerability detection model; the vulnerability detection missing amount represents the number of actual vulnerability samples that the power dispatch vulnerability detection model fails to detect in the vulnerability detection results, and the vulnerability detection missing amount is used to quantify the model's logical vulnerability detection missing level.

[0041] In this embodiment, the vulnerability detection process is to obtain the detection results by identifying the anomalies in the preset power data sample set through the power dispatch vulnerability detection model. The anomalies include vulnerability error detection and vulnerability detection missing. By obtaining the correct vulnerability detection amount, the vulnerability error detection amount and the vulnerability detection missing amount, the performance of the model can be objectively measured to reduce the influence of subjective judgment. The power dispatch vulnerability detection model is an important tool to ensure the security of the power grid. Through functional evaluation, it can be ensured that the model can timely discover and warn of potential vulnerabilities and threats in actual applications, reduce the operation risks of the power grid, and use the preset power data sample set to perform functional evaluation on the power dispatch vulnerability detection model. It is reasonable and necessary, which can not only improve the performance of the model and ensure the safe and stable operation of the power grid, but also provide strong support for the further application and development of the model; it realizes the improvement of the preset power grid security.

[0042] Furthermore, the model function evaluation index is calculated using the following formula:

[0043]

[0044] Where GN represents the model function evaluation index, e represents the natural constant, m represents the number of vulnerability detections within the preset time period, m = 1, 2, ..., M, M represents the total number of vulnerability detections, y 1m represents the number of correct vulnerability detections in the mth vulnerability detection, y 2m represents the number of false detections of the mth vulnerability detection, y 3m Indicates the number of missing vulnerability detections for the mth vulnerability detection.

[0045] In this embodiment, the algorithm of this embodiment combines the correct vulnerability detection amount, the incorrect vulnerability detection amount and the missing vulnerability detection amount, and comprehensively analyzes to obtain the model function evaluation index. In this formula, the incorrect vulnerability detection amount and the missing vulnerability detection amount influence each other, and there is a balance between the incorrect vulnerability detection amount and the missing vulnerability detection amount. Excessive pursuit of reducing the incorrect detection amount may cause the detection model to be too conservative, thereby increasing the missing vulnerability detection amount, while excessive pursuit of reducing the missing detection amount may increase the risk of incorrect detection, indicating the detection capability level of the power dispatching vulnerability detection model for code sequence vulnerabilities. Therefore, precise analysis is carried out by establishing a mathematical form.

[0046] Specifically, for the convenience of analysis, define α1 is the vulnerability detection accuracy coefficient, defined as α2 is the comprehensive coefficient of vulnerability detection, and the calculation formula of the model function evaluation index is: The statistical table of changes in the model function evaluation index is shown in Table 1:

[0047] Table 1 Statistics of changes in model function evaluation index

[0048] <![CDATA[False positive coefficient α1]]> <![CDATA[Leakage loss coefficient α2]]> Model function evaluation index GN 0.849 0.391 2.695 0.715 0.229 2.537 0.802 0.168 2.590 0.945 0.226 2.731 ... ... ...

[0049] Among them, the vulnerability detection accuracy coefficient is positively correlated with the model function evaluation index, and the vulnerability detection comprehensive coefficient is positively correlated with the model function evaluation index; when the number of correct vulnerability detections is high, it means that the model can accurately identify real vulnerabilities in the data samples, which is usually attributed to reasonable model design, sufficient training and appropriate feature selection; if the number of false vulnerability detections is high, this may be due to the high complexity of the power dispatch vulnerability detection model or the insufficient representativeness of the training data. Noise or outliers in the power data may cause the model to learn wrong patterns, resulting in false detections during testing; poor model generalization ability may cause the power dispatch vulnerability detection model to fail to effectively identify vulnerability types or variants that have not appeared in the training data, resulting in a high missed detection rate. By analyzing the reasons for the number of correct vulnerability detections, the number of false vulnerability detections and the number of missing vulnerability detections, we can have a more comprehensive understanding of the performance of the power dispatch vulnerability detection model and make targeted optimizations and improvements accordingly; thereby realizing the numerical evaluation of the model function and further improving the accuracy of the power dispatch vulnerability detection model.

[0050] Furthermore, the specific setting method of the model function threshold is as follows: using a current sensor to measure the maximum current and the minimum current of a preset power grid in a preset time period to obtain a power load value, and the power load value is used to measure the power consumption level of the power dispatching vulnerability detection model; inputting a preset power data sample set into the power dispatching vulnerability detection model for vulnerability detection, and obtaining a response time value based on the start time and result output time of the vulnerability detection, and the response time value is used to measure the response speed level of the power dispatching vulnerability detection model; obtaining a throughput value based on the output of the power dispatching vulnerability detection model within a preset time period, and obtaining the model function threshold by combining the obtained throughput with the power load value and the response time value, and the throughput value represents the number of samples of the power data sample set detected by the power dispatching vulnerability detection model, and the throughput value is used to quantify the power data sample set processing efficiency of the power dispatching vulnerability detection model.

[0051] In this embodiment, the power load value is the difference between the maximum current and the minimum current of the preset power grid in the preset time period. The current measured by the current sensor is plotted over time, and the maximum current and the minimum current are obtained by observing the peaks and troughs of the graph. The maximum current is the peak, and the minimum current is the trough. In the power system, the throughput value, the power load value and the response time value are all important indicators for evaluating system performance. It should also be noted that with the expansion of the system scale, changes in business needs and the development of technology, the model function threshold needs to be regularly evaluated and adjusted. When setting the model function threshold, it is necessary to fully consider potential risks and uncertainties to ensure that the system can operate stably under various circumstances, establish an effective monitoring and early warning mechanism, promptly discover and handle system performance degradation or abnormal conditions, and ensure that the system always maintains a safe and efficient operating state; the reliability of the power dispatch vulnerability detection model function evaluation is improved.

[0052] Furthermore, the model function threshold is calculated using the following formula:

[0053]

[0054] Where YZ represents the model function threshold, e represents the natural constant, k1 represents the power load value, k2 represents the response time value, k3 represents the throughput value, and k4 represents the preset time period.

[0055] In this embodiment, the algorithm of this embodiment combines the power load value, response time value and throughput value, and comprehensively analyzes to obtain the model function threshold. In this formula, the power load value and the response time value influence each other. Under high load conditions, the equipment in the preset power grid will overheat or overload, causing the performance of the preset power grid to decline, thereby affecting the response time, indicating the accuracy of the power dispatch vulnerability detection model in detecting logical vulnerabilities. Therefore, by establishing a mathematical form, precise analysis is performed.

[0056] Specifically, for the convenience of analysis, define β1 is the throughput coefficient, defined as β2 is the load coefficient, and the calculation formula of the model function threshold is: like Figure 2As shown, a statistical graph of changes in the model function threshold is provided for an embodiment of the present application. It can be seen from the graph that the throughput coefficient is positively correlated with the model function threshold, and the load coefficient is negatively correlated with the model function threshold; the throughput value refers to the amount of request processed or data transmitted by the system per unit time. In the power system, it may refer to the ability of the power dispatching system to process control commands or data transmission; the power load value refers to the amount of power load borne by the power system at a certain moment, which directly affects the stability and security of the power grid; the response time refers to the time required for the system to receive a request and return a response. In the power dispatching system, it may refer to the execution time of the control command or the response time of the data query; thereby achieving a comprehensive evaluation of the model function and further improving the reliability of the power dispatching vulnerability detection model.

[0057] like Figure 3 As shown, it is a process diagram of parameter tuning provided by an embodiment of the present application, and the specific steps of parameter tuning are as follows: construct a parameter grid of preset learning rate candidate values ​​and preset regularization parameter candidate values, and obtain a candidate value parameter combination according to the learning rate candidate values ​​and the preset regularization parameter candidate values ​​in the parameter grid, the preset learning rate candidate values ​​are 0.01, 0.1 and 1, the preset regularization parameter candidate values ​​are 0.01, 0.1 and 1, the parameter grid includes all parameter combinations of preset learning rate candidate values ​​and preset regularization parameter candidate values, and the candidate value parameter combination is used to improve the performance level of the power dispatch vulnerability detection model; use the logical vulnerability data set to train the power dispatch vulnerability detection model corresponding to each candidate value parameter combination, and input the verification data set into The trained power dispatch vulnerability detection model is input to perform vulnerability detection to obtain vulnerability verification results; the accuracy of the trained power dispatch vulnerability detection model is obtained according to the vulnerability verification results, and the accuracy of the power dispatch vulnerability detection model is compared to obtain the maximum accuracy, and it is determined whether the candidate value parameter combination corresponding to the maximum accuracy is unique, if so, the preset learning rate candidate value and the preset regularization parameter candidate value in the candidate value parameter combination corresponding to the maximum accuracy are selected as the learning rate and regularization parameter of the power dispatch vulnerability detection model, otherwise, the candidate value parameter combination corresponding to the maximum accuracy is averaged to obtain the learning rate mean and the regularization parameter mean, and the learning rate mean and the regularization parameter mean are used as the learning rate and regularization parameter of the power dispatch vulnerability detection model.

[0058] In this embodiment, the electric power dispatch vulnerability detection model corresponding to the logical vulnerability data set is used for model training, which needs to be initialized first. The initialization requires setting the preset learning rate candidate value and the preset regularization parameter candidate value to 0, and then the logical vulnerability data set is input into the electric power dispatch vulnerability detection model for model training. Finally, the model is trained through multiple iterations, and the entire logical vulnerability data set is input into the model in each iteration until the model converges. In the process of constructing the electric power dispatch vulnerability detection model, the learning rate and the regularization parameter are two crucial hyperparameters, which have a significant impact on the training effect and generalization ability of the model. The learning rate refers to updating the model weights in the optimization algorithm. The step size determines the distance the model advances along the gradient descent direction in each iteration. If the learning rate is too large, the model may not converge or even diverge during the training process. If the learning rate is too small, the model training process will become very slow and more iterations will be required to achieve better results. Regularization is a technology to prevent model overfitting. It is achieved by adding a term related to the complexity of the model to the loss function. The regularization parameter is used to control the weight of this term. If the regularization parameter is too large, the model may underfit, that is, the model cannot fully learn the characteristics of the data. If the regularization parameter is too small, it may not be able to effectively prevent overfitting. The efficiency of vulnerability detection is improved.

[0059] Furthermore, the specific evaluation method of the precision is as follows: the verification data set is input into the power dispatching vulnerability detection model, and the monitoring true examples and monitoring false examples are obtained according to the output results. The monitoring true examples are used to quantify the number of vulnerabilities in the verification data set correctly detected by the power dispatching vulnerability detection model, and the monitoring false examples are used to quantify the number of vulnerabilities in the verification data set that are not detected by the power dispatching vulnerability detection model; the precision is obtained according to the ratio of the monitoring true examples to the total monitoring number, and the total monitoring number is the total number of monitoring true examples and monitoring false examples.

[0060] In this embodiment, the most appropriate parameter combination is determined by the accuracy rate for parameter tuning, and the learning rate and regularization parameter of the power dispatching vulnerability detection model are selected. The application scenario of the accuracy rate is that it can help us reduce false alarms as much as possible while ensuring the accuracy of the detection results. Especially in the power dispatching system, the detection of logical vulnerabilities requires high reliability and accuracy. Parameter tuning through accuracy can effectively optimize the performance of the model, improve the security and reliability of the preset power grid, and optimize the power dispatching vulnerability detection model. It is also necessary to strengthen power supply and demand forecasting and power generation equipment maintenance management to ensure the coordination and stability of power production and supply, increase the intensity of power grid construction and transformation, improve the reliability and safety of transmission lines and substations, improve material procurement and inventory management systems, ensure the timeliness and effectiveness of material supply, strengthen the construction and maintenance of data security and information management systems, improve the security and reliability of power data, formulate and improve emergency plans, strengthen drills and training, and improve emergency response and fault handling capabilities; the security of the preset power grid is improved.

[0061] The embodiment of the present application provides a business automation logic vulnerability detection device based on deep learning, including a power data collection module, a model training module, a model function evaluation module and a parameter tuning module; wherein the power data collection module is used to collect power data of a preset power grid during the power supply process and perform data processing to obtain a logic vulnerability data set and a verification data set; the model training module is used to use the logic vulnerability data set to perform model training on a power dispatching vulnerability detection model, and input the preset power data sample set into the power dispatching vulnerability detection model to perform vulnerability detection to obtain a vulnerability detection result; the model function evaluation module is used to compare the vulnerability detection result with the known number of logic vulnerability samples of the preset power data sample set to obtain a model function evaluation index, and determine whether the model function evaluation index is greater than the set model function threshold, if so, continue to monitor the vulnerability detection result, otherwise execute the function of the parameter tuning module, the model function evaluation index is used to evaluate the detection capability level of the power dispatching vulnerability detection model for the power dispatching vulnerability corresponding to the preset power data sample set; the parameter tuning module is used to perform parameter tuning on the power dispatching vulnerability detection model by inputting the verification data set into the power dispatching vulnerability detection model, and the parameter tuning includes learning rate tuning and regularization parameter tuning.

[0062] An embodiment of the present application also provides an electronic device, which includes a memory for storing computer program instructions and a processor for executing the program instructions, wherein when the computer program instructions are executed by the processor, the electronic device is triggered to execute a business automation logic vulnerability detection method based on deep learning.

[0063] An embodiment of the present application also provides a computer-readable storage medium for storing a program, which, when executed by a processor, implements a business automation logic vulnerability detection method based on deep learning.

[0064] To summarize, the embodiment of the present application obtains a logical vulnerability data set and a verification data set by collecting power data of a preset power grid, and performs model training on a power dispatching vulnerability detection model, and then inputs the preset power data sample set into the power dispatching vulnerability detection model for vulnerability detection to obtain a model function evaluation index, and finally determines whether the model function evaluation index is greater than a set model function threshold, and if so, continues to monitor the detection results, otherwise, performs parameter tuning on the power dispatching vulnerability detection model, thereby achieving improved accuracy in logic vulnerability detection, and effectively solving the problem of low accuracy in logic vulnerability detection in the prior art.

[0065] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0066] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0067] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0068] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0069] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0070] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A business automation logic vulnerability detection method based on deep learning, characterized in that: The following steps are involved: S1, collects power data of the preset power grid during the power supply process and processes the data to obtain a logical vulnerability data set and a verification data set; S2, using the logical vulnerability data set to train a power dispatch vulnerability detection model, and inputting a preset power data sample set into the power dispatch vulnerability detection model to perform vulnerability detection to obtain a vulnerability detection result; S3, compare the vulnerability detection result with the known number of logic vulnerability samples of the preset power data sample set to obtain a model function evaluation index, and determine whether the model function evaluation index is greater than a set model function threshold. If so, continue to monitor the vulnerability detection result, otherwise execute S4, and the model function evaluation index is used to evaluate the detection capability level of the power dispatch vulnerability detection model for the power dispatch vulnerability corresponding to the preset power data sample set; S4, performing parameter tuning on the power dispatch vulnerability detection model by inputting the verification data set into the power dispatch vulnerability detection model, wherein the parameter tuning includes learning rate tuning and regularization parameter tuning.

2. The business automation logic vulnerability detection method based on deep learning as claimed in claim 1, characterized in that: The specific steps for obtaining the logical vulnerability dataset and the verification dataset are as follows: Processing the collected power data of the preset power grid during the power supply process and converting the processed power data into a preset format, wherein the data processing includes deduplication and missing data processing, and the power data includes load data, generator data, distribution network data, and the number of preset power dispatching logic vulnerabilities; The power data converted into a preset format is randomly divided into the logic vulnerability data set and the verification data set according to a preset ratio.

3. The business automation logic vulnerability detection method based on deep learning as claimed in claim 2, characterized in that: The specific steps for obtaining the preset number of power dispatching logic vulnerabilities are as follows: At each preset time point within a preset time period, the power generation of the preset power grid is obtained through a grid-side electric meter, wherein the power generation of the preset power grid represents the power generation of the generator set of the preset power grid during the preset time period, and the power generation of the preset power grid is used to measure the power supply level of the preset power grid; At each of the preset time points within the preset time period, the power consumption of the preset power grid is obtained through an electric meter on the power consumption side, wherein the power consumption represents the power consumption of the preset power grid in the preset time period; If the power generation of the power grid at the preset time point is 0, the power generation failure determination value at the preset time point is 1, otherwise the power generation failure determination value at the preset time point is 0; If the power generation of the power grid at the preset time point is not 0 and the power generation of the power grid is less than the power consumption, the power generation deficiency determination value at the preset time point is 1, otherwise the power generation deficiency determination value at the preset time point is 0; The preset number of power dispatching logic loopholes is obtained according to the power generation shortage judgment value and the power generation failure judgment value at the preset time point. The expression of the preset number of power dispatching logic loopholes is: Where MX represents the number of preset power dispatch logic vulnerabilities, t represents the sequence number of the preset time point in the preset time period, t=1,2,...,T, T represents the total number of preset time points in the preset time period, and Z 1t represents the power generation shortage judgment value at the t-th preset time point, Z 2t Indicates the power generation failure judgment value at the t-th preset time point.

4. The business automation logic vulnerability detection method based on deep learning as claimed in claim 1, characterized in that: The specific steps of obtaining the preset power data sample set are as follows: Collecting historical power data of normal operation of the preset power grid to obtain a normal sample set, wherein the normal sample set represents a power data set that does not contain logical vulnerabilities; Simulating a communication interruption scenario by shutting down a communication module of the preset power grid, and collecting power data of the simulated communication interruption scenario to obtain a communication interruption sample set; The preset power data sample set includes a normal sample set and a communication interruption sample set.

5. The business automation logic vulnerability detection method based on deep learning as claimed in claim 1, characterized in that: The specific steps for obtaining the model function evaluation index are as follows: Inputting the preset power data sample set into the power dispatch vulnerability detection model within a preset time period to perform vulnerability detection to obtain the vulnerability detection result; Obtaining a model function evaluation index based on the vulnerability detection results obtained from the correct vulnerability detection amount, the vulnerability error detection amount, and the vulnerability detection missing amount; The correct vulnerability detection amount represents the number of samples in the vulnerability detection result that are correctly detected as vulnerabilities by the power dispatch vulnerability detection model; The vulnerability error detection amount represents the number of samples in the vulnerability detection result where the power dispatch vulnerability detection model mistakenly determines that the normal samples are vulnerabilities; The vulnerability detection missing amount represents the number of actual vulnerability samples that the power dispatch vulnerability detection model fails to detect in the vulnerability detection result.

6. The business automation logic vulnerability detection method based on deep learning as claimed in claim 5, characterized in that: The model function evaluation index is specifically calculated using the following formula: Where GN represents the model function evaluation index, e represents a natural constant, m represents the number of vulnerability detections within the preset time period, m = 1, 2, ..., M, M represents the total number of vulnerability detections, y 1m represents the correct detection amount of the vulnerability in the mth vulnerability detection, y 2m represents the number of false detections of the vulnerability in the mth vulnerability detection, y 3m Represents the vulnerability detection missing amount of the m-th vulnerability detection.

7. The business automation logic vulnerability detection method based on deep learning as claimed in claim 1, characterized in that: The specific steps for setting the model function threshold are as follows: Using a current sensor to measure the maximum current and the minimum current of the preset power grid in a preset time period to obtain a power load value; Inputting the preset power data sample set into the power dispatch vulnerability detection model to perform vulnerability detection, and obtaining a response time value according to the start time of the vulnerability detection and the result output time; A throughput value is obtained according to the output of the power dispatching vulnerability detection model within the preset time period, and the obtained throughput is combined with the power load value and the response time value to obtain the model function threshold. The throughput value represents the number of samples in the power data sample set detected by the power dispatching vulnerability detection model.

8. The business automation logic vulnerability detection method based on deep learning as claimed in claim 7, characterized in that: The model function threshold is specifically calculated using the following formula: In the formula, YZ represents the model function threshold, e represents the natural constant, k1 represents the power load value, k2 represents the response time value, k3 represents the throughput value, and k4 represents the preset time period.

9. The business automation logic vulnerability detection method based on deep learning as claimed in claim 1, characterized in that: The specific steps of parameter tuning are as follows: Constructing a parameter grid of preset learning rate candidate values ​​and preset regularization parameter candidate values, and obtaining a candidate value parameter combination according to the learning rate candidate values ​​and the preset regularization parameter candidate values ​​in the parameter grid; Using the logical vulnerability data set, respectively, the power dispatch vulnerability detection model corresponding to each candidate value parameter combination is trained, and the verification data set is input into the trained power dispatch vulnerability detection model to perform vulnerability detection to obtain a vulnerability verification result; According to the vulnerability verification result, the accuracy of the trained power dispatch vulnerability detection model is obtained, and the accuracy of the power dispatch vulnerability detection model is compared to obtain the maximum accuracy, and it is determined whether the candidate value parameter combination corresponding to the maximum accuracy is unique. If so, the preset learning rate candidate value and the preset regularization parameter candidate value in the candidate value parameter combination corresponding to the maximum accuracy are selected as the learning rate and regularization parameter of the power dispatch vulnerability detection model. Otherwise, the candidate value parameter combination corresponding to the maximum accuracy is averaged to obtain the learning rate mean and the regularization parameter mean, and the learning rate mean and the regularization parameter mean are used as the learning rate and the regularization parameter of the power dispatch vulnerability detection model.

10. The business automation logic vulnerability detection method based on deep learning as claimed in claim 9, characterized in that: The specific evaluation steps of the accuracy are as follows: Inputting the verification data set into the power dispatch vulnerability detection model, and obtaining monitoring true cases and monitoring false cases according to the output results; The precision rate is obtained according to the ratio of the monitoring true examples to the monitoring total number, where the monitoring total number is the total number of the monitoring true examples and the monitoring false examples.

Images