A power distribution terminal fuzzy test attack sample classification method and device

Abstract

The application discloses a power distribution terminal fuzzy test attack sample classification method and device, wherein the method comprises the following steps: analyzing a communication protocol message, and determining variable fields corresponding to various system commands in the communication protocol message; modifying the variable fields according to a pre-set mechanism to obtain a generation sequence; splicing the generation sequence and other fields of the communication protocol message corresponding to the variable fields to form test sample data; constructing a data set according to the test sample data, and dividing the data set into a training set and a test set according to a pre-set proportion; inputting the data set into a fuzzy test sample classification model for training to obtain a trained fuzzy test sample classification model and effective fuzzy test sample classification of the trained fuzzy test sample classification model. The application can more accurately and quickly classify test sample data, so that power distribution terminal communication security risks can be found early, and the safe and stable operation of a power distribution network can be effectively ensured.

Description

Technical Field

[0001] This invention relates to the field of neural network technology, and in particular to a method and apparatus for classifying fuzzy test attack samples of power distribution terminals. Background Technology

[0002] With the widespread application of digital technologies in the power sector, the construction of new power systems is continuously incorporating digital and intelligent technologies such as the Internet of Things, big data, and cloud computing to improve efficiency and management. However, the rapid expansion of the power system's cybersecurity boundaries has increased cybersecurity risks, leading to frequent cyberattacks targeting critical infrastructure such as power systems. Given the massive number of distribution terminal devices, there is an urgent need to conduct security vulnerability analysis on these terminals, proactively identify security risks, and implement closed-loop mitigation measures to enhance the security protection capabilities of distribution network automation terminals and ensure the safe and stable operation of the power system.

[0003] Fuzz testing is primarily used to identify vulnerabilities and abnormal behaviors in software systems. This method ensures the accuracy and effectiveness of testing, thereby increasing the likelihood of discovering security vulnerabilities. It is particularly suitable for the field of vulnerability discovery in industrial control system protocols. Generating test cases is a crucial step in fuzz testing, directly impacting the effectiveness of vulnerability discovery.

[0004] Fuzzing attack sample generation methods mainly include mutation testing and generation testing. Mutation testing generates samples that lack specificity, as they only make superficial modifications to the original samples. Therefore, many mutated samples may not trigger deep-seated vulnerabilities in the program. The probability of generating valid samples gradually decreases with the number of mutations. Generation testing, on the other hand, requires an accurate and in-depth understanding of the input format and protocols processed by the target program, resulting in relatively high development costs. If there are deviations in the understanding of the target input specifications, it will lead to the generation of a large number of invalid test samples, wasting testing resources and time.

[0005] In existing technologies, mutation testing and generation testing, by inputting a large number of test samples into the program, can more thoroughly test the potential security risks of the equipment and comprehensively cover possible communication vulnerabilities of the terminal equipment. However, this also results in large-scale data redundancy and reduces the timeliness of fuzz testing. In addition, the communication protocols of power distribution terminals follow strict definitions and specifications. If the generated test cases do not meet the relevant specifications, the communication messages cannot be checked and verified by the terminal equipment under test, thus affecting the validity of the fuzz test results.

[0006] This section is intended to provide background or context for the embodiments of the invention set forth in the claims. The description herein is not an admission that it is prior art simply because it is included in this section. Summary of the Invention

[0007] This invention provides a method for classifying fuzzy test attack samples for power distribution terminals. This method can classify test sample data more accurately and quickly, effectively supporting subsequent fuzzy testing experiments, facilitating early detection of communication security vulnerabilities in power distribution terminals, and strongly ensuring the safe and stable operation of the power distribution network. The fuzzy test attack sample classification method includes:

[0008] Obtain the communication protocol messages of the power distribution terminal;

[0009] The communication protocol message is parsed to determine the variable fields corresponding to various system commands in the communication protocol message;

[0010] The variable field is modified according to a pre-set mechanism to obtain the generated sequence;

[0011] The generated sequence is concatenated with other fields of the communication protocol message corresponding to the variable field to form test sample data;

[0012] A dataset is constructed based on the test sample data, and the dataset is divided into a training set and a test set according to a preset ratio;

[0013] The dataset is input into the fuzzy test sample classification model for training, resulting in the trained fuzzy test sample classification model and its classification as valid fuzzy test samples.

[0014] Furthermore, the step of parsing the communication protocol message to determine the variable fields corresponding to various system commands in the communication protocol message includes:

[0015] Based on the type identifier in the communication protocol message, determine the various system commands corresponding to the communication protocol message;

[0016] Feature extraction is performed on the various system commands to determine the variable fields of the various system commands.

[0017] Furthermore, constructing the dataset based on the test sample data includes:

[0018] The test sample data is input into the power distribution terminal for sample testing to obtain the category labels corresponding to various system commands.

[0019] The test sample data and its corresponding category labels are preprocessed to obtain the processed dataset.

[0020] Further, data preprocessing of the test sample data and its corresponding category labels includes:

[0021] According to the field format definition of the communication protocol message, the test sample data is segmented sequentially;

[0022] The test sample data in text form is converted into vector form using a pre-trained word vector model.

[0023] Further, the step of inputting the dataset into the fuzzy test sample classification model for training includes:

[0024] Initialize the parameters of the fuzzy test sample classification model;

[0025] The sample sequence in the training set is trained sequentially through the convolutional layer, pooling layer and fully connected layer of the fuzzy test sample classification model to obtain the predicted probability of various system commands and the initially trained fuzzy test sample classification model.

[0026] The initial fuzzy test sample classification model is iteratively trained using the Adam algorithm to obtain the trained fuzzy test sample classification model.

[0027] Furthermore, the method also includes:

[0028] The trained fuzzy test sample classification model is evaluated using an evaluation algorithm.

[0029] Furthermore, the method also includes:

[0030] The fuzzy test samples identified as valid by the fuzzy test sample classification model in the test set are sent to the power distribution terminal to be tested.

[0031] Determine whether the abnormal state of the power distribution terminal is triggered based on the response of the power distribution terminal;

[0032] After receiving a terminal response message within a preset time, the system analyzes whether the power distribution terminal has any communication vulnerabilities. If the power distribution terminal has communication vulnerabilities, the fuzzy test sample is determined to be a valid fuzzy test sample, and the label of the fuzzy test sample is determined to be valid. If the power distribution terminal does not have any communication vulnerabilities, the fuzzy test sample is determined to be an invalid fuzzy test sample, and the label of the fuzzy test sample is determined to be invalid.

[0033] The relabeled test set is incorporated into the training set, and the training set and the test set are re-divided according to the preset ratio;

[0034] The dataset is input into the fuzzy test sample classification model for iterative training until all fuzzy test samples marked as valid in the prediction results of the fuzzy test sample classification model are considered to be true and valid.

[0035] This invention also provides a fuzzy test attack sample classification device for power distribution terminals, which improves the generalization ability of the fuzzy test sample classification model to unknown sample data, thereby adapting to different test scenarios. The fuzzy test attack sample classification device includes:

[0036] The message acquisition module is used to acquire the communication protocol messages of the power distribution terminal;

[0037] The message parsing module is used to parse the communication protocol message and determine the variable fields corresponding to various system commands in the communication protocol message;

[0038] The variable field modification module is used to modify the variable field according to a pre-set mechanism to obtain the generated sequence;

[0039] The test sample generation module is used to concatenate the generated sequence with other fields of the communication protocol message corresponding to the variable field to form test sample data;

[0040] The dataset construction module is used to construct a dataset based on the test sample data and divide the dataset into a training set and a test set according to a preset ratio.

[0041] The first iteration training module is used to input the dataset into the fuzzy test sample classification model for training, and to obtain the trained fuzzy test sample classification model and its classification as valid fuzzy test samples.

[0042] Furthermore, the message parsing module includes:

[0043] The command determination unit is used to determine the various system commands corresponding to the communication protocol message based on the type identifier in the communication protocol message;

[0044] The feature extraction unit is used to extract features from the various system commands and determine the variable fields of the various system commands.

[0045] Furthermore, the dataset construction module includes:

[0046] The terminal testing unit inputs the test sample data into the power distribution terminal to perform sample testing and obtains the category labels corresponding to various system commands.

[0047] The data preprocessing unit is used to preprocess the test sample data and its corresponding category labels to obtain the processed dataset.

[0048] Furthermore, the data preprocessing unit includes:

[0049] The word segmentation subunit is used to segment the test sample data sequentially according to the field format definition of the communication protocol message;

[0050] The vector transformation subunit is used to convert test sample data in text form into vector form using a pre-trained word vector model.

[0051] Furthermore, the first iterative training module includes:

[0052] The initialization unit is used to initialize the parameters of the fuzzy test sample classification model.

[0053] The model training unit is used to train the sample sequences in the training set through the convolutional layer, pooling layer and fully connected layer of the fuzzy test sample classification model to obtain the predicted probabilities of various system commands and the initially trained fuzzy test sample classification model.

[0054] The model optimization unit is used to iteratively train the initially trained fuzzy test sample classification model using the Adam algorithm to obtain the trained fuzzy test sample classification model.

[0055] Furthermore, the device also includes:

[0056] The model evaluation module is used to evaluate the trained fuzzy test sample classification model using an evaluation algorithm.

[0057] Furthermore, the device also includes:

[0058] The data transmission module is used to send the fuzzy test samples that are determined to be valid by the fuzzy test sample classification model in the test set to the power distribution terminal to be tested.

[0059] The response judgment module is used to determine whether the abnormal state of the power distribution terminal is triggered based on the response of the power distribution terminal;

[0060] The label correction module is used to analyze whether there is a communication vulnerability in the power distribution terminal after receiving a terminal response message within a preset time. If there is a communication vulnerability in the power distribution terminal, the fuzzy test sample is determined to be a valid fuzzy test sample, and the label of the fuzzy test sample is determined to be valid. If there is no communication vulnerability in the power distribution terminal, the fuzzy test sample is determined to be an invalid fuzzy test sample, and the label of the fuzzy test sample is determined to be invalid.

[0061] The dataset update module is used to incorporate the relabeled test set into the training set and to redivide the training set and the test set according to the preset ratio;

[0062] The second iterative training module is used to input the dataset into the fuzzy test sample classification model for iterative training until all fuzzy test samples marked as valid in the prediction results of the fuzzy test sample classification model are real and valid.

[0063] This invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the above-mentioned method for classifying fuzzy test attack samples of power distribution terminals.

[0064] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method for classifying fuzzy test attack samples for power distribution terminals.

[0065] This invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements the above-described method for classifying fuzzy test attack samples for power distribution terminals.

[0066] This invention provides a method and apparatus for classifying fuzzy attack samples in power distribution terminals. By extracting and modifying features from variable fields of public and private protocol commands in communication messages, test sample data is generated. This improves the generalization ability of the fuzzy test sample classification model to unknown sample data, thereby adapting to different testing scenarios. Automated classification using fuzzy testing technology concentrates limited testing resources and time on effective fuzzy test samples that are more likely to discover vulnerabilities in power distribution terminals, thus optimizing the allocation of testing resources and time. The trained fuzzy test sample classification model can classify test sample data more accurately and quickly, accelerating the detection and verification of potential vulnerabilities in power distribution terminals. This shortens the cycle from vulnerability detection to vulnerability remediation, thereby improving the security of power distribution terminals and ensuring their safe and stable operation. Attached Figure Description

[0067] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0068] Figure 1 This is a flowchart illustrating a method for classifying fuzzy test attack samples of a power distribution terminal according to an embodiment of the present invention.

[0069] Figure 2 This is a flowchart illustrating the method for classifying fuzzy test attack samples of power distribution terminals in another embodiment of the present invention.

[0070] Figure 3This is a flowchart illustrating the method for classifying fuzzy test attack samples of power distribution terminals in another embodiment of the present invention.

[0071] Figure 4 This is a flowchart illustrating the method for classifying fuzzy test attack samples of power distribution terminals in another embodiment of the present invention.

[0072] Figure 5 This is a flowchart illustrating the method for classifying fuzzy test attack samples of power distribution terminals in another embodiment of the present invention.

[0073] Figure 6 This is a flowchart illustrating the method for classifying fuzzy test attack samples of power distribution terminals in another embodiment of the present invention.

[0074] Figure 7 This is a schematic diagram of the structure of a power distribution terminal fuzzy test attack sample classification device in one embodiment of the present invention;

[0075] Figure 8 This is a schematic diagram of the structure of a power distribution terminal fuzzy test attack sample classification device in another embodiment of the present invention;

[0076] Figure 9 This is a schematic diagram of the structure of a power distribution terminal fuzzy test attack sample classification device in another embodiment of the present invention;

[0077] Figure 10 This is a schematic diagram of the structure of a power distribution terminal fuzzy test attack sample classification device in another embodiment of the present invention;

[0078] Figure 11 This is a schematic diagram of the structure of a power distribution terminal fuzzy test attack sample classification device in another embodiment of the present invention;

[0079] Figure 12 This is a schematic diagram of the physical structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0080] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0081] The information collected in the technical solution of this application is information and data authorized by the user or fully authorized by all parties. The collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data all comply with the relevant laws, regulations and standards of the relevant countries and regions, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation portals are provided for users to choose to authorize or refuse.

[0082] Provide users with corresponding operation entry points, allowing them to choose to agree to or reject the automated decision results; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0083] To achieve fuzz test sample classification of communication protocol messages in power distribution terminals, thereby reducing the workload of manual screening and significantly improving the efficiency of fuzz testing, the TextCNN model, through the construction of a multi-layer neural network model, can automatically learn complex patterns and extract corresponding features from a large amount of communication protocol message data, thus more accurately identifying and classifying valid and invalid fuzz test messages. Fuzz testing, through dynamically executed testing methods, can maintain a low false positive rate, thereby increasing the possibility of detecting security vulnerabilities in power distribution terminals. This invention provides a method and apparatus for classifying fuzz test attack samples in power distribution terminals.

[0084] Figure 1 This is a flowchart illustrating the fuzzy test attack sample classification method for power distribution terminals in an embodiment of the present invention. Figure 1 As shown, the fuzz test attack sample classification method includes steps 101 to 106.

[0085] Step 101: Obtain the communication protocol message of the power distribution terminal.

[0086] Step 102: Parse the communication protocol message to determine the variable fields corresponding to various system commands in the communication protocol message.

[0087] Step 103: Modify the variable fields according to the pre-set mechanism to obtain the generated sequence.

[0088] Step 104: Concatenate the generated sequence with the other fields of the communication protocol message corresponding to the variable field to form test sample data.

[0089] Step 105: Construct a dataset based on the test sample data, and divide the dataset into a training set and a test set according to a preset ratio.

[0090] Step 106: Input the dataset into the fuzzy test sample classification model for training, and obtain the trained fuzzy test sample classification model and its classification as valid fuzzy test samples.

[0091] from Figure 1As shown in the flowchart, in this embodiment of the invention, by extracting and modifying the features of variable fields of public and private protocol commands in communication messages, test sample data is formed. This improves the generalization ability of the fuzzy test sample classification model to unknown sample data, thereby adapting to different testing scenarios. Automated classification using fuzzy testing technology allows limited testing resources and time to be concentrated on effective fuzzy test samples that are more likely to discover vulnerabilities in power distribution terminals, thus optimizing the allocation of testing resources and time. The trained fuzzy test sample classification model can classify test sample data more accurately and quickly, accelerating the detection and verification of potential vulnerabilities in power distribution terminals, shortening the cycle from vulnerability detection to vulnerability repair, thereby improving the security of power distribution terminals and ensuring their safe and stable operation.

[0092] like Figure 1 As shown below, each step will be explained in detail.

[0093] Step 101: Obtain the communication protocol message of the power distribution terminal.

[0094] Specifically, Wireshark is used to capture packets on the network card of the power distribution automation terminal detection platform to obtain the communication protocol messages corresponding to various system commands of power distribution terminals from different brands.

[0095] The system instructions in the acquired communication protocol messages include: connecting to the terminal, disconnecting the terminal, general call, reading time, clock synchronization, terminal reset, terminal software upgrade, remote splitting, remote reconnection, reading inherent parameters, reading operating parameters, writing operating parameters, reading setpoints, writing setpoints, switching setpoint areas, reading the waveform file directory, reading the historical file directory, and reading files.

[0096] In one embodiment, the distribution terminal collects real-time operating data of the distribution network and then uploads the collected data to the distribution network automation system via the IEC 60870-5-104 protocol. This enables the distribution network automation system to monitor the distribution network operation at any time and make correct decisions. Furthermore, the distribution terminal can be remotely controlled via the distribution network automation system, thereby shortening the fault handling time of the distribution terminal and reducing the cost of manual maintenance.

[0097] In one embodiment, IEC 60870-5-104 protocol samples of distribution terminals and distribution network automation systems are used as raw data for training the TextCNN model.

[0098] Step 102: Parse the communication protocol message to determine the variable fields corresponding to various system commands in the communication protocol message.

[0099] Communication protocol messages typically consist of two parts: Application Protocol Control Information (APCI) and Application Service Data Unit (ASDU). The APCI and ASDU together constitute the Application Protocol Data Unit (APDU), which is the basic unit of transmission in the IEC 60870-5-104 protocol.

[0100] In one embodiment, the APDU field may contain only the APCI field, or it may contain both the APCI and ASDU fields. The APCI field has a fixed length of 6 bytes, while the ASDU field has a variable length. In practical applications, the distinction between the APCI and ASDU fields is determined by the structure and content of the message. The APCI field, as control information, has a relatively fixed format and content, used to test the power distribution terminal's verification mechanism for the transmission and reception order of communication protocol messages. The ASDU field, on the other hand, varies in format and content depending on different data types and service requirements.

[0101] Specifically, by parsing the acquired communication protocol messages, the data unit identifier and transmission reason in the ASDU field of the communication protocol message are obtained. The data unit identifier includes the Type Identifier (TI), Structure Qualifier (SQ), Cause of Transmission (COT), and Common Address of ASDU (COA). The Type Identifier in the ASDU field defines the structure, type, and format of the information object.

[0102] like Figure 2 As shown, step 102 includes steps 201 to 202.

[0103] Step 201: Determine the various system commands corresponding to the communication protocol message based on the type identifier in the communication protocol message.

[0104] Specifically, based on the type identifier in the data unit identifier of the ASDU field, the various system commands corresponding to the communication protocol message are determined.

[0105] As shown in Table 1, the commonly used system commands in the communication protocol messages of the control direction of the distribution network automation system include: station general call command, clock synchronization command, reset process command, remote control command, single point command, two point command, switch setting area, read setting area number, read parameters and setting value, and write parameters and setting value, etc.

[0106] The correspondence between different system commands and their type identifiers is as follows:

[0107]

[0108]

[0109] Table 1 Message Type Identifier

[0110] In one embodiment, the communication protocol is divided into a public protocol and a private protocol. The system commands of the public protocol include: station general call command, clock synchronization command, reset process command, and remote control command, etc. The system commands of the private protocol include: switching setting areas, reading setting area numbers, reading parameters and setting values, and writing parameters and setting values, etc. Therefore, by determining the type identifier of the data unit identifier in the ASDU field, it is possible to determine which commands correspond to the communication protocol message, thereby distinguishing whether the communication protocol message is a public protocol or a private protocol.

[0111] Step 202: Extract features from various system commands to determine the variable fields of each system command.

[0112] The control fields in the APCI fields of various system commands are treated as variable fields. Feature extraction is performed on the ASDU fields of various system commands to determine the variable fields of system commands such as station general call command, clock synchronization command, reset process command, remote control command, single-point command, two-point command, switching setting area, reading setting area number, reading parameters and setting value, and writing parameters and setting value.

[0113] In one embodiment, the ASDU variable fields of the station general call command include the ASDU public address and the call qualifier of interrogation (QOI).

[0114] In one embodiment, the variable field of the clock synchronization command is the timestamp in the communication protocol message characteristics, i.e., time information, such as milliseconds, minutes, hours, days, months, and years. The variable field of the reset process command is the reset process command qualifier in the communication protocol message characteristics. The variable fields of the remote control command include: the information object address, single command SCO, or dual command DCO in the communication protocol message characteristics.

[0115] In one embodiment, the variable fields for reading parameters and setting commands include: a variable frame length qualifier, an information object address, a setting area number, and an ASDU common address. The variable fields for writing parameters and setting commands include: an information object address, a setting area number, an ASDU common address, a parameter feature identifier, a data type, and a data length and value. The variable field for the setting area switching command is the setting area number. The variable field for the reading setting area number command is the ASDU common address.

[0116] In one embodiment, the acquired communication protocol messages are processed by protocol layering and data clustering according to the message type identifier.

[0117] Specifically, based on the structure of the IEC 60870-5-104 protocol, communication protocol messages are divided into different categories (i.e., different system commands) according to the message type identifier. Variable fields are determined for each category of communication protocol messages. The message data corresponding to each type of system command is collected and organized into independent datasets to facilitate targeted processing and analysis of different categories of system commands in the future.

[0118] Step 103: Modify the variable fields according to the pre-set mechanism to obtain the generated sequence.

[0119] Specifically, the variable fields of the extracted communication protocol messages are modified according to generation-based and mutation-based methods.

[0120] In one embodiment, the generation-based method generates legitimate test sample cases that conform to the distribution terminal protocol specification. The mutation-based method generates anomalous random test sample cases to improve the coverage of test sample cases. The methods for generating and mutating tests include: continuous tampering, limiting range value modification, bit flipping, and bit shifting, etc., modifying the extracted variable fields according to the above methods to obtain the modified generation sequence. Since the modified generation sequence covers various possible abnormal situations, it can ensure the diversity and comprehensiveness of the dataset.

[0121] Step 104: Concatenate the generated sequence with the other fields of the communication protocol message corresponding to the variable field to form test sample data.

[0122] Specifically, the generated sequence is concatenated with the remaining fields of the communication protocol message corresponding to the original variable fields to form test cases. A large number of test cases constitute the test sample data, which serves as the foundation for subsequently building the dataset.

[0123] In one embodiment, test cases with formatting errors, missing data, obvious anomalies, or non-compliance with communication protocol specifications are deleted from the test sample data to ensure that each test case is valid and parsable. For example, checking whether the message length of the test case meets the requirements and whether the field values ​​are within a reasonable range.

[0124] In one embodiment, if duplicate test cases exist in the test sample data, the duplicate test cases are deleted and only one copy is retained to avoid the impact of data redundancy on the subsequent training of the fuzzy test sample classification model, and also to ensure that the test cases in the test sample data are representative and independent.

[0125] Step 105: Construct a dataset based on the test sample data, and divide the dataset into a training set and a test set according to a preset ratio.

[0126] like Figure 3 As shown, step 105 includes steps 301 and 302.

[0127] Step 301: Input the test sample data into the power distribution terminal for sample testing, and initially obtain the category (valid or invalid) labels corresponding to various system commands.

[0128] Specifically, all test cases in the test sample data are input into the power distribution terminal for sample testing, thereby classifying all test cases in the test sample data into valid fuzzy test samples and invalid fuzzy test samples. Test cases in the test sample data that can be abnormally responded to or rejected by the power distribution terminal are initially defined as valid fuzzy test samples. Test cases in the test sample data that can be normally responded to or rejected by the power distribution terminal are initially defined as invalid fuzzy test samples.

[0129] Label various system commands to build a label table for system commands.

[0130] The correspondence between different system commands and their type labels is as follows:

[0131] System commands Label Convenor effective 0 General call invalid 1 Clock synchronization is effective 2 Clock synchronization failure 3 Reset process valid 4 Reset process invalid 5 Remote control single point effective 6 Remote single-point ineffective 7 Remote control dual-point effective 8 Remote dual-point ineffective 9 Switching to the setpoint area is effective 10 Switching the setpoint area is invalid. 11 Reading the fixed value area code is valid. 12 Reading the fixed value area code is invalid. 13 Reading parameters and setting values ​​is valid. 14 Reading parameters and fixed values ​​is invalid. 15 Writing parameters and fixed values ​​is valid 16 Writing parameters and fixed values ​​is invalid. 17

[0132] Table 2 Category Labels

[0133] The above category label table allows all test cases in the test sample data to be divided into different categories according to various system commands of public and private protocols.

[0134] Step 302: Perform data preprocessing on the test sample data and its corresponding category labels to obtain the processed dataset.

[0135] like Figure 4 As shown, step 302 includes steps 401 to 402.

[0136] Step 401: According to the field format definition of the communication protocol message, the test sample data is segmented in a preset order.

[0137] Specifically, each test case in the test sample data is first converted into text format. For example, integers are converted into their corresponding string representations. Then, the test cases are segmented according to the format definitions and lengths of the APCI startup character, APDU length field, control fields 1 and 2, control fields 3 and 4, ASDU type identifier, variable structure, qualifier VSQ, transmission reason, ASDU common address, and information object address fields, with different fields separated by spaces.

[0138] In one embodiment, a uniform standard length L is set for all test cases in the test sample data. When the length of a test case in the test sample data exceeds L, the length of the test case is truncated to L. When the length of a test case in the test sample data is less than L, zeros are padded to the end of the test case to make its length L.

[0139] The above test sample dataset is divided into a training set and a test set in an 8:2 ratio, resulting in dataset D. Dataset D = {(d1,l1),(d2,l2),…,(d…} N ,l N )}, where d represents the processed test case, i.e., the specific communication protocol message; l represents the label corresponding to the test case; and N is the number of test cases in the dataset.

[0140] Step 402: Convert the test sample data in text form into vector form using a pre-trained word vector model.

[0141] Specifically, a pre-trained word vector model, Word2Vec, is used to convert the text-based test sample data into vector form, which serves as the input data for the TextCNN model. The field values ​​obtained after word segmentation in the converted text test cases are then converted into corresponding word vectors using Word2Vec. Each word vector is then sorted according to its original order in the test cases, resulting in an input sequence S. This large number of input sequences S are used as the input data for training the TextCNN model, where each input sequence S represents the feature information of the communication protocol messages in the test cases.

[0142] Step 106: Train the fuzzy test sample classification model in the dataset to obtain the trained fuzzy test sample classification model and its classification as valid fuzzy test samples.

[0143] like Figure 5 As shown, step 106 includes steps 501 to 503.

[0144] Step 501: Initialize the parameters of the fuzzy test sample classification model. The fuzzy test sample classification model is the TextCNN model.

[0145] Specifically, a large training set consisting of a large number of input sequences S and their corresponding labels is input into the TextCNN model for training. The model parameters of the TextCNN model are initialized, with the number of training epochs set to 100, the learning rate to 0.002, and the batch size to 64. This invention is not limited to these settings.

[0146] Step 502: The sample sequences in the training set are trained sequentially through the convolutional layers, pooling layers, and fully connected layers of the TextCNN model to obtain the predicted probabilities of various system commands and the initial training fuzzy test sample classification model.

[0147] Specifically, the input sequence S is fed into multiple convolutional layers, each using a different size convolutional kernel. In this embodiment, the convolutional kernel sizes of the TextCNN model are set to 3, 4, and 5, and the number of channels (i.e., the number of convolutional kernels) for each type of convolutional kernel is 100. This invention is not limited to this.

[0148] First, in the convolutional layer, a filter is used to perform a convolution operation on the input sequence S to extract its feature information. After the convolution operation, a ReLU nonlinear activation function is applied for a nonlinear transformation to enhance the expressive power of the neural network. Then, in the pooling layer, max pooling is used to reduce computation and enhance the translation invariance of features. Finally, in the fully connected layer, a multi-class cross-entropy loss function based on Softmax is used to output the predicted probabilities of various system commands, i.e., the prediction bias of various system commands.

[0149] Step 503: Iteratively train the initially trained fuzzy test sample classification model using the Adam algorithm to obtain the trained fuzzy test sample classification model.

[0150] Specifically, the Adam optimization algorithm is used as the optimization algorithm for the fuzzy test sample classification model. Iterative training using the Adam optimization algorithm reduces prediction bias, minimizing the deviation between the final prediction result and the actual value. The Adam optimization algorithm automatically calculates the gradient of the loss function with respect to the model parameters to dynamically adjust the model parameters and minimize the loss function.

[0151] The method for classifying fuzzy test attack samples for power distribution terminals also includes: predicting all data in the test set of the dataset, and evaluating the performance of the trained fuzzy test sample classification model through an evaluation algorithm.

[0152] Specifically, after the model training is completed, the accuracy and F1 score are calculated on the test set using an evaluation algorithm to evaluate the trained fuzzy test sample classification model, and the F1 score and accuracy are used as evaluation indicators.

[0153] In one embodiment, during model training, the F1 score and accuracy can be calculated on the test set using an evaluation algorithm to adjust model parameters and monitor for overfitting in the fuzzy test sample classification model. The generalization ability of the fuzzy test sample classification model is evaluated based on the F1 score and accuracy to improve its stability and reliability.

[0154] The formula for calculating accuracy is:

[0155]

[0156] Wherein, TP (True Positive) is the number of samples correctly predicted as positive by the model, TN (True Negative) is the number of samples correctly predicted as negative by the model, FP (False Positive) is the number of samples incorrectly predicted as positive by the model, and FN (False Negative) is the number of samples incorrectly predicted as negative by the model.

[0157] Before calculating the F1 score, precision and recall must be calculated first.

[0158] The formula for calculating accuracy is:

[0159]

[0160] Where P is the accuracy, TP is the number of samples correctly predicted as positive, and FP is the number of samples incorrectly predicted as positive.

[0161] The formula for calculating recall rate is:

[0162]

[0163] Where r is the recall rate, TP is the number of samples correctly predicted as positive, and FN is the number of samples incorrectly predicted as negative.

[0164] After obtaining the precision and recall, calculate the F1 value according to formula (4).

[0165] The formula for calculating the F1 value is:

[0166]

[0167] Where F1 is the F1 score, P is the precision, and r is the recall.

[0168] like Figure 6 As shown, the fuzzy test attack sample classification method for power distribution terminals also includes steps 601 to 605.

[0169] Step 601: Send the fuzzy test samples that are determined to be valid by the fuzzy test sample classification model in the test set to the power distribution terminal to be tested.

[0170] Step 602: Determine whether the abnormal state of the power distribution terminal is triggered based on the response of the power distribution terminal.

[0171] Specifically, the status of the power distribution terminal is determined by whether it replies with a terminal response message.

[0172] Step 603: After receiving the terminal response message within a preset time, analyze whether the power distribution terminal has any communication vulnerabilities. If the power distribution terminal has any communication vulnerabilities, determine that the fuzzy test sample is a valid fuzzy test sample and determine that the label of the fuzzy test sample is valid. If the power distribution terminal does not have any communication vulnerabilities, determine that the fuzzy test sample is an invalid fuzzy test sample and determine that the label of the fuzzy test sample is invalid.

[0173] Specifically, if a terminal response message is received within a preset time, and analysis determines that a fuzzy test sample classified as valid by the fuzzy test sample classification model can cause communication vulnerabilities in the power distribution terminal, then the fuzzy test sample classified as valid by the fuzzy test sample classification model is deemed truly valid, and its label is deemed valid. If a terminal response message is received within a preset time, and analysis determines that a fuzzy test sample classified as valid by the fuzzy test sample classification model cannot cause communication vulnerabilities in the power distribution terminal, then the fuzzy test sample classified as valid by the fuzzy test sample classification model is deemed invalid, and the label of the fuzzy test sample classified as valid by the fuzzy test sample classification model is modified to invalid based on the verification results.

[0174] Step 604: Incorporate the relabeled test set into the training set, and redivide the training set and test set according to a preset ratio.

[0175] Step 605: Input the dataset into the fuzzy test sample classification model for iterative training until all fuzzy test samples marked as valid in the prediction results of the fuzzy test sample classification model are real and valid.

[0176] Specifically, the relabeled test set is incorporated into the training set, and the dataset is re-split into training and test sets at an 8:2 ratio. The re-split dataset is then input into the fuzzy test sample classification model for iterative training until all fuzzy test samples predicted by the model are considered truly valid.

[0177] In one embodiment, a multi-round iterative fuzzy test sample dataset is used to perform fuzzy testing on more than 10 power distribution terminals of different brands to detect the types of vulnerabilities in the power distribution terminals. The vulnerability types include: unauthorized vulnerabilities (i.e., unauthorized remote control), arbitrary tampering vulnerabilities (i.e., arbitrary tampering of the clock and / or arbitrary tampering of remote adjustment parameters, etc.), denial-of-service vulnerabilities (i.e., resetting the terminal process), and configuration error vulnerabilities (i.e., error type identification, unprotected upper limit of remote adjustment parameter values, invalid setpoint area code, and / or abnormal terminal addressing), etc.

[0178] In this embodiment of the invention, test sample data is formed by extracting and modifying the variable fields of public and private protocol commands in communication messages to improve the generalization ability of the fuzzy test sample classification model for unknown sample data, thereby adapting to different testing scenarios. Automated classification using fuzzy testing technology allows limited testing resources and time to be concentrated on effective fuzzy test samples that are more likely to discover vulnerabilities in power distribution terminals, thus optimizing the allocation of testing resources and time. The trained fuzzy test sample classification model can classify test sample data more accurately and quickly, accelerating the detection and verification of potential vulnerabilities in power distribution terminals, shortening the cycle from vulnerability detection to vulnerability repair, thereby improving the security of power distribution terminals and ensuring their safe and stable operation. The fuzzy test samples generated and screened by the above method can effectively trigger power distribution terminal anomalies. This improves the efficiency of fuzzy testing and reduces manual input costs.

[0179] This invention also provides a device for classifying fuzzy test attack samples for power distribution terminals, as described in the following embodiments. Since the principle behind this device is similar to the method for classifying fuzzy test attack samples for power distribution terminals, the implementation of this device can refer to the implementation of the method for classifying fuzzy test attack samples for power distribution terminals; repeated details will not be elaborated further.

[0180] like Figure 7 As shown, the power distribution terminal fuzzy test attack sample classification device includes a message acquisition module 701, a message parsing module 702, a variable field modification module 703, a test sample generation module 704, a dataset construction module 705, and a first iteration training module 706.

[0181] The message acquisition module 701 is used to acquire the communication protocol messages of the power distribution terminal.

[0182] The message parsing module 702 is used to parse communication protocol messages and determine the variable fields corresponding to various system commands in the communication protocol messages.

[0183] The variable field modification module 703 is used to modify the variable field according to a pre-set mechanism to obtain the generated sequence.

[0184] The test sample generation module 704 is used to concatenate the generated sequence with other fields of the communication protocol message corresponding to the variable field to form test sample data.

[0185] The dataset construction module 705 is used to construct a dataset based on the test sample data and divide the dataset into a training set and a test set according to a preset ratio.

[0186] The first iteration training module 706 is used to input the dataset into the fuzzy test sample classification model for training, and obtain the trained fuzzy test sample classification model and its classification as valid fuzzy test samples.

[0187] like Figure 8 As shown, the message parsing module 702 includes a command determination unit 801 and a feature extraction unit 802.

[0188] The command determination unit 801 is used to determine the various system commands corresponding to the communication protocol message based on the type identifier in the communication protocol message.

[0189] The feature extraction unit 802 is used to extract features from various system commands and determine the variable fields of various system commands.

[0190] like Figure 9 As shown, the dataset construction module 705 includes a terminal testing unit 901 and a data preprocessing unit 902.

[0191] The terminal test unit 901 is used to input test sample data into the power distribution terminal for sample testing and obtain the category labels corresponding to various system commands.

[0192] The data preprocessing unit 902 is used to preprocess the test sample data and its corresponding category labels to obtain the processed dataset.

[0193] like Figure 10 As shown, the data preprocessing unit 902 includes a word segmentation subunit 1001 and a vector transformation subunit 1002.

[0194] The word segmentation subunit 1001 is used to segment the test sample data sequentially according to the field format definition of the communication protocol message.

[0195] The vector transformation subunit 1002 is used to convert test sample data in text form into vector form using a pre-trained word vector model.

[0196] like Figure 11 As shown, the first iteration training module 706 includes an initialization unit 111, a model training unit 112, and a model optimization unit 113.

[0197] The initialization unit is used to initialize the parameters of the fuzzy test sample classification model.

[0198] The model training unit is used to train the sample sequences in the training set sequentially through the convolutional layer, pooling layer and fully connected layer of the fuzzy test sample classification model, so as to obtain the predicted probability of various system commands and the initially trained fuzzy test sample classification model.

[0199] The model optimization unit is used to iteratively train the initially trained fuzzy test sample classification model using the Adam algorithm to obtain the trained fuzzy test sample classification model.

[0200] The power distribution terminal fuzz test attack sample classification device also includes a model evaluation module 707.

[0201] The model evaluation module is used to evaluate the trained fuzzy test sample classification model using an evaluation algorithm.

[0202] The power distribution terminal fuzz test attack sample classification device also includes a data transmission module 708, a response judgment module 709, a label correction module 710, a dataset update module 711, and a second iteration training module 712.

[0203] The data transmission module 708 is used to send the fuzzy test samples that have been determined to be valid by the fuzzy test sample classification model in the test set to the power distribution terminal to be tested.

[0204] The response judgment module 709 is used to determine whether an abnormal state of the power distribution terminal is triggered based on the response of the power distribution terminal.

[0205] The label correction module 710 is used to analyze whether there is a communication vulnerability in the power distribution terminal after receiving the terminal response message within a preset time. If there is a communication vulnerability in the power distribution terminal, the fuzzy test sample is determined to be a valid fuzzy test sample, and the label of the fuzzy test sample is determined to be valid. If there is no communication vulnerability in the power distribution terminal, the fuzzy test sample is determined to be an invalid fuzzy test sample, and the label of the fuzzy test sample is determined to be invalid.

[0206] The dataset update module 711 is used to incorporate the relabeled test set into the training set and to redivide the training set and test set according to a preset ratio.

[0207] The second iterative training module 712 is used to input the dataset into the fuzzy test sample classification model for iterative training until all fuzzy test samples marked as valid in the prediction results of the fuzzy test sample classification model are real and valid.

[0208] Figure 12 This is a schematic diagram of the physical structure of an electronic device provided in an embodiment of the present invention, such as... Figure 12 As shown, the electronic device 120 includes a processor 121, a memory 122, and a bus 123.

[0209] The processor 121 and the memory 122 communicate with each other via the bus 123.

[0210] The processor 121 is used to call program instructions in the memory 122 to execute the methods provided in the above-described method embodiments.

[0211] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method for classifying fuzzy test attack samples for power distribution terminals.

[0212] This invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements the above-described method for classifying fuzzy test attack samples for power distribution terminals.

[0213] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0214] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1A device that provides the functions specified in one or more boxes.

[0215] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0216] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0217] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A power distribution terminal fuzz testing attack sample classification method, characterized in that, The method comprises the following steps: Obtaining a communication protocol message of a power distribution terminal; Parsing the communication protocol message to determine the variable fields corresponding to each type of system command in the communication protocol message; Modifying the variable fields according to a pre-set mechanism to obtain a generated sequence; Splicing the generated sequence with other fields of the communication protocol message corresponding to the variable fields to form test sample data; Constructing a data set according to the test sample data and dividing the data set into a training set and a test set according to a pre-set proportion; Inputting the data set into the fuzzy test sample classification model for training to obtain a trained fuzzy test sample classification model and the classification of the fuzzy test sample as valid; wherein the fuzzy test sample classification model is a TextCNN model; The method further comprises the following steps: sending the fuzzy test sample in the test set determined as valid by the fuzzy test sample classification model to a power distribution terminal to be detected; determining whether an abnormal state of the power distribution terminal is triggered according to the response of the power distribution terminal; after receiving a terminal response message within a pre-set time, analyzing whether the power distribution terminal has a communication risk; if the power distribution terminal has a communication risk, determining that the fuzzy test sample is a valid fuzzy test sample and determining that the label of the fuzzy test sample is valid; if the power distribution terminal does not have a communication risk, determining that the fuzzy test sample is an invalid fuzzy test sample and determining that the label of the fuzzy test sample is invalid; incorporating the re-labeled test set into the training set and re-dividing the training set and the test set according to the pre-set proportion; inputting the data set into the fuzzy test sample classification model for iterative training until all the fuzzy test samples marked as valid in the prediction results of the fuzzy test sample classification model are real and valid; In the convolution layer of the TextCNN model, the test sample is convolved by a filter to extract feature information in the test sample; after the convolution operation, a ReLU nonlinear activation function is used for nonlinear transformation; in the pooling layer of the TextCNN model, maximum pooling is used for pooling operation; in the fully connected layer of the TextCNN model, a multi-class cross-entropy loss function based on Softmax is used to output the prediction probability of each type of system command, i.e., the prediction bias of each type of system command.

2. The method of claim 1, wherein, The parsing of the communication protocol message to determine the variable fields corresponding to each type of system command in the communication protocol message comprises the following steps: Determining each type of system command corresponding to the communication protocol message according to the type identifier in the communication protocol message; Extracting features of the each type of system command to determine the variable fields of the each type of system command.

3. The method of claim 1, wherein, The construction of the data set according to the test sample data comprises the following steps: Inputting the test sample data into the power distribution terminal for sample testing to obtain the category labels corresponding to each type of system command; Performing data preprocessing on the test sample data and the category labels corresponding thereto to obtain a processed data set.

4. The method of claim 3, wherein, The data preprocessing on the test sample data and the category labels corresponding thereto comprises the following steps: According to the field format definition of the communication protocol message, the test sample data is tokenized sequentially; The text form test sample data is converted into a vector form through a pre-trained word vector model.

5. The method of claim 1, wherein, The data set is input into the fuzzy test sample classification model for training, including: The fuzzy test sample classification model parameters are initialized; After the sample sequence in the training set is trained through the convolution layer, the pooling layer and the full connection layer of the fuzzy test sample classification model, the prediction probability of each type of system command and the initially trained fuzzy test sample classification model are obtained. The initially trained fuzzy test sample classification model is iteratively trained through the Adam algorithm to obtain the trained fuzzy test sample classification model.

6. The method of claim 1, wherein, The method further includes: The trained fuzzy test sample classification model is evaluated through an evaluation algorithm.

7. A power distribution terminal fuzz testing attack sample classification apparatus characterized by, It includes: A message acquisition module is configured to acquire a communication protocol message of a power distribution terminal; A message analysis module is configured to analyze the communication protocol message to determine variable fields corresponding to various system commands in the communication protocol message; A variable field modification module is configured to modify the variable fields according to a pre-set mechanism to obtain a generation sequence; A test sample generation module is configured to splice the generation sequence with other fields of the communication protocol message corresponding to the variable fields to form test sample data; A data set construction module is configured to construct a data set according to the test sample data and divide the data set into a training set and a test set according to a pre-set proportion; A first iterative training module is configured to input the data set into the fuzzy test sample classification model for training to obtain a trained fuzzy test sample classification model and classify the fuzzy test sample as valid; wherein the fuzzy test sample classification model is a TextCNN model; The device further includes: A data sending module is configured to send the fuzzy test sample determined as valid by the fuzzy test sample classification model in the test set to a power distribution terminal to be detected; A response judgment module is configured to determine whether to trigger an abnormal state of the power distribution terminal according to a response of the power distribution terminal; A label correction module is configured to analyze whether the power distribution terminal has a communication risk after receiving a terminal response message within a pre-set time, determine the fuzzy test sample as a valid fuzzy test sample if the power distribution terminal has a communication risk, determine the label of the fuzzy test sample as valid, and determine the fuzzy test sample as an invalid fuzzy test sample if the power distribution terminal does not have a communication risk, and determine the label of the fuzzy test sample as invalid; A data set updating module is configured to include the re-labeled test set into the training set and re-divide the training set and the test set according to the pre-set proportion; A second iterative training module is configured to input the data set into the fuzzy test sample classification model for iterative training until all the fuzzy test samples marked as valid in the prediction results of the fuzzy test sample classification model are real and valid. The test sample is convoluted by a filter in a convolution layer of the TextCNN model to extract feature information in the test sample; after the convolution operation, a ReLU nonlinear activation function is used for nonlinear transformation; in a pooling layer of the TextCNN model, maximum pooling is used for pooling operation; in a full connection layer of the TextCNN model, a multiclass cross-entropy loss function based on Softmax is used to output prediction probabilities of various system commands, i.e., prediction biases of various system commands.

8. The apparatus of claim 7, wherein, The message analysis module comprises: A command determination unit configured to determine various system commands corresponding to the communication protocol message according to the type identifier in the communication protocol message; A feature extraction unit configured to perform feature extraction on the various system commands to determine variable fields of the various system commands.

9. The apparatus of claim 7, wherein, The data set construction module comprises: A terminal test unit configured to input the test sample data into a power distribution terminal to perform sample testing and obtain category labels corresponding to various system commands; A data preprocessing unit configured to perform data preprocessing on the test sample data and the category labels corresponding thereto to obtain a processed data set.

10. The apparatus of claim 9, wherein, The data preprocessing unit comprises: A word segmentation subunit configured to sequentially perform word segmentation on the test sample data according to a field format definition of the communication protocol message; A vector conversion subunit configured to convert the test sample data in text form into a vector form through a pre-trained word vector model.

11. The apparatus of claim 7, wherein, The first iterative training module comprises: An initialization unit configured to initialize parameters of a fuzzy test sample classification model; A model training unit configured to train sample sequences in the training set through a convolution layer, a pooling layer and a full connection layer of the fuzzy test sample classification model to obtain prediction probabilities of various system commands and an initially trained fuzzy test sample classification model; A model optimization unit configured to perform iterative training on the initially trained fuzzy test sample classification model through an Adam algorithm to obtain a trained fuzzy test sample classification model.

12. The apparatus of claim 7, wherein, The device further comprises: A model evaluation module configured to evaluate the trained fuzzy test sample classification model through an evaluation algorithm.

13. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the method of any one of claims 1 to 6 when executing the computer program.

14. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program implements the method of any one of claims 1 to 6 when executed by the processor.

15. A computer program product, characterised in that, The computer program product comprises a computer program, and the computer program implements the method of any one of claims 1 to 6 when executed by the processor.

Images