Vulnerability detection and verification method for hydropower system based on open source software
Through static code analysis and deep learning models, combined with static code analysis and self-attention mechanism, deep vulnerabilities in open source software in hydropower systems are detected and verified, and vulnerabilities that are unable to effectively identify complex business logic and real-time problems in the existing technology, achieving efficient and accurate vulnerability detection and verification.
Patent Information
- Application Number
- CN202411844058.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-15
- Publication Date
- 2025-04-08
AI Technical Summary
It is difficult for the existing technology to effectively detect and verify deep vulnerabilities in open source software in hydropower systems. Especially under the complex business logic and real-time requirements, traditional static analysis tools cannot identify potential vulnerabilities and lack specialized research on hydropower systems.
The method based on static code analysis, code slicing and embedded vector generation is adopted, and a deep learning model with a self-attention mechanism is combined to perform vulnerability detection and verification. Specific steps include collecting open source projects, generating interest slices, performing word embedding and position embedding, building machine learning models for vulnerability classification and detection, and verifying vulnerabilities through AFL fuzzing test.
It significantly improves the efficiency and accuracy of open source software vulnerability analysis in hydropower systems, can identify deep vulnerabilities, enhance system security, and support real-time scanning and vulnerability detection.
Smart Images
Figure CN119783113A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of power system security, and in particular to a method for detecting and verifying loopholes in a hydropower generation system based on open source software. Background Art
[0002] Hydropower generation systems are usually composed of complex hardware and software collaboration, including control systems, scheduling algorithms, real-time data acquisition modules, etc. The safety of these systems is crucial to the stable operation of the power system.
[0003] In the development and maintenance of hydropower systems, code vulnerabilities can cause serious problems, such as misoperation of key equipment, interruption of system communications, and even paralysis of the entire power network. Common vulnerabilities include insufficient input validation, memory management errors, communication protocol parsing vulnerabilities, and control logic defects. These vulnerabilities can be exploited by attackers to cause data leakage or equipment malfunction, thereby affecting power generation efficiency and safety.
[0004] Open source software is widely used in industrial automation and hydropower generation due to its flexibility and low cost. Currently, there are the following problems in detecting open source software vulnerabilities in hydropower generation systems:
[0005] First, due to the diversity and complexity of open source projects, it is difficult to manually check for vulnerabilities in open source software code.
[0006] Second, traditional static analysis tools are gradually becoming ineffective. Existing static analysis tools are mainly based on rule matching or simple data flow analysis, lacking the understanding of the deep semantics and context of the code, and are unable to identify some deep vulnerabilities, which are prone to false positives and false negatives.
[0007] Third, there is a lack of research on open source software vulnerability detection for hydropower generation systems. Current open source software vulnerability detection research is mostly focused on general system software, network services or mobile applications, while there is less research on hydropower generation systems. The code of hydropower generation systems usually involves unique business logic (such as scheduling algorithms and protocol communications), and these characteristics are not fully considered in general vulnerability detection methods. Existing general detection methods cannot cover specific vulnerability types of open source software in hydropower generation scenarios, such as real-time issues and industrial protocol parsing errors. Summary of the invention
[0008] The purpose of the present invention is to propose a vulnerability detection and verification method for hydropower generation systems, which realizes vulnerability classification and detection based on static code analysis, code slicing and embedding vector generation, and combines a deep learning model with a self-attention mechanism.
[0009] To this end, the technical solution adopted in the present invention is as follows:
[0010] The present invention provides a method for detecting and verifying a vulnerability in a hydropower generation system based on open source software, the method comprising:
[0011] S1. Collect open source projects related to hydropower generation systems involving control systems, scheduling algorithms, and real-time data acquisition functions, and remove documents, test scripts, and third-party dependent libraries from the open source projects;
[0012] S2. Generate code slices using the collected open source projects, specifically,
[0013] First, determine the points of interest of the open source project, including: API calls, memory operations, control logic, communication protocol parsing, data flow and dependencies. After determining the slicing points of interest, use static code analysis methods to perform code slicing on the open source project.
[0014] S3, after generating the slices, performing word embedding and position embedding operations on each slice, and using the word embedding and the word embedding vector generated by the position embedding to generate a synthetic embedding vector for the position embedding vector, and inputting the synthetic embedding vector into the machine learning model for the machine learning model to learn vulnerability features;
[0015] S4. Construct a machine learning model, wherein the machine learning model consists of two parts: a self-attention mechanism layer and a feedforward neural network layer;
[0016] S5. Determine a vulnerability classification task, where the machine learning model can be used for multi-classification tasks and binary classification tasks;
[0017] S6. Divide the synthesized embedding vector into a training set and a test set, stop training when the vulnerability classification accuracy of the machine learning model on the test set is higher than a preset threshold, and then use the model to scan the code of the hydropower system in real time.
[0018] When the machine learning model detects the type of vulnerability in the slice, AFL fuzz testing is used to verify whether the vulnerability exists. If the vulnerability exists, it is repaired. If the vulnerability does not exist or the vulnerability type is wrong, the slice is used to update the machine learning model.
[0019] Furthermore, the points of interest are specifically:
[0020] The points of interest included in API calls are: function call operations involving input and output, functions involving file operations, and call functions involving network communications;
[0021] The memory operations include the following points of interest: dynamic memory allocation operations, memory release operations, pointer operations with memory leaks and double release issues, and pointer variables passed across functions;
[0022] The control logic contains points of interest: including multiple conditional branches and nested loops, branches involving permission checks and security policies;
[0023] The points of interest in communication protocol parsing include: parsing operations on protocol fields and verification operations on length fields;
[0024] The points of interest included in data flow and dependencies are: the path of input data from input points to key operation points, database query operations, file operations, and system commands.
[0025] Furthermore, there is a word segmentation operation before the word embedding operation, which maps the slice C into a token vector. Token refers to keywords, identifiers, operators, constants, variable names and symbols in the open source project code. The token vector is represented as follows:
[0026] C=[c1,c2,c3,…,c n ]
[0027] Among them, c i is the i-th token in slice C.
[0028] Furthermore, the word embedding operation is specifically to embed each c i Mapped to a low-dimensional vector space, this mapping process is achieved by embedding the matrix W E Implementation. Embedding matrix W E The dimension is S×d, where S is c i Size, d is the dimension of the word embedding vector.
[0029] For c i , its word embedding vector is expressed as:
[0030] e i =W E t i
[0031] The embedding matrix W E It is obtained by training and learning the machine learning model.
[0032] Furthermore, the position embedding operation is specifically as follows:
[0033] c i The position embedding vector p i Generated by:
[0034]
[0035] Where k is the dimension index in the position embedding vector, k∈{1,2,…,d / 2}, and d is the dimension of the position embedding vector. Position embedding vector p i Indicates ci The position in the slice.
[0036] Furthermore, the synthetic embedding vector is expressed as follows:
[0037] z i =e i +p i
[0038] The synthetic embedding vector z i The machine learning model can simultaneously learn the semantic information of each token and the relative position information in the slice.
[0039] Furthermore, the self-attention mechanism of the machine learning model is specifically:
[0040] First, the synthetic embedding vector z i Mapped to query, key, and value vectors:
[0041] Q i =W Q z i ,K i =W K z i ,V i =W V z i
[0042] Among them, W Q , W K 、V i are weight matrices used to calculate query, key, and value vectors, respectively. i , K i 、V i are all d-dimensional vectors.
[0043] Next, calculate the attention weight α between each pair of tokens ij :
[0044]
[0045] Among them, α ij is the attention weight between the i-th token and the j-th token, indicating c i C j degree of attention. is the dot product of the query vector and the key vector, indicating the similarity between them.
[0046] Finally, using the attention weight α ij The value vector V j Perform weighted summation to obtain the context vector A i, the formula is as follows:
[0047]
[0048] Furthermore, there is a feedforward neural network layer after the self-attention mechanism layer, and the feedforward neural network layer consists of two fully connected layers and an activation function. The input vector of the feedforward neural network is the context vector A i , the output vector F(A i )The formula is as follows:
[0049] F(A i )=ReLU(W1A i +b1)W2+b2
[0050] Among them, W1, W2 and b1, b2 are the learned weight matrices and biases, and ReLU is the activation function.
[0051] Furthermore, the output of the feedforward neural network is processed by residual connection operations and layer normalization operations.
[0052] The residual connection operation is to convert the input vector A of the feedforward neural network layer i And the output vector F(A i ) are added together, the formula is as follows:
[0053] r i =A i +F(A i )
[0054] The layer normalization operation is performed on r i Perform layer normalization, specifically,
[0055]
[0056]
[0057]
[0058] Where μ is r i The characteristic mean in r i The standard deviation of the features in , ∈ is a small smoothing term to prevent division by 0; γ is a learnable scaling parameter, β is a learnable offset parameter, and d is r i The vector dimension of .
[0059] The output vector after layer normalization is L = {L1, L2, ..., L n}.
[0060] Furthermore, the multi-classification task is to map the normalized output vector L of the layer to an M-class classification space, where M represents the number of vulnerability types. The specific steps are as follows:
[0061] y=W c L+b c
[0062] Among them, W c is the weight matrix, b c is the bias term and y is the unnormalized classification score.
[0063] The output scores are normalized using the softmax layer to obtain the probability distribution of M categories, as follows:
[0064]
[0065] Here, y[x] represents the probability of being classified as x.
[0066] Finally, the category with the highest classification probability is taken as the final classification result. The formula is as follows:
[0067]
[0068] The binary classification task is to map the normalized output vector L of the layer to a binary classification space, where 1 indicates the presence of a vulnerability and 0 indicates the absence of a vulnerability.
[0069] Compared with the prior art, the advantages of the present invention are:
[0070] (1) The present invention collects open source projects of hydropower generation systems and removes documents, test scripts and third-party dependency libraries from the open source projects to extract key functions and behaviors related to the hydropower generation system. It also combines static code analysis tools to generate interest point slices, which can significantly improve the efficiency of code vulnerability analysis, focus on areas with high vulnerability incidence, and avoid interference from irrelevant data.
[0071] (2) The present invention captures the semantic information and structural characteristics of the code by slicing the embedding vector generation process, including word segmentation, word embedding, and position embedding. Subsequently, the self-attention mechanism is combined to further model the global context relevance of the code, ensuring that potential vulnerability features in the code can be accurately identified, thereby improving the accuracy and depth of vulnerability detection.
[0072] (3) The machine learning model used in the present invention has a multi-layer self-attention mechanism, residual connection, and layer normalization model structure, supports multi-classification and binary classification tasks, has strong generalization ability and adaptability, and can be widely used in real-time scanning and vulnerability detection of hydropower system codes. BRIEF DESCRIPTION OF THE DRAWINGS
[0073] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.
[0074] Figure 1 is a flow chart of the method of the present invention;
[0075] Figure 2 It is a schematic diagram of the embedding operation of the present invention;
[0076] Figure 3 This is a structural diagram of the machine learning model of the present invention. DETAILED DESCRIPTION
[0077] To achieve the above objectives, the present invention is implemented through the following technical solutions.
[0078] Combination Figure 1 The present invention provides a method for detecting and verifying a vulnerability in a hydropower generation system based on open source software, the method comprising:
[0079] S1. Collect codes related to the hydropower system. Specifically,
[0080] Collect open source projects from GitHub, GitLab, and SourceForge platforms to collect open source projects related to hydropower generation systems, especially those involving control systems, scheduling algorithms, and real-time data acquisition functions.
[0081] For example, OpenPLC: an open source project involving industrial automation and control systems, SCADA system: a monitoring and data acquisition system involving a large amount of sensor data, real-time processing and communication protocols, HydroPower Control: an open source hydropower control system software.
[0082] Remove the documents, test scripts, and third-party dependency libraries from the open source projects and focus on the core code.
[0083] S2. Generate code slices. Specifically,
[0084] Identify the points of interest of the open source project, split the code of the open source project into meaningful slices, and extract the key behaviors in the code.
[0085] In the hydropower sector, common vulnerabilities include: insufficient input validation (e.g., unsanitized user input), memory-related vulnerabilities (e.g., buffer overflow, null pointer dereference), protocol parsing errors in communication modules, missing permission checks for safety-critical operations, and timing competition issues (e.g., race conditions or deadlocks).
[0086] Based on the above common vulnerabilities, the points of interest in the open source software of the hydropower system are determined to be:
[0087] API calls: including function calls involving input and output (such as scanf and gets functions), functions involving file operations (such as fopen and fread functions), and functions involving network communications (such as socket, send, and recv functions).
[0088] Memory operations: including dynamic memory allocation operations (such as malloc, calloc, and realloc functions), memory release operations (such as free function), pointer operations with memory leaks and double release problems, and pointer variables passed across functions.
[0089] Control logic: includes complex conditional branches or nested loops (which may hide exception paths or unhandled error conditions), branches involving permission checks or security policies.
[0090] Communication protocol parsing: including parsing operations of protocol fields (such as packet header verification, checksum verification) and verification operations of length fields.
[0091] Data flow and dependencies: The path of user input data from the input point to the key operation points, which include database query operations, file operations, and system commands.
[0092] After determining the slice interest points, the static code analysis tool Joern is used to generate code slices for the open source project.
[0093] S3, generate slice embedding vector. Figure 2 As shown, specifically,
[0094] After the slices are generated, in order to capture the semantic features of the slices, each slice C is mapped into an embedding vector for machine learning model analysis.
[0095] First, before code embedding, the slice C is segmented to obtain the corresponding token. In natural language processing and programming language processing, a token is the smallest meaningful unit in a text or code. In the present invention, a token refers to a basic element such as a keyword, identifier, operator, constant, variable name, symbol, etc. in the open source project code. The segmentation operation formula is as follows:
[0096] C=[c1,c2,c3,…,c n ]
[0097] Among them, c i is the i-th token in slice C.
[0098] Secondly, the word embedding operation is performed on the slices so that each c i Mapped into a low-dimensional vector space, this mapping process is implemented through a lookup table, namely the embedding matrix W E . Embedding matrix W E The dimension is S×d, where S is c i Size, d is the dimension of the word embedding vector.
[0099] For c i , its word embedding vector is expressed as:
[0100] e i =W E t i
[0101] Embedding matrix W E It is learned through model training.
[0102] Then, the slice is embedded in position, which allows the model to know the position of each token in the slice. i The position embedding vector p i Generated by:
[0103]
[0104] Where k is the dimension index in the position embedding vector, k∈{1,2,…,d / 2}, and d is the dimension of the position embedding vector. Position embedding vector p i Indicates c i The position in the slice. Position embedding can ensure that tokens at different positions are distinguishable.
[0105] Finally, use c i The word embedding vector e i and the position embedding vector p i Further generate synthetic embedding vector h i , to be output to the machine learning model to synthesize the embedding vector z i It is expressed as follows,
[0106] z i =e i +p i
[0107] z i This allows the model to simultaneously learn the semantic information of each token and its relative position in the slice.
[0108] S4. Construct a machine learning model, such as Figure 3As shown, the machine learning model consists of two parts: self-attention mechanism and feedforward neural network. The specific machine learning model structure is as follows:
[0109] First, the self-attention mechanism updates the representation of tokens by calculating the correlation between tokens. i Will be mapped to query, key and value vectors:
[0110] Q i =W Q z i ,K i =W K z i ,V i =W V z i
[0111] Among them, W Q , W K 、V i are the learned weight matrices used to calculate the query, key, and value vectors, respectively. i , K i 、V i are all d-dimensional vectors.
[0112] Next, calculate the attention weight α between each pair of tokens ij :
[0113]
[0114] Among them, α ij is the attention weight between the i-th token and the j-th token, indicating c i C j degree of attention. is the dot product of the query and the key, indicating the similarity between them.
[0115] Afterwards, the attention weights are used to map the value vector V j Perform weighted summation, context vector A i , the formula is as follows:
[0116]
[0117] Second, after each self-attention layer, there is a feed-forward neural network, which consists of two fully connected layers and an activation function. The input vector of the feed-forward neural network is the context vector A. i , the output vector F(A i )The formula is as follows:
[0118] F(A i)=ReLU(W1A i +b1)W2+b2
[0119] Among them, W1, W2 and b1, b2 are the learned weight matrices and biases, and ReLU is the activation function.
[0120] Third, the output of the feedforward neural network is processed through residual connections and layer normalization.
[0121] The residual connection is to feed forward the input vector A of the neural network i And the output vector F(A i ) are added together, the formula is as follows:
[0123] r i =A i +F(A i )
[0124] Next, r i Perform layer normalization, the formula is as follows:
[0125]
[0126] in, Yes i The feature mean in ;
[0127] in, Yes i The characteristic standard deviation in ,∈ is a small smoothing term to prevent division by zero;
[0128] Where γ is a learnable scaling parameter, β is a learnable offset parameter, and d is r i The vector dimension of .
[0129] The output vector after layer normalization is L = {L1, L2, ..., L n}
[0130] S5. Vulnerability classification task
[0131] The layer-normalized vector L is used for a vulnerability classification task, which can be divided into a multi-classification task and a binary classification task.
[0132] The multi-classification task is to map L into an M-class classification space, where M represents the number of vulnerability types. The specific steps are as follows:
[0133] y=W c L+b c
[0134] Among them, W c is the weight matrix, b c is the bias term and y is the unnormalized classification score.
[0135] The output scores are normalized using the softmax layer to obtain the probability distribution of M categories, as follows:
[0136]
[0137] Here, y[x] represents the probability of being classified as x.
[0138] Finally, the category with the highest classification probability is taken as the final classification result. The formula is as follows:
[0139]
[0140] The binary classification task is to map the normalized output vector L of the layer to a binary classification space, where 1 indicates the presence of a vulnerability and 0 indicates the absence of a vulnerability.
[0141] S6, machine learning model training and deployment, this step is specifically as follows:
[0142] The synthetic embedding vector of S3 is divided into a training set and a test set. When the vulnerability classification accuracy of the machine learning model on the test set is higher than a preset threshold, the training is stopped. The model is deployed in a real environment to scan the code of the hydropower system in real time to discover potential vulnerabilities.
[0143] When the machine learning model detects the type of vulnerability in the slice, AFL fuzz testing is used to verify whether the vulnerability exists. If the vulnerability exists, it is repaired. If the vulnerability does not exist or the vulnerability type is wrong, the slice is used to update the machine learning model.
[0144] The present invention uses static code analysis tools and a custom slicing method to extract point-of-interest codes from open source hydropower system-related codes, which can accurately identify potential security vulnerabilities and improve the efficiency and accuracy of vulnerability discovery.
[0145] The present invention adopts a combination of word embedding and position embedding to convert code slices into semantic vectors, and uses the self-attention mechanism and feedforward neural network to model the code context relationship, which can capture the semantic features and logical structure of the slices and provide high-quality feature representation for vulnerability classification.
[0146] The present invention uses a multi-layer self-attention mechanism, residual connection, and layer normalization model design, supports multi-classification and binary classification tasks, has strong generalization ability and adaptability, and can be widely used in real-time scanning and vulnerability detection of hydropower system codes to ensure system security.
[0147] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.
Claims
1. A method for detecting and verifying hydropower system vulnerabilities based on open source software, characterized in that: The method includes: S1. Collect open source projects related to hydropower generation systems involving control systems, scheduling algorithms, and real-time data acquisition functions, and remove documents, test scripts, and third-party dependent libraries from the open source projects; S2. Generate code slices using the collected open source projects, specifically, First, determine the points of interest of the open source project, including: API calls, memory operations, control logic, communication protocol parsing, data flow and dependencies. After determining the slicing points of interest, use static code analysis methods to perform code slicing on the open source project. S3, after generating the slices, performing word embedding and position embedding operations on each slice, and using the word embedding, the word embedding vector generated by the position embedding, and the position embedding vector to generate a synthetic embedding vector, and input it into the machine learning model for the machine learning model to learn vulnerability features; S4. Construct a machine learning model, wherein the machine learning model consists of two parts: a self-attention mechanism layer and a feedforward neural network layer; S5. Determine a vulnerability classification task, where the machine learning model can be used for multi-classification tasks and binary classification tasks; S6, dividing the synthesized embedding vector into a training set and a test set, stopping training when the vulnerability classification accuracy of the machine learning model on the test set is higher than a preset threshold, and then using the model to scan the code of the hydropower system in real time; When the machine learning model detects the type of vulnerability in the slice, AFL fuzz testing is used to verify whether the vulnerability exists. If the vulnerability exists, it is repaired. If the vulnerability does not exist or the vulnerability type is wrong, the slice is used to update the machine learning model.
2. The method for detecting and verifying a hydropower system vulnerability based on open source software according to claim 1, characterized in that: The points of interest in S2 are specifically: The points of interest included in API calls are: function call operations involving input and output, functions involving file operations, and call functions involving network communications; The memory operations include the following points of interest: dynamic memory allocation operations, memory release operations, pointer operations with memory leaks and double release issues, and pointer variables passed across functions; The control logic contains points of interest such as: multiple conditional branches and nested loops, branches involving permission checks and security policies; The points of interest in communication protocol parsing include: parsing operations on protocol fields and verification operations on length fields; The points of interest included in data flow and dependencies are: the path of input data from input points to key operation points, database query operations, file operations, and system commands.
3. The method for detecting and verifying a hydropower system vulnerability based on open source software according to claim 1, characterized in that: The word embedding operation in S3 is preceded by a word segmentation operation. The word segmentation operation is to map the slice C into a token vector. Token refers to keywords, identifiers, operators, constants, variable names and symbols in the open source project code. The token vector is represented as follows: C=[c1,c2,c3,…,c n ] Among them, c i is the i-th token in slice C.
4. The method for detecting and verifying a hydropower system vulnerability based on open source software according to claim 3, characterized in that: The word embedding operation of S3 is specifically as follows: Each c i Mapped to a low-dimensional vector space, this mapping process is achieved by embedding the matrix W E Implementation, embedding matrix W E The dimension is S×d, where S is c i size, d is the dimension of the word embedding vector, For C i , its word embedding vector is expressed as: e i =W E t i The embedding matrix W E It is obtained by training and learning the machine learning model.
5. The method for detecting and verifying a hydropower system vulnerability based on open source software according to claim 4, characterized in that: The c i The position embedding vector p i Generated by: Where k is the dimension index in the position embedding vector, k∈{1,2,…,d / 2}, d is the dimension of the position embedding vector, and the position embedding vector p i Indicates c i Position in the slice.
6. The method for detecting and verifying a hydropower system vulnerability based on open source software according to claim 5, characterized in that: The synthetic embedding vector is expressed as follows: with i =e i +p i The synthetic embedding vector z i The machine learning model can simultaneously learn the semantic information of each token and the relative position information in the slice.
7. The method for detecting and verifying a hydropower system vulnerability based on open source software according to claim 6, characterized in that: The self-attention mechanism of the machine learning model is specifically: First, the synthetic embedding vector z i Mapped to query, key, and value vectors: Q i =W Q z i ,K i =W K z i ,V i =W V z i Among them, W Q , W K 、V i are weight matrices used to calculate query, key, and value vectors, Q i , K i 、V i are all d-dimensional vectors; Next, calculate the attention weight α between each pair of tokens ij : Among them, α ij is the attention weight between the i-th token and the j-th token, indicating c i C j degree of attention; is the dot product of the query vector and the key vector, indicating the similarity between them; Finally, using the attention weight α ij The value vector V j Perform weighted summation to obtain the context vector A i , the formula is as follows:
8. The method for detecting and verifying a hydropower system vulnerability based on open source software according to claim 7, characterized in that: There is a feedforward neural network layer after the self-attention mechanism layer. The feedforward neural network layer consists of two fully connected layers and an activation function. The input vector of the feedforward neural network is the context vector A i , the output vector F(A i )The formula is as follows: <h2 style=";text-align:left;direction:ltr">F(A<h2 style=";text-align:left;direction:ltr"> i <h2 style=";text-align:left;direction:ltr"> )=ReLU(W1A<h2 style=";text-align:left;direction:ltr"> i <h2 style=";text-align:left;direction:ltr"> +b1)W2+b2 Among them, W1, W2 and b1, b2 are the learned weight matrices and biases, and ReLU is the activation function.
9. The method for detecting and verifying a hydropower system vulnerability based on open source software according to claim 8, characterized in that: The output of the feedforward neural network layer is processed by residual connection operation and layer normalization operation. The residual connection operation is to convert the input vector A of the feedforward neural network layer i And the output vector F(A i ) are added together, the formula is as follows: r i =A i +F(A i ) The layer normalization operation is performed on r i Perform layer normalization, specifically, Where μ is r i The characteristic mean in r i The standard deviation of the features in , ∈ is a small smoothing term to prevent division by 0; γ is a learnable scaling parameter, β is a learnable offset parameter, and d is r i The vector dimension of The output vector after layer normalization is L = {L1, L2, ..., L n }.
10. The method for detecting and verifying a hydropower system vulnerability based on open source software according to claim 9, characterized in that: The multi-classification task of S5 is to map the normalized output vector L of the layer to an M-class classification space, where M represents the number of vulnerability types. The specific steps are as follows: y=W c L+b c Among them, W c is the weight matrix, b c is the bias term, y is the unnormalized classification score, and the output score is normalized using the softmax layer to obtain the probability distribution of M categories. The formula is as follows: Among them, y[x] represents the probability of classification as x, Finally, the category with the highest classification probability is taken as the final classification result. The formula is as follows: The binary classification task of S5 is to map the normalized output vector L of the layer to a binary classification space, where 1 indicates the presence of a vulnerability and 0 indicates the absence of a vulnerability.