Power near-field network communication security detection method and system, electronic equipment and medium

Abstract

The invention provides a power near-field network communication security detection method and system, electronic equipment and a medium, and is applied to the technical field of network security. The method comprises the following steps: extracting key information in a target communication protocol specification for the power near-field network according to a communication process, and constructing a finite-state machine corresponding to the target communication protocol specification based on the key information; performing path search on a finite-state machine corresponding to the target communication protocol specification to obtain a protocol state path set corresponding to the target communication protocol specification; acquiring and analyzing actual communication traffic based on a target communication protocol specification in the power near-field network, and generating an actual state transition path based on an analysis result; and carrying out security detection on the actual state transition path based on the protocol state path set. The problems that the detection accuracy and efficiency are low, the actual application requirement cannot be met, and time and labor are consumed in power system communication safety detection are solved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and system for detecting power near-field network communication security, electronic equipment and a medium. Background Art

[0002] With the rapid development of power systems, information and intelligent technologies have been widely used in the power industry, especially in near-field network environments, where the demand for communication between power equipment has increased significantly. These power equipment undertake important tasks such as power monitoring, data acquisition, and equipment control, and the security of their communications directly affects the stable operation and information security of the power system. However, there are many types of communication protocols used in power systems, and the standards and specifications are complex and diverse. In addition, due to the variability of the actual operating environment, traditional security detection methods are often difficult to fully cover when facing complex communication processes, resulting in missed reports and false reports.

[0003] Traditional security detection methods mainly rely on rule matching and pattern recognition. These methods usually detect communication security based on preset rules or patterns. Although they can work effectively in certain specific scenarios, they are often unable to cope with the complex and changeable actual application environment of power systems. Specifically, the power communication process is complex and involves a large number of state change processes. Traditional methods are difficult to accurately capture all possible state changes, which leads to insufficient detection accuracy and reliability. In addition, the process of manually constructing matching rules and patterns is time-consuming and labor-intensive, prone to errors, and cannot meet the requirements for detection efficiency and accuracy in practical applications. Summary of the invention

[0004] In order to overcome the problems of low detection accuracy and efficiency in the above-mentioned power system communication security detection, inability to meet actual application requirements and time-consuming and labor-intensive, the present invention provides a power near-field network communication security detection method and system, electronic equipment and medium.

[0005] In one aspect, the present invention provides a method for detecting power near-field network communication security, the method comprising:

[0006] Extract key information in the target communication protocol specification for the electric power near-field network according to the communication process, and construct a finite state machine corresponding to the target communication protocol specification based on the key information;

[0007] Performing a path search on a finite state machine corresponding to the target communication protocol specification to obtain a protocol state path set corresponding to the target communication protocol specification;

[0008] Acquire and parse the actual communication traffic based on the target communication protocol specification in the power near-field network, and generate an actual state transition path based on the parsing result;

[0009] The security of the actual state transfer path is detected based on the protocol state path set.

[0010] Optionally, the key information is a key information list, and extracting the key information in the target communication protocol specification for the power near-field network according to the communication process includes:

[0011] Extracting the communication events of each communication object, the state information of each communication object when the communication event occurs, the triggering conditions of the communication event and the communication impact of the communication event from the target communication protocol specification according to the communication process;

[0012] Extracting the communication behaviors associated with each of the communication events from the target communication protocol specification according to the communication process;

[0013] The key information list is generated based on the communication event, the status information of each communication object when the communication event occurs, the triggering condition of the communication event and the communication impact of the communication event, and the communication behavior associated when the communication event occurs.

[0014] Optionally, constructing a finite state machine corresponding to the target communication protocol specification based on the key information includes:

[0015] Determine, based on the key information list, a communication event of each communication object and state information of each communication object when the communication event occurs;

[0016] Matching trigger conditions of each communication event, communication impact of each communication event, and communication behaviors associated with each communication event based on the key information list;

[0017] Determine the transfer state corresponding to each communication object after each communication event occurs based on the communication impact; determine the state transfer process corresponding to each communication event based on the state information of each communication object when each communication event occurs and the transfer state corresponding to each communication object after each communication event occurs, the triggering condition of each communication event and the communication behavior associated with each communication event;

[0018] Based on the state transfer process corresponding to each communication event, a finite state machine of the target communication protocol specification is formed.

[0019] Optionally, before performing a path search on a finite state machine corresponding to the target communication protocol specification, the method further includes:

[0020] The state information of each communication object corresponding to the state transition process in the finite state machine is used as a node, the communication event corresponding to the state transition process in the finite state machine is used as a directed edge between the corresponding nodes before and after the state transition, the triggering condition of the communication event corresponding to the state transition process and the communication behavior associated with the communication event corresponding to the state transition process are used as attributes of the directed edge, and a directed graph corresponding to the finite state machine is constructed.

[0021] Optionally, performing a path search on a finite state machine corresponding to the target communication protocol specification to obtain a protocol state path set corresponding to the target communication protocol specification includes:

[0022] Starting from the node corresponding to the initial state in the directed graph, a breadth-first search algorithm is used to perform a breadth search of the state path of the directed graph to obtain a state path sequence set covered by breadth;

[0023] Starting from the node corresponding to the initial state in the directed graph, a state transition search of the directed graph is performed using a depth-first search algorithm to obtain a state path sequence set covered by the transition;

[0024] Starting from the node corresponding to the initial state in the directed graph, the transfer path of the directed graph is expanded and generated by solving the Euler circuit to obtain a state path sequence set with enhanced coverage;

[0025] The state path sequence set of the breadth coverage, the state path sequence set of the transfer coverage and the state path sequence set of the enhanced coverage are subjected to path fusion to obtain the protocol state path set.

[0026] Optionally, starting from the node corresponding to the initial state in the directed graph, the expansion generation of the transfer path of the directed graph is performed by solving the Euler circuit to obtain a state path sequence set with enhanced coverage, including:

[0027] Determining, based on the directed graph, node pairs having unequal in-degrees and unequal out-degrees;

[0028] In the directed graph, by adding directed redundant edges between node pairs with unequal in-degrees and out-degrees to make the in-degrees and out-degrees of each node pair with unequal in-degrees and out-degrees equal, an adjusted directed graph is obtained;

[0029] Determine the shortest path between pairs of nodes with unequal in-degree and out-degree in the directed graph using Dijkstra's algorithm;

[0030] For each node of the adjusted directed graph, determine a core event set corresponding to each node of the adjusted directed graph, and solve an Euler circuit starting from a node corresponding to an initial state of the adjusted directed graph until all edges in the core event set are located in the Euler circuit;

[0031] The target event in the Euler circuit is extracted in a first-in-first-out order, and the directed redundant edges in the target event are replaced with the shortest path to obtain the state path sequence set of the enhanced coverage.

[0032] Optionally, performing path fusion on the state path sequence set of the breadth coverage, the state path sequence set of the transfer coverage, and the state path sequence set of the enhanced coverage to obtain the protocol state path set includes:

[0033] The state path sequence set of the breadth coverage, the state path sequence set of the transfer coverage and the state path sequence set of the enhanced coverage are merged with paths having the same node sequence and redundant paths and unreachable paths are deleted to obtain the protocol state path set.

[0034] Optionally, merging paths having the same node sequence on the state path sequence set of breadth coverage, the state path sequence set of transfer coverage, and the state path sequence set of enhanced coverage includes:

[0035] Performing path matching on the state path sequence set of breadth coverage, the state path sequence set of transfer coverage, and the state path sequence set of enhanced coverage, and identifying paths with the same preceding node sequence in each state path sequence set;

[0036] Merge the same parts of the node sequences in the paths with the same preceding node sequence in each state path sequence set to obtain a merged path;

[0037] Different parts of the node sequences in the paths with the same preceding node sequence in each state path sequence set are used as branch paths of the merged path.

[0038] Optionally, the acquiring and parsing actual communication traffic based on the target communication protocol specification in the power near-field network includes:

[0039] capturing in real time the actual communication traffic in the power near-field network based on the target communication protocol specification;

[0040] Parsing the actual communication traffic using a protocol parser for the target communication protocol specification to obtain communication key fields;

[0041] The generating of the actual state transition path based on the parsing result includes:

[0042] Determine the corresponding communication behavior and communication object state change based on the communication key field;

[0043] The actual state transition path is constructed based on the actual communication process corresponding to the actual communication traffic, the communication behavior and the state change of the communication object.

[0044] Optionally, the performing security detection of the actual state transfer path based on the protocol state path set includes:

[0045] Matching the actual state transition path in the protocol state path set to determine differences in the actual state transition path;

[0046] Classifying the difference situations existing in the actual state transition path based on preset difference types, and obtaining the difference type corresponding to the actual state transition path and the quantity corresponding to each difference type;

[0047] Determine the risk score of the actual state transition path based on the risk score of each difference type and the difference type corresponding to the actual state transition path and the number corresponding to each difference type;

[0048] The safety of the actual state transition path is determined based on the magnitude relationship between the risk score and a preset safety threshold.

[0049] Optionally, the difference types include state differences and state transfer differences, the state differences include state offsets, state jumps and state repetitions, and the state transfer differences include illegal state transfers and missing state transfers.

[0050] Optionally, after performing security detection on the actual state transfer path based on the protocol state path set, the method further includes:

[0051] Producing a corresponding level of danger warning based on the danger score;

[0052] Based on the actual effect of the danger warning, the danger score corresponding to each of the difference types is adjusted.

[0053] On the other hand, the present invention also provides a power near-field network communication safety detection system, comprising:

[0054] A state machine construction module, used to extract key information in a target communication protocol specification for a power near-field network according to a communication process, and to construct a finite state machine corresponding to the target communication protocol specification based on the key information;

[0055] A path search module, used to perform a path search on a finite state machine corresponding to the target communication protocol specification to obtain a protocol state path set corresponding to the target communication protocol specification;

[0056] An actual path generation module, used for acquiring and parsing the actual communication traffic based on the target communication protocol specification in the power near-field network, and generating an actual state transition path based on the parsing result;

[0057] A security detection module is used to perform security detection on the actual state transfer path based on the protocol state path set.

[0058] On the other hand, the present invention also provides an electronic device, comprising: at least one processor and a memory; the memory and the processor are connected via a bus;

[0059] The memory is used to store one or more programs;

[0060] When the one or more programs are executed by the at least one processor, any one of the above-mentioned methods for detecting safety of power near-field network communications is implemented.

[0061] On the other hand, the present invention further provides a readable storage medium having an execution program stored thereon, and when the execution program is executed, the power near-field network communication security detection method described in any one of the above items is implemented.

[0062] Compared with the prior art, the present invention has the following beneficial effects:

[0063] The present invention provides a method and system for detecting the safety of electric power near-field network communication, an electronic device and a medium. On the one hand, according to the communication process, key information in the target communication protocol specification for the electric power near-field network is extracted, and a finite state machine corresponding to the target communication protocol specification is constructed based on the key information. By constructing a finite state machine based on the communication process, full coverage detection of protocol state changes can be achieved, missed detection and false detection can be avoided, and detection efficiency and accuracy can be improved. The security detection of actual communication traffic based on the finite state machine can meet the requirements of high reliability and low latency in practical applications. On the other hand, through the construction and flow monitoring of the automated finite state machine, manual participation is reduced, the time-consuming, labor-intensive and error-prone problems of the traditional rule construction process are solved, the information accuracy of the detection rule base is improved, and the safety detection of electric power near-field network communication based on the target communication protocol specification is realized by combining the path search and the comparison of the state path, and the reliability of the detection results can be improved while ensuring the detection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] Figure 1 This is one of the flow diagrams of a method for detecting safety of power near-field network communication according to the present invention;

[0065] Figure 2 This is a second flow chart of a method for detecting safety of near-field power network communication according to the present invention;

[0066] Figure 3 It is a schematic structural diagram of the electronic device of the present invention. DETAILED DESCRIPTION

[0067] The specific implementation modes of the present invention are further described in detail below with reference to the accompanying drawings.

[0068] Embodiment 1:

[0069] The present invention provides a method for detecting safety of power near-field network communication, as shown in the schematic diagram Figure 1 As shown, including:

[0070] Step S110, extracting key information in a target communication protocol specification for a power near-field network according to a communication process, and constructing a finite state machine corresponding to the target communication protocol specification based on the key information;

[0071] Step S120, performing a path search on a finite state machine corresponding to the target communication protocol specification to obtain a protocol state path set corresponding to the target communication protocol specification;

[0072] Step S130, acquiring and parsing actual communication traffic based on the target communication protocol specification in the power near-field network, and generating an actual state transition path based on the parsing result;

[0073] Step S140: Perform security detection of the actual state transfer path based on the protocol state path set.

[0074] In this example implementation, the power near-field network refers to a network mainly used for short-distance communication between power equipment, and the target communication protocol specification is a power-specific communication protocol specification. The power-specific communication protocol specification is used to realize the data transmission and exchange of control instructions in the power near-field network. The power-specific communication protocol specification usually has the characteristics of high reliability and low latency to ensure the stable operation of the power system. For example, the target communication protocol specification can be a power-specific communication protocol specification such as Modbus communication protocol, IEC104 communication protocol or DNP3 protocol. The key information includes the state description, event definition, action description, event triggering conditions, potential impact of events and other contents in the document of the target communication protocol specification. By defining the state, communication event, communication event triggering conditions and impact and action of the communication object, the corresponding finite state machine is constructed according to the communication process. The state machine is a mathematical model that describes the system state and its transfer process, which can intuitively represent the state changes and behavior patterns of the system under different conditions. In the communication protocol security detection, by constructing a finite state machine model of the standard protocol, the core concepts, state sets, event sets and action sets of the protocol can be standardized. Based on this model, a high-coverage state path sequence set is further generated to improve the detection efficiency. The finite state machine can generate a state transition diagram, and obtain a set of protocol state paths by searching the paths of the state transition diagram. Similarly, the actual state transition path can be obtained by extracting key information from the actual communication traffic, and a security detection can be performed by comparing the paths between the protocol state path set and the actual state transition path. If it is found that the actual state transition path does not match the path in the protocol state path set, there may be a security risk. The security detection method based on state machine comparison of the present invention can achieve full coverage detection of protocol state changes, significantly improving the accuracy and reliability of detection; through automated comparison and monitoring, it reduces manual participation, reduces the error rate, and improves detection efficiency.

[0075] In an example implementation, the key information is a key information list, and the step S110 of extracting the key information in the target communication protocol specification for the power near field network according to the communication process includes the following process:

[0076] Extracting the communication events of each communication object, the state information of each communication object when the communication event occurs, the triggering conditions of the communication event and the communication impact of the communication event from the target communication protocol specification according to the communication process;

[0077] Extracting the communication behaviors associated with each of the communication events from the target communication protocol specification according to the communication process;

[0078] The key information list is generated based on the communication event, the status information of each communication object when the communication event occurs, the triggering condition of the communication event and the communication impact of the communication event, and the communication behavior associated when the communication event occurs.

[0079] In this example implementation, the communication object is an electric device or system participating in the communication, and various communication events of the electric device or system can be extracted from the document of the target communication protocol specification. For example, all communication events of each communication object defined in the target communication protocol specification and the status information of each communication object when the communication event occurs can be identified. For example, the communication event can be "data packet reception", "command execution", "connection establishment", etc., and the status information of the communication object can be the "normal operation", "overload", "fault" and other states of the electric device. Determine the communication behavior (operation or behavior) associated with each communication event in the target communication protocol specification, and the communication behavior may include "sending an alarm", "switching mode", "recording a log", etc. Analyze the triggering conditions of each communication event, such as "triggering an alarm when the temperature exceeds a threshold", "reconnecting when the packet loss rate exceeds a certain proportion", etc. Record the possible consequences or impacts of each communication event as event impact (communication impact), such as "causing a system restart", "triggering a security alarm", "entering a degraded mode", etc. Generate a key information list based on each communication event, the status information of each communication object when each communication event occurs, the triggering conditions of each communication event, the communication impact of each communication event, and the communication behavior associated with each communication event when it occurs. That is, based on key information such as communication events in the communication process and status information of each communication object when the communication event occurs, triggering conditions of the communication event, communication impact of the communication event, communication behavior associated with the communication event, and the association relationship formed in these key information by the communication process, a key information list is generated. For example, key information can be written into the key information list based on the association relationship between key information.

[0080] In an example implementation, the step S110 of constructing a finite state machine corresponding to the target communication protocol specification based on the key information includes the following process:

[0081] Determine, based on the key information list, a communication event of each communication object and state information of each communication object when the communication event occurs;

[0082] Matching trigger conditions of each communication event, communication impact of each communication event, and communication behaviors associated with each communication event based on the key information list;

[0083] Determine the transfer state corresponding to each communication object after each communication event occurs based on the communication impact; determine the state transfer process corresponding to each communication event based on the state information of each communication object when each communication event occurs and the transfer state corresponding to each communication object after each communication event occurs, the triggering condition of each communication event and the communication behavior associated with each communication event;

[0084] Based on the state transfer process corresponding to each communication event, a finite state machine of the target communication protocol specification is formed.

[0085] In this example implementation, the state information of each communication object when each event in the protocol occurs can be summarized based on the key information list L, and the state order of the state information of each communication object in the summarized state information can be determined based on the communication process in the protocol, that is, the initial state, the intermediate states arranged in sequence, and all the terminal states, and the communication state set State is defined, which includes the initial state s of the protocol init , the protocol intermediate state s i and the terminal state set State end ; Based on the summary of event-related information such as events, event triggering conditions, and event impacts in the key information list L, extract the event set Event of each communication object in the protocol; based on the communication behavior (action or operation) when the event occurs, define the protocol action set Action, as shown below:

[0086] State = {s init , s1, s2, ..., s n , State end )

[0087] Event = {e c |e c ∈E}

[0088] Action = {a k |a k ∈a}

[0089] Among them, s n represents the nth intermediate state, e c is the event-related information of the cth event in the protocol, E is the set of protocol events, a k is the kth action executed in the protocol when the event occurs, and a is the set of protocol actions.

[0090] Based on the protocol state set State, the protocol event set Event, and the protocol action set Action, a state transition rule set is constructed; the corresponding state, trigger conditions, event impact, behavior, etc. can be matched from the event, or the corresponding event and its related information can be matched from the state. For example, each event in the protocol event set is traversed, and the state when the event occurs and the trigger conditions, event impact, and action a (communication behavior) associated with the event are found from the key information list. According to the event impact found, the new state s′ (transfer state) to be transferred to is determined, and then the state transition variable t=(s, s′, e, a) corresponding to each event is constructed, where e represents event information, and the event information includes the trigger conditions for the event. The state transition process of the communication event is determined based on the state transition variable, and the finite state machine of the target communication protocol specification can be constructed based on the state transition variable corresponding to each event. A state transition rule set can also be constructed based on the state transition variable of the event, and a finite state machine of the target communication protocol specification can be constructed based on the protocol state set State, the protocol event set Event, the protocol action set Action, and the state transition rule set. Exemplarily, the finite state machine may include a protocol state set State, a protocol event set Event, a protocol action set Action, a state transition rule set, a protocol start state s init , the protocol termination state set State end , specifically expressed as follows:

[0091] FSM=(State,Event,Action,Δ,s init , State end )

[0092] Among them, FSM is a finite state machine, Δ is a set of state transition rules, and its expression is:

[0093] Δ={(s, s′, e, a)|s, s′∈State, e∈Event, a∈Action}.

[0094] In an example implementation, before performing a path search on the finite state machine corresponding to the target communication protocol specification in step S120, the method further includes: using the state information of each communication object corresponding to the state transition process in the finite state machine as a node, using the communication event corresponding to the state transition process in the finite state machine as a directed edge between the corresponding nodes before and after the state transition, using the triggering condition of the communication event corresponding to the state transition process and the communication behavior associated with the communication event corresponding to the state transition process as attributes of the directed edge, and constructing a directed graph corresponding to the finite state machine.

[0095] In this example implementation, a corresponding directed graph can be constructed based on a finite state machine, with the states of each communication object corresponding to the state transition process in the state machine as nodes, the communication events corresponding to the state transition process as directed edges, and the actions (communication behaviors) corresponding to the state transition process in the state machine and the triggering conditions of the state transition corresponding to the state transition process (triggering conditions of the communication events) as edge attributes to construct a directed graph, thereby facilitating subsequent path searches.

[0096] In an example implementation, the performing of a path search on the finite state machine corresponding to the target communication protocol specification in step S120 to obtain a protocol state path set corresponding to the target communication protocol specification includes:

[0097] Starting from the node corresponding to the initial state in the directed graph, a breadth-first search algorithm is used to perform a breadth search of the state path of the directed graph to obtain a state path sequence set covered by breadth;

[0098] Starting from the node corresponding to the initial state in the directed graph, a state transition search of the directed graph is performed using a depth-first search algorithm to obtain a state path sequence set covered by the transition;

[0099] Starting from the node corresponding to the initial state in the directed graph, the transfer path of the directed graph is expanded and generated by solving the Euler circuit to obtain a state path sequence set with enhanced coverage;

[0100] The state path sequence set of the breadth coverage, the state path sequence set of the transfer coverage and the state path sequence set of the enhanced coverage are subjected to path fusion to obtain the protocol state path set.

[0101] In this example implementation, the breadth-first search algorithm starts from the node corresponding to the initial state in the directed graph and expands outward layer by layer to perform path search. The current search starts from each node in the node set searched last time, and expands the search to each adjacent node until each node in the directed graph is searched. Using the breadth-first search algorithm, all possible paths are found in a layer-by-layer manner to generate a state path sequence set SPSS1 with breadth coverage. The specific process is as follows: (1) Create an empty queue Q and set the initial state s initAdd to queue Q. Queue Q will first process nodes close to the starting state and gradually expand to nodes farther from the starting node. (2) Initialize an empty set SPSS1 to store the final searched node state path sequence. (3) Take out the state s corresponding to the current node from queue Q and check the nodes adjacent to it. (4) Traverse all new states s′ transferred from state s through a certain event. (5) Put the new state s′ into queue Q, maintain the order of the levels, and wait for further expansion. (6) Whenever a node completes all possible state transitions, judge the completeness of the current path of the node. If the path is complete, store it in the SPSS1 set. (7) Repeat the above process, expanding layer by layer, until there are no nodes in queue Q, and obtain all possible state paths SPSS1 searched.

[0102] The depth-first search algorithm starts from the node corresponding to the initial state in the directed graph and searches along a path vertically until the end node is found and then searches for other paths vertically. init The transfer is performed to generate a state path sequence set SPSS2 covered by the transfer. The specific execution process is as follows: (1) Create an empty stack S and set the initial state s init Push into the stack, and initialize an empty state path sequence set SPSS2 to store the final search state path sequence. The characteristic of the depth-first search algorithm is to first search along a path to the terminal node, and then search other paths. (2) Take out the state s corresponding to the current node from the stack S, and continue to go deeper along the current path. (3) Traverse all new states s′ that are transferred from state s through a certain event. Then add the event and the new state s′ (that is, the next node) to the current path, and put the terminal state s′ of the new path into the stack. This method ensures that it goes as deep as possible in one direction. (4) If the current path reaches a terminal state or there are no more expandable events, store this complete path in the SPSS2 set. If it is impossible to go deeper, backtrack to the previous state and try other possibilities. (5) Repeat the above process until the stack S is empty, that is, all possible state paths have been explored. During the depth-first search process, if a circular path is detected, you can choose to skip the path or record it as a special case. In the end, the SPSS2 set will contain all the paths from s init Start with a depth-first search to generate all state path sequences.

[0103] The above process searches the directed graph from the perspectives of breadth and depth to avoid the problem of false detection caused by missing states. In order to ensure full coverage of the protocol state, starting from the node corresponding to the initial state in the directed graph, the transfer path of the directed graph is expanded and generated by solving the Euler circuit to obtain the state path sequence set SPSS3 with enhanced coverage, including the following process:

[0104] Determining, based on the directed graph, node pairs having unequal in-degrees and unequal out-degrees;

[0105] In the directed graph, directed redundant edges are added between pairs of nodes with unequal in-degrees and out-degrees to make the in-degrees and out-degrees of each pair of nodes with unequal in-degrees and out-degrees equal, thereby obtaining an adjusted directed graph;

[0106] Determine the shortest path between pairs of nodes with unequal in-degree and out-degree in the directed graph using Dijkstra's algorithm;

[0107] For each node of the adjusted directed graph, determine a core event set corresponding to each node of the adjusted directed graph, and solve an Euler circuit starting from a node corresponding to an initial state of the adjusted directed graph until all edges in the core event set are located in the Euler circuit;

[0108] The target event in the Euler circuit is extracted in a first-in-first-out order, and the directed redundant edges in the target event are replaced with the shortest path to obtain the state path sequence set of the enhanced coverage.

[0109] In this example implementation, starting from the node corresponding to the initial state of the directed graph, by traversing each node s of the directed graph, a is calculated. s =indegree s -outdegree s , where indegree s and outdegree s Respectively represent the in-degree and out-degree of the node, a s Represents the difference between the in-degree and out-degree of node s. If there is a node a s ≠0, then the directed graph is an asymmetric directed graph. For an asymmetric directed graph, it is necessary to first transform it into a symmetric directed graph and then solve the Euler circuit. Specifically, (a) first determine the node pairs with unequal in-degree and out-degree in the asymmetric directed graph. For example, for the node pairs of the asymmetric directed graph<i,j> , if i, j∈V, V is a set of nodes in a directed graph, and a i >0 and a j <0, a i and a j Represents the difference between the in-degree and out-degree of node i and node j respectively, then the node pair<i,j> For a pair of nodes with unequal in-degree and out-degree, we can add a directed redundant edge between nodes i and j, so that a i Decrease by 1 and a j Increase by 1. Repeat step (a) until the in-degree and out-degree of all pairs of nodes in the directed graph that are not equal are equal, that is, the in-degree of all nodes in the directed graph is equal to the out-degree, that is, for each s∈V, there is as = 0. Through the above process, an asymmetric directed graph can be transformed into a symmetric directed graph. At the same time, the Dijkstra algorithm can also be used to find the node pairs with unequal in-degree and out-degree in the original directed graph (i.e., the asymmetric directed graph) (e.g., the node pair<i,j> ) shortest path. For the transformed symmetric directed graph, (b) assuming that l represents the current node, define Q l is the core event set of state l. From the initial state s init First, solve the Euler circuit. init Add the Euler circuit and set l = s init . Select node m∈Q l , and node m is not in the Euler circuit, and node m is added to the Euler circuit. If the output edge of m points to node o, add o to the Euler circuit. Update l=o. Repeat step (b) until all edges are in the Euler circuit. (c) After obtaining the complete Euler circuit, extract the events in the Euler circuit in the order of first-in-first-out to obtain the target event. The event set obtained by replacing the directed redundant edges in the target event with the shortest path solved in step (a) is the state path sequence set SPSS3 with enhanced coverage. This example further enhances the state coverage of the target communication protocol specification.

[0110] Finally, the state path sequence set SPSS1 with breadth coverage, the state path sequence set SPSS2 with transfer coverage, and the state path sequence set SPSS3 with enhanced coverage are merged to obtain the final protocol state path set. Specifically, the state path sequence set with breadth coverage, the state path sequence set with transfer coverage, and the state path sequence set with enhanced coverage are merged with paths with the same node sequence and redundant paths and unreachable paths are deleted, that is, the paths with the same node sequence in the three sets are merged, the repeated paths in the three sets are redundantly deleted and only one path is retained, and the unreachable paths in the three sets due to the characteristics of the state machine are deleted. The paths retained after the above-mentioned path merging and path deletion processing in the three sets are the protocol state path set. This example compares and analyzes the three state path sequences obtained, merges the paths with the same preceding node sequence, deletes redundant paths and unreachable paths due to the characteristics of the state machine, and outputs the final high-coverage state path sequence set. This set covers all states, state transition paths, and critical paths in the finite state machine of the protocol standard, laying the foundation for comparison with the actual interactive state transition.

[0111] Exemplarily, merging paths having the same node sequence on the state path sequence set of breadth coverage, the state path sequence set of transfer coverage, and the state path sequence set of enhanced coverage includes the following process:

[0112] Performing path matching on the state path sequence set of breadth coverage, the state path sequence set of transfer coverage, and the state path sequence set of enhanced coverage, and identifying paths with the same preceding node sequence in each state path sequence set;

[0113] Merge the same parts of the node sequences in the paths with the same preceding node sequence in each state path sequence set to obtain a merged path;

[0114] Different parts of the node sequences in the paths with the same preceding node sequence in each state path sequence set are used as branch paths of the merged path.

[0115] In this example implementation, the state path sequence set SPSS1 for breadth coverage, the state path sequence set SPSS2 for transfer coverage, and the state path sequence set SPSS3 for enhanced coverage are collected, and the path sequences in these three sets are compared pair by pair to identify the paths with the same preceding node sequence, that is, the situation where the first several node sequences of the path are the same. For the paths with the same preceding node sequence, the paths are merged, and the parts with the same preceding node sequence are retained. The different parts of the node sequence in the paths with the same preceding node sequence in each state path sequence set are used as branch paths of the merged path, and the branch paths are further expanded. For example, path P1 = [s init , s1, s2] and path P2 = [s init , s1, s3] can be merged into a common prefix path [s init , s1], and continue to expand branches [s2] and [s3] under this path.

[0116] In some implementations, the step S130 of acquiring and parsing the actual communication traffic in the power near-field network based on the target communication protocol specification includes the following process:

[0117] capturing in real time the actual communication traffic in the power near-field network based on the target communication protocol specification;

[0118] Parsing the actual communication traffic using a protocol parser for the target communication protocol specification to obtain communication key fields;

[0119] The generating of the actual state transition path based on the parsing result includes:

[0120] Determine the corresponding communication behavior and communication object state change based on the communication key field;

[0121] The actual state transition path is constructed based on the actual communication process corresponding to the actual communication traffic, the communication behavior and the state change of the communication object.

[0122] In this example implementation, network packet capture software can be used to capture the actual communication traffic of the power near-field network in real time, and the protocol parser of the target communication protocol specification can be used to parse the captured actual communication traffic data packets into understandable structured data, and extract the key communication fields, which include: source address, destination address, protocol type, data load, content, etc. The state transition path of the actual communication traffic can be constructed with reference to the process of constructing a protocol state path based on a key information list in the target communication protocol specification. Specifically, the communication key fields of the captured message can be formalized based on the protocol state set State, the protocol event set Event, and the protocol action set Action. Exemplarily, for messages sent to the client, the current communication object state and communication event are updated according to the message content. For messages sent to the server, according to the message content (the state s after transfer), the communication object state and communication event are updated according to the message content. act ' and possible actions a act That is, communication behavior), with f(s act , e act )=(s act ′,a act ) to transfer the state, f represents the state transfer function of the actual communication process, s act is the original state before the transfer in the actual communication process, e act is the event that causes the state transition, based on which we can get a path with the original state s before the transition act As the starting point, the state after transfer is s act ' is the end point, event e act By continuously recording the state change path of the actual communication flow in the actual communication process, the actual state transfer path of the actual interaction can be obtained, that is, the directed graph G s , for subsequent analysis.

[0123] In some example implementations, the performing of security detection of the actual state transition path based on the protocol state path set in step S140 includes:

[0124] Matching the actual state transition path in the protocol state path set to determine differences in the actual state transition path;

[0125] Classifying the difference situations existing in the actual state transition path based on preset difference types, and obtaining the difference type corresponding to the actual state transition path and the quantity corresponding to each difference type;

[0126] Determine the risk score of the actual state transition path based on the risk score of each difference type and the difference type corresponding to the actual state transition path and the number corresponding to each difference type;

[0127] The safety of the actual state transition path is determined based on the magnitude relationship between the risk score and a preset safety threshold.

[0128] In this example implementation, the difference type and the risk score corresponding to each difference type can be preset. Specifically, according to the possible differences between the actual state path and the protocol state path set, the difference type is defined to include two categories: state difference and state transition difference. Each category can include several subcategories. The state difference can include three subcategories: state offset, state jump and state repetition. The state transition difference can include two subcategories: illegal state transition and missing state transition. The state difference refers to the difference generated when the state in the actual state path is inconsistent with the state in the protocol state path set. The state offset refers to the state that is not in the finite state machine of the target communication protocol specification in the actual state path. The state jump refers to the skipping of certain states in the finite state machine of the target communication protocol specification in the actual state path. The state repetition refers to the unnecessary repetition of a state in the actual state path. The state transition difference refers to the difference generated when the state transition in the actual state path is inconsistent with the state transition in the protocol state path set. Among them, the illegal state transition refers to the occurrence of a state transition in the actual state path that does not exist in the protocol state path set; the missing state transition refers to the absence of a state transition in the protocol state path set that should have occurred in the actual state path. A corresponding risk score can be set for each subclass. For example, based on the severity of each difference type, the corresponding risk score is set as follows: risk score w1 = 10 for state deviation, risk score w2 = 8 for state jump, risk score w3 = 5 for state duplication, risk score w4 = 15 for illegal state transition, and risk score w5 = 12 for missing state transition. The path matching process is: traverse the actual state transition path, that is, the directed graph G s , for each edge e act The actual path formed by the two state nodes connected to the edge is compared with the protocol state path set and the corresponding finite state machine. When there is a difference between the two, the difference type and the number of each difference type are recorded, and the difference types obtained during the traversal process are accumulated, as shown in the following formula:

[0129]

[0130] Among them, Score is the risk score of the actual state transition path, M r is the number of difference types r between the actual state transfer path and the protocol state path set, t ris the serial number corresponding to the difference type r, r represents the difference type number, r takes values ​​of 1, 2, 3, 4, 5, and the corresponding difference types when r takes values ​​of 1, 2, 3, 4, 5 are state offset, state jump, state duplication, illegal state transfer, and missing state transfer, respectively. r Indicates the risk score of the difference type r. The safety threshold can be set and adjusted based on experience. For example, the safety threshold ε can be set to 20. When Score>ε, it is determined that there is a safety hazard and a safety alarm can be issued.

[0131] In some example implementations, after performing security detection on the actual state transition path based on the protocol state path set, the method further includes:

[0132] Producing a corresponding level of danger warning based on the danger score;

[0133] Based on the actual effect of the danger warning, the danger score corresponding to each of the difference types is adjusted.

[0134] In this example implementation, different danger warning levels can be configured for different danger scores, such as high, medium, and low danger warnings. The danger warning may include information such as the warning content, the reason for the warning, and the time of the warning. The danger score of each difference type can be assigned based on the effectiveness and accuracy of the warning. r Adjustments can be made to achieve more accurate and effective safety detection. For example, when the danger warning is low-level but a more serious safety problem actually occurs, a higher danger score can be set for the difference type with a large number of differences, such as setting a higher danger score for illegal state transitions, resulting in a higher danger score and warning level.

[0135] The following is a specific embodiment of a method for detecting the safety of near-field network communication in the power industry. The method can be used to detect the safety of near-field network channels and dedicated communication protocols in the power industry. Figure 2As shown, the following process may be included: first, the target communication protocol specification is analyzed, information is summarized and refined to obtain a key information list, thereby determining the state set, event set and action set of the target communication protocol specification, and constructing a state transition rule set, and constructing a finite state machine of the target communication protocol specification. Next, according to the finite state machine of the target communication protocol specification, a high-coverage protocol state path set is generated, which improves the efficiency of comparing the protocol standard with the actual interaction process. Then, the protocol interaction process of the actual communication is captured, monitored and parsed in real time, the sending, receiving and protocol state transfer of the message are recorded, the state change path is tracked, and the actual state transfer path is obtained. Finally, quantitative scoring is performed based on the difference between the protocol state path set of the target communication protocol specification (standard protocol) and the actual state transfer path, different levels of alarms are performed according to the difference scores, and the risk score of each difference type is adjusted according to the alarm accuracy, ensuring the accuracy and effectiveness of security detection. The present invention significantly improves the comparison efficiency of the standard protocol and the actual interaction process, and more accurately identifies the potential safety hazards of the protocol in the actual execution process. In addition, by real-time monitoring and capturing the actual interaction process, the present invention can timely discover abnormal states in protocol execution and conduct quantitative analysis, providing accurate security scores and graded alarms. By dynamically adjusting the risk score, the accuracy and pertinence of the alarm are further enhanced, thereby providing reliable security protection for the power near-field network and effectively preventing potential communication protocol security threats.

[0136] Although traditional protocol security detection methods can work effectively in certain specific scenarios, they often seem powerless when faced with the complex and changeable actual application environment of the power system. Specifically, the state transfer process of the power communication protocol is complex, involving a large number of states and events. It is difficult for traditional methods to accurately capture all possible state changes, which leads to insufficient accuracy and reliability of detection. In addition, the process of manually constructing rules is time-consuming and labor-intensive, prone to errors, and cannot meet the high requirements for detection efficiency and accuracy in practical applications. With the improvement of the power system's requirements for communication protocol security, more accurate and effective detection methods are needed. The present invention can intuitively represent the state changes and behavior patterns of the power system under different conditions by introducing a state machine. In the communication protocol security detection, by constructing a finite state machine model of the standard protocol specification, the core concepts, state sets, event sets, and action sets of the protocol can be standardized. Based on this model, a high-coverage protocol state path set is further generated, which effectively improves the efficiency of information comparison between the standard protocol and the actual interaction process.

[0137] The present invention systematically analyzes and summarizes the communication protocol specifications, extracts the key information of the protocol, constructs the state set, event set and action set of the protocol, and constructs the finite state machine of the protocol based on these sets. Subsequently, based on the constructed finite state machine, a high coverage path set covering all possible state changes of the protocol is generated to improve the efficiency of the comparison between the protocol standard and the actual execution process of the protocol. In practical applications, the present invention records the sending and receiving events of each message and the corresponding state transitions by capturing and monitoring the interaction process of the protocol in real time, and comprehensively tracks the change path of the actual state. Finally, by comparing the difference between the standard protocol state path and the actual interaction state path, the degree of difference is quantified, and a safety score and alarm information are generated based on this degree of difference. The method can adjust the score according to the actual situation, ensure the accuracy and effectiveness of the detection, and provide a solid technical guarantee for the safe communication of the power near-field network.

[0138] The method based on state machine comparison of the present invention can not only accurately describe the normal state transfer process of the protocol, but also can capture and monitor the changes of the protocol state in real time during the actual communication process. By tracking the sending, receiving and state transfer paths of messages during the protocol interaction process, the operating state of the protocol can be fully grasped and compared with the state path of the standard protocol. If a difference is found between the actual state path and the standard path, the method will perform quantitative scoring and trigger different levels of alarm mechanisms based on the difference score, so that the method can flexibly respond to different levels of security risks, ensure timely discovery and response to potential security threats, and provide more accurate security protection.

[0139] Embodiment 2:

[0140] Based on the same inventive concept, the present invention also provides a power near-field network communication safety detection system, the system comprising:

[0141] A state machine construction module, used to extract key information in a target communication protocol specification for a power near-field network according to a communication process, and to construct a finite state machine corresponding to the target communication protocol specification based on the key information;

[0142] A path search module, used to perform a path search on a finite state machine corresponding to the target communication protocol specification to obtain a protocol state path set corresponding to the target communication protocol specification;

[0143] An actual path generation module, used for acquiring and parsing the actual communication traffic based on the target communication protocol specification in the power near-field network, and generating an actual state transition path based on the parsing result;

[0144] A security detection module is used to perform security detection on the actual state transfer path based on the protocol state path set.

[0145] In a possible implementation manner, the key information is a key information list, and the state machine building module includes:

[0146] An information extraction submodule is used to extract the communication events of each communication object, the status information of each communication object when the communication event occurs, the triggering conditions of the communication event and the communication impact of the communication event from the target communication protocol specification according to the communication process; extract the communication behaviors associated with each communication event when it occurs from the target communication protocol specification according to the communication process;

[0147] The list generation submodule is used to generate the key information list based on the communication event, the status information of each communication object when the communication event occurs, the triggering condition of the communication event and the communication impact of the communication event, and the associated communication behavior when the communication event occurs.

[0148] In a possible implementation manner, the state machine construction module further includes a state machine construction submodule, and the state machine construction submodule is used to:

[0149] Determine, based on the key information list, a communication event of each communication object and state information of each communication object when the communication event occurs;

[0150] Matching trigger conditions of each communication event, communication impact of each communication event, and communication behaviors associated with each communication event based on the key information list;

[0151] Determine the transfer state corresponding to each communication object after each communication event occurs based on the communication impact; determine the state transfer process corresponding to each communication event based on the state information of each communication object when each communication event occurs and the transfer state corresponding to each communication object after each communication event occurs, the triggering condition of each communication event and the communication behavior associated with each communication event;

[0152] Based on the state transfer process corresponding to each communication event, a finite state machine of the target communication protocol specification is formed.

[0153] In a possible implementation manner, the state machine construction module further includes:

[0154] A directed graph construction submodule is used to use the state information of each communication object corresponding to the state transition process in the finite state machine as a node, the communication event corresponding to the state transition process in the finite state machine as a directed edge between the corresponding nodes before and after the state transition, and the triggering condition of the communication event corresponding to the state transition process and the communication behavior associated with the communication event corresponding to the state transition process as the attributes of the directed edge to construct a directed graph corresponding to the finite state machine.

[0155] In a possible implementation, the path search module includes:

[0156] A breadth search submodule, used to start from the node corresponding to the initial state in the directed graph, use a breadth-first search algorithm to perform a breadth search of the state path of the directed graph, and obtain a state path sequence set covered by breadth;

[0157] A depth search submodule, used to start from the node corresponding to the initial state in the directed graph, use a depth-first search algorithm to search for state transitions in the directed graph, and obtain a set of state path sequences covered by the transitions;

[0158] An enhanced search submodule, which is used to expand and generate the transfer path of the directed graph by solving the Euler circuit, starting from the node corresponding to the initial state in the directed graph, to obtain a state path sequence set with enhanced coverage;

[0159] The fusion submodule is used to perform path fusion on the state path sequence set of the breadth coverage, the state path sequence set of the transfer coverage and the state path sequence set of the enhanced coverage to obtain the protocol state path set.

[0160] In a possible implementation manner, the enhanced search submodule is specifically used for:

[0161] Determining, based on the directed graph, node pairs having unequal in-degrees and unequal out-degrees;

[0162] In the directed graph, by adding directed redundant edges between the node pairs with unequal in-degrees and out-degrees to make the in-degrees and out-degrees of each node pair with unequal in-degrees and out-degrees equal, an adjusted directed graph is obtained;

[0163] Determine the shortest path between pairs of nodes with unequal in-degree and out-degree in the directed graph using Dijkstra's algorithm;

[0164] For each node of the adjusted directed graph, determine a core event set corresponding to each node of the adjusted directed graph, and solve an Euler circuit starting from a node corresponding to an initial state of the adjusted directed graph until all edges in the core event set are located in the Euler circuit;

[0165] The target event in the Euler circuit is extracted in a first-in-first-out order, and the directed redundant edges in the target event are replaced with the shortest path to obtain the state path sequence set of the enhanced coverage.

[0166] In a possible implementation manner, the fusion submodule is specifically used for:

[0167] The state path sequence set of the breadth coverage, the state path sequence set of the transfer coverage and the state path sequence set of the enhanced coverage are merged with paths having the same node sequence and redundant paths and unreachable paths are deleted to obtain the protocol state path set.

[0168] In a possible implementation manner, the fusion submodule is further specifically used for:

[0169] Performing path matching on the state path sequence set of breadth coverage, the state path sequence set of transfer coverage, and the state path sequence set of enhanced coverage, and identifying paths with the same preceding node sequence in each state path sequence set;

[0170] Merge the same parts of the node sequences in the paths with the same preceding node sequence in each state path sequence set to obtain a merged path;

[0171] Different parts of the node sequences in the paths with the same preceding node sequence in each state path sequence set are used as branch paths of the merged path.

[0172] In a possible implementation, the actual path generation module includes:

[0173] A traffic acquisition submodule, used for capturing in real time the actual communication traffic in the electric power near-field network based on the target communication protocol specification;

[0174] A traffic analysis submodule, configured to analyze the actual communication traffic using a protocol analyzer for the target communication protocol specification to obtain communication key fields;

[0175] The actual path construction submodule is used to determine the corresponding communication behavior and the state change of the communication object based on the communication key field; based on the actual communication process corresponding to the actual communication flow, the communication behavior and the state change of the communication object, construct the actual state transfer path.

[0176] In a possible implementation, the security detection module includes:

[0177] A path matching submodule, used for performing path matching of the actual state transition path in the protocol state path set, and determining differences existing in the actual state transition path;

[0178] A difference classification submodule, used for classifying the difference situations existing in the actual state transition path based on preset difference types, and obtaining the difference type corresponding to the actual state transition path and the quantity corresponding to each difference type;

[0179] a score determination submodule, configured to determine a risk score of the actual state transition path based on the risk score of each difference type and the difference type corresponding to the actual state transition path and the number corresponding to each difference type;

[0180] The safety determination submodule is used to determine the safety of the actual state transition path based on the size relationship between the risk score and a preset safety threshold.

[0181] In a possible implementation manner, the difference types include state differences and state transition differences, the state differences include state offsets, state jumps, and state repetitions, and the state transition differences include illegal state transitions and missing state transitions.

[0182] In a possible implementation, the system further includes:

[0183] An alarm module, used for issuing a corresponding level of danger alarm based on the danger score;

[0184] The score adjustment module is used to adjust the risk score corresponding to each difference type based on the actual effect of the risk warning.

[0185] Embodiment 3:

[0186] like Figure 3 As shown, the present invention also provides an electronic device, which may be a computer device, a single-chip device, an intelligent mobile device, etc. The electronic device in this embodiment may include a processor, a memory, a transceiver component, etc. The memory, the processor, and the transceiver component are connected via a bus; the memory may be used to store an execution program, and an exemplary execution program may include instructions; the processor is used to execute the instructions stored in the memory. The memory may also be used to store data, which may be called and / or modified when the instructions are executed.

[0187] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions in a storage medium to implement the corresponding method flow or corresponding functions, so as to implement the steps of a power near-field network communication safety detection method in the above-mentioned embodiment.

[0188] Example 4

[0189] Based on the same inventive concept, the present invention also provides a readable storage medium, specifically an electronic device readable storage medium (Memory), which is a memory device in an electronic device for storing programs and data. It can be understood that the storage medium here can include both built-in storage media in electronic devices and, of course, extended storage media supported by electronic devices. The storage medium provides a storage space, which stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by a processor are also stored in the storage space, and these instructions can be one or more execution programs (including program codes). It should be noted that the storage medium here can be a high-speed RAM memory or a non-volatile memory, such as at least one disk memory. The processor loads and executes one or more instructions stored in the storage medium, which can implement the steps of a power near-field network communication safety detection method in the above embodiment.

[0190] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0191] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0192] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0193] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0194] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit its protection scope. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that after reading the present invention, those skilled in the art can still make various changes, modifications or equivalent substitutions to the specific implementation methods of the application, but these changes, modifications or equivalent substitutions are all within the protection scope of the claims to be approved.

Claims

1. A method for detecting the safety of power near-field network communication, characterized in that: include: Extract key information in the target communication protocol specification for the electric power near-field network according to the communication process, and construct a finite state machine corresponding to the target communication protocol specification based on the key information; Performing a path search on a finite state machine corresponding to the target communication protocol specification to obtain a protocol state path set corresponding to the target communication protocol specification; Acquire and parse the actual communication traffic based on the target communication protocol specification in the power near-field network, and generate an actual state transition path based on the parsing result; The security of the actual state transfer path is detected based on the protocol state path set.

2. The method according to claim 1, characterized in that: The key information is a key information list, and the key information in the target communication protocol specification for the power near-field network is extracted according to the communication process, including: Extracting the communication events of each communication object, the state information of each communication object when the communication event occurs, the triggering conditions of the communication event and the communication impact of the communication event from the target communication protocol specification according to the communication process; Extracting the communication behaviors associated with each of the communication events from the target communication protocol specification according to the communication process; The key information list is generated based on the communication event, the status information of each communication object when the communication event occurs, the triggering condition of the communication event and the communication impact of the communication event, and the communication behavior associated when the communication event occurs.

3. The method according to claim 2, characterized in that The constructing a finite state machine corresponding to the target communication protocol specification based on the key information includes: Determine, based on the key information list, a communication event of each communication object and state information of each communication object when the communication event occurs; Matching trigger conditions of each communication event, communication impact of each communication event, and communication behaviors associated with each communication event based on the key information list; Determine the transfer state corresponding to each communication object after each communication event occurs based on the communication impact; determine the state transfer process corresponding to each communication event based on the state information of each communication object when each communication event occurs and the transfer state corresponding to each communication object after each communication event occurs, the triggering condition of each communication event and the communication behavior associated with each communication event; Based on the state transfer process corresponding to each communication event, a finite state machine of the target communication protocol specification is formed.

4. The method according to claim 3, characterized in that Before performing a path search on the finite state machine corresponding to the target communication protocol specification, the method further includes: The state information of each communication object corresponding to the state transition process in the finite state machine is used as a node, the communication event corresponding to the state transition process in the finite state machine is used as a directed edge between the corresponding nodes before and after the state transition, the triggering condition of the communication event corresponding to the state transition process and the communication behavior associated with the communication event corresponding to the state transition process are used as attributes of the directed edge, and a directed graph corresponding to the finite state machine is constructed.

5. The method according to claim 4, characterized in that The performing path search on the finite state machine corresponding to the target communication protocol specification to obtain a protocol state path set corresponding to the target communication protocol specification includes: Starting from the node corresponding to the initial state in the directed graph, a breadth-first search algorithm is used to perform a breadth search of the state path of the directed graph to obtain a state path sequence set covered by breadth; Starting from the node corresponding to the initial state in the directed graph, a state transition search of the directed graph is performed using a depth-first search algorithm to obtain a state path sequence set covered by the transition; Starting from the node corresponding to the initial state in the directed graph, the transfer path of the directed graph is expanded and generated by solving the Euler circuit to obtain a state path sequence set with enhanced coverage; The state path sequence set of the breadth coverage, the state path sequence set of the transfer coverage and the state path sequence set of the enhanced coverage are subjected to path fusion to obtain the protocol state path set.

6. The method according to claim 5, characterized in that Starting from the node corresponding to the initial state in the directed graph, the transfer path of the directed graph is expanded and generated by solving the Euler circuit to obtain a state path sequence set with enhanced coverage, including: Determining, based on the directed graph, node pairs having unequal in-degrees and unequal out-degrees; In the directed graph, by adding directed redundant edges between node pairs with unequal in-degrees and out-degrees to make the in-degrees and out-degrees of each node pair with unequal in-degrees and out-degrees equal, an adjusted directed graph is obtained; Determine the shortest path between pairs of nodes with unequal in-degree and out-degree in the directed graph using Dijkstra's algorithm; For each node of the adjusted directed graph, determine a core event set corresponding to each node of the adjusted directed graph, and solve an Euler circuit starting from a node corresponding to an initial state of the adjusted directed graph until all edges in the core event set are located in the Euler circuit; The target event in the Euler circuit is extracted in a first-in-first-out order, and the directed redundant edges in the target event are replaced with the shortest path to obtain the state path sequence set of the enhanced coverage.

7. The method according to claim 5, characterized in that The step of performing path fusion on the state path sequence set of the breadth coverage, the state path sequence set of the transfer coverage, and the state path sequence set of the enhanced coverage to obtain the protocol state path set includes: The state path sequence set of the breadth coverage, the state path sequence set of the transfer coverage and the state path sequence set of the enhanced coverage are merged with paths having the same node sequence and redundant paths and unreachable paths are deleted to obtain the protocol state path set.

8. The method according to claim 7, characterized in that Merging paths having the same node sequence on the state path sequence set of breadth coverage, the state path sequence set of transfer coverage, and the state path sequence set of enhanced coverage includes: Performing path matching on the state path sequence set of breadth coverage, the state path sequence set of transfer coverage, and the state path sequence set of enhanced coverage, and identifying paths with the same preceding node sequence in each state path sequence set; Merge the same parts of the node sequences in the paths with the same preceding node sequence in each state path sequence set to obtain a merged path; Different parts of the node sequences in the paths with the same preceding node sequence in each state path sequence set are used as branch paths of the merged path.

9. The method according to claim 1, characterized in that: The obtaining and parsing of actual communication traffic in the power near-field network based on the target communication protocol specification includes: capturing in real time the actual communication traffic in the power near-field network based on the target communication protocol specification; Parsing the actual communication traffic using a protocol parser for the target communication protocol specification to obtain communication key fields; The generating of the actual state transition path based on the parsing result includes: Determine the corresponding communication behavior and communication object state change based on the communication key field; The actual state transition path is constructed based on the actual communication process corresponding to the actual communication traffic, the communication behavior and the state change of the communication object.

10. The method according to claim 1 or 9, characterized in that: The security detection of the actual state transfer path based on the protocol state path set includes: Matching the actual state transition path in the protocol state path set to determine differences in the actual state transition path; Classifying the difference situations existing in the actual state transition path based on preset difference types, and obtaining the difference type corresponding to the actual state transition path and the quantity corresponding to each difference type; Determine the risk score of the actual state transition path based on the risk score of each difference type and the difference type corresponding to the actual state transition path and the number corresponding to each difference type; The safety of the actual state transition path is determined based on the magnitude relationship between the risk score and a preset safety threshold.

11. The method according to claim 10, characterized in that The difference types include state differences and state transfer differences. The state differences include state offsets, state jumps, and state repetitions. The state transfer differences include illegal state transfers and missing state transfers.

12. The method according to claim 10, characterized in that After performing security detection on the actual state transfer path based on the protocol state path set, the method further includes: Producing a corresponding level of danger warning based on the danger score; Based on the actual effect of the danger warning, the danger score corresponding to each of the difference types is adjusted.

13. A power near-field network communication safety detection system, characterized in that: The system comprises: A state machine construction module, used to extract key information in a target communication protocol specification for a power near-field network according to a communication process, and to construct a finite state machine corresponding to the target communication protocol specification based on the key information; A path search module, used to perform a path search on a finite state machine corresponding to the target communication protocol specification to obtain a protocol state path set corresponding to the target communication protocol specification; An actual path generation module, used for acquiring and parsing the actual communication traffic based on the target communication protocol specification in the power near-field network, and generating an actual state transition path based on the parsing result; A security detection module is used to perform security detection on the actual state transfer path based on the protocol state path set.

14. The system according to claim 13, characterized in that The key information is a key information list, and the state machine building module includes: An information extraction submodule is used to extract the communication events of each communication object, the status information of each communication object when the communication event occurs, the triggering conditions of the communication event and the communication impact of the communication event from the target communication protocol specification according to the communication process; extract the communication behaviors associated with each communication event when it occurs from the target communication protocol specification according to the communication process; The list generation submodule is used to generate the key information list based on the communication event, the status information of each communication object when the communication event occurs, the triggering condition of the communication event and the communication impact of the communication event, and the associated communication behavior when the communication event occurs.

15. The system according to claim 14, characterized in that The state machine construction module further includes a state machine construction submodule, and the state machine construction submodule is used for: Determine, based on the key information list, a communication event of each communication object and state information of each communication object when the communication event occurs; Matching trigger conditions of each communication event, communication impact of each communication event, and communication behaviors associated with each communication event based on the key information list; Determine, based on the communication impact, the transfer state corresponding to each communication object after each communication event occurs; Determine the state transition process corresponding to each communication event based on the state information of each communication object when each communication event occurs and the corresponding transfer state of each communication object after each communication event occurs, the triggering condition of each communication event and the communication behavior associated with each communication event; Based on the state transfer process corresponding to each communication event, a finite state machine of the target communication protocol specification is formed.

16. The system according to claim 15, characterized in that The state machine building module also includes: A directed graph construction submodule is used to use the state information of each communication object corresponding to the state transition process in the finite state machine as a node, the communication event corresponding to the state transition process in the finite state machine as a directed edge between the corresponding nodes before and after the state transition, and the triggering condition of the communication event corresponding to the state transition process and the communication behavior associated with the communication event corresponding to the state transition process as the attributes of the directed edge to construct a directed graph corresponding to the finite state machine.

17. The system according to claim 16, characterized in that The path search module includes: A breadth search submodule, used to start from the node corresponding to the initial state in the directed graph, use a breadth-first search algorithm to perform a breadth search of the state path of the directed graph, and obtain a state path sequence set covered by breadth; A depth search submodule, used to start from the node corresponding to the initial state in the directed graph, use a depth-first search algorithm to search for state transitions in the directed graph, and obtain a set of state path sequences covered by the transitions; An enhanced search submodule, which is used to expand and generate the transfer path of the directed graph by solving the Euler circuit, starting from the node corresponding to the initial state in the directed graph, to obtain a state path sequence set with enhanced coverage; The fusion submodule is used to perform path fusion on the state path sequence set of the breadth coverage, the state path sequence set of the transfer coverage and the state path sequence set of the enhanced coverage to obtain the protocol state path set.

18. The system according to claim 17, characterized in that The enhanced search submodule is specifically used for: Determine the node pairs with unequal in-degree and out-degree based on the directed graph, and add directed redundant edges between the node pairs with unequal in-degree and out-degree in the directed graph to make the in-degree and out-degree of each node pair with unequal in-degree and out-degree equal, to obtain an adjusted directed graph; Determine the shortest path between pairs of nodes with unequal in-degree and out-degree in the directed graph using Dijkstra's algorithm; For each node of the adjusted directed graph, determine a core event set corresponding to each node of the adjusted directed graph, and solve an Euler circuit starting from a node corresponding to an initial state of the adjusted directed graph until all edges in the core event set are located in the Euler circuit; The target event in the Euler circuit is extracted in a first-in-first-out order, and the directed redundant edges in the target event are replaced with the shortest path to obtain the state path sequence set of the enhanced coverage.

19. The system according to claim 17, characterized in that The fusion submodule is specifically used for: The state path sequence set of the breadth coverage, the state path sequence set of the transfer coverage and the state path sequence set of the enhanced coverage are merged with paths having the same node sequence and redundant paths and unreachable paths are deleted to obtain the protocol state path set.

20. The system according to claim 19, characterized in that The fusion submodule is also specifically used for: Performing path matching on the state path sequence set of breadth coverage, the state path sequence set of transfer coverage, and the state path sequence set of enhanced coverage, and identifying paths with the same preceding node sequence in each state path sequence set; Merge the same parts of the node sequences in the paths with the same preceding node sequence in each state path sequence set to obtain a merged path; Different parts of the node sequences in the paths with the same preceding node sequence in each state path sequence set are used as branch paths of the merged path.

21. The system according to claim 13, characterized in that The actual path generation module comprises: A traffic acquisition submodule, used for capturing in real time the actual communication traffic in the electric power near-field network based on the target communication protocol specification; A traffic analysis submodule, configured to analyze the actual communication traffic using a protocol analyzer for the target communication protocol specification to obtain communication key fields; The actual path construction submodule is used to determine the corresponding communication behavior and the state change of the communication object based on the communication key field; based on the actual communication process corresponding to the actual communication flow, the communication behavior and the state change of the communication object, construct the actual state transfer path.

22. The system according to claim 13 or 21, characterized in that The safety detection module comprises: A path matching submodule, used for performing path matching of the actual state transition path in the protocol state path set, and determining differences existing in the actual state transition path; A difference classification submodule, used for classifying the difference situations existing in the actual state transition path based on preset difference types, and obtaining the difference type corresponding to the actual state transition path and the quantity corresponding to each difference type; a score determination submodule, configured to determine a risk score of the actual state transition path based on the risk score of each difference type and the difference type corresponding to the actual state transition path and the number corresponding to each difference type; The safety determination submodule is used to determine the safety of the actual state transition path based on the size relationship between the risk score and a preset safety threshold.

23. The system according to claim 22, characterized in that The difference types include state differences and state transfer differences. The state differences include state offsets, state jumps, and state repetitions. The state transfer differences include illegal state transfers and missing state transfers.

24. The system according to claim 22, characterized in that The system further comprises: An alarm module, used for issuing a corresponding level of danger alarm based on the danger score; The score adjustment module is used to adjust the risk score corresponding to each difference type based on the actual effect of the risk warning.

25. An electronic device, characterized in that: include: at least one processor and memory; The memory and the processor are connected via a bus; The memory is used to store one or more programs; When the one or more programs are executed by the at least one processor, the power near-field network communication security detection method according to any one of claims 1 to 12 is implemented.

26. A readable storage medium, characterized in that: An execution program is stored thereon, and when the execution program is executed, the power near-field network communication safety detection method as described in any one of claims 1 to 12 is implemented.

Images