Power information software supply chain security risk automatic test method and system

Abstract

The invention is suitable for the technical field of software security testing, and provides a power information system software supply chain security risk automatic testing method and system, and the method comprises the steps: connecting a power information system background database, and obtaining data in a program code database in real time; converting the data into a text vector sequence by using a natural language processing technology, and constructing an abstract syntax tree based on the text vector sequence to obtain feature information of a program code; determining target feature measurement corresponding to the feature information by using an improved ant colony algorithm; judging whether the correlation between the target feature measurement and a feature measurement in a preset software supply chain attack stage is within a threshold range or not; if yes, analyzing the attack technique type of the program code according to the target feature measurement; and performing attack behavior simulation processing through the attack technique type to obtain simulation response data, and determining a security risk prediction result according to the simulation response data. By predicting the attack occurrence stage to the attack occurrence position, the test precision and efficiency are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of software security testing, and in particular to an automated testing method and system for security risks in a power information software supply chain. Background Art

[0002] At present, there are three main aspects of software supply chain security risks. The first is the network security risk of the software supply chain. When there are security vulnerabilities in the software itself or the platform, components, and algorithms of its supply chain environment, attackers can achieve unauthorized access through implantation, replacement, and other means, causing network attack risks. The second is the risk of sensitive information leakage. As the level of the software supply chain increases, the security management and penetration capabilities and security risk awareness decrease step by step. The possibility of software suppliers and others illegally using or uploading sensitive information to external networks increases, which can easily cause the leakage and loss of important sensitive information. The third is the risk of software supply chain interruption, which is mainly reflected in the fact that there are many difficult-to-replace software and components in critical information infrastructure and important networks.

[0003] In the prior art, automated static security analysis tools are used to perform static security testing on software source code during the development phase to resolve errors in the program. Software component identification tools are used to detect components of programming languages ​​and components of various grouping managers during the testing phase. The testing phase relies on third-party tools and human factors, and the conditions during the testing process need to be set by testers based on experience, which results in insufficient accuracy in software supply chain security testing and inaccurate test results. Summary of the invention

[0004] In view of the above problems existing in the prior art, the present invention is proposed.

[0005] Therefore, the present invention provides an automated testing method for power information software supply chain security risks, which can solve the problem of insufficient accuracy in software supply chain security testing.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: an automated testing method for power information software supply chain security risks, comprising: connecting to a power information system backend database to obtain data in a program code database of the power information system software in real time;

[0007] Using natural language processing technology to convert the data in the program code database into a text vector sequence, and constructing an abstract syntax tree based on the text vector sequence to obtain feature information of the program code;

[0008] Determine the target feature metric corresponding to the feature information using an improved ant colony algorithm;

[0009] Determining whether the correlation between the target feature metric and a feature metric in a preset software supply chain attack stage is within a threshold range, wherein the preset software supply chain attack stage includes a development stage, a delivery stage, and / or a use stage;

[0010] If yes, then analyzing the attack method type of the program code according to the target feature measurement;

[0011] Attack behavior simulation processing is performed through the attack technique type to obtain simulation response data, and the security risk prediction result is determined based on the simulation response data.

[0012] As a preferred solution of the power information software supply chain security risk automated testing method described in the present invention, wherein: the target feature measurement corresponding to the feature information is determined by using an improved ant colony algorithm, including:

[0013] Setting the original value of the characteristic information of the program code, the number of ants and the maximum evolutionary generation;

[0014] Initialize k cluster centers, randomly select several text vectors in the abstract syntax tree as the original cluster centers, and calculate the distance and heuristic function from the text vector to each cluster center;

[0015] Determine the class to which the text vector belongs, derive the value of the objective function, and determine the sum of the distances from each text vector to the cluster center;

[0016] Compare the objective function values ​​solved by all ants and update the global pheromone;

[0017] All clustering results are sorted and the target feature measurement is determined according to the set abnormal critical value.

[0018] As a preferred solution of the power information software supply chain security risk automated testing method described in the present invention, the calculation formula of the cluster center s of the target feature measurement is as follows:

[0019]

[0020] Among them, τ(i,j) is the pheromone between the text vector sample and the cluster center, η(i,j) is the heuristic function, p is the probability of the target feature measuring the cluster center, p0 is the pre-set text variable, and S is the cluster center of other text vectors.

[0021] As a preferred solution of the power information software supply chain security risk automated testing method described in the present invention, the expression for updating the global pheromone is as follows:

[0022]

[0023] Where: τ ij (t) is the pheromone concentration between time periods i and j, is the pheromone exertion level, Δτ ij is the pheromone increment, and Q is the enhancement value of pheromone intensity.

[0024] As a preferred solution of the power information software supply chain security risk automated testing method described in the present invention, wherein: the determination of whether the correlation between the target feature metric and the feature metric in the preset software supply chain attack stage is within a threshold range, the preset software supply chain attack stage includes a development stage, a delivery stage and / or a use stage, including:

[0025] Constructing a reduced-dimensional feature matrix of the target feature metric;

[0026] The Pearson correlation coefficients of the reduced dimension feature matrix and the feature matrices of the development phase, the delivery phase and / or the use phase in the preset software supply chain attack phase are calculated in sequence;

[0027] It is determined whether the Pearson correlation coefficient is within a threshold range.

[0028] As a preferred solution of the automated testing method for power information software supply chain security risks described in the present invention, the expression for calculating the Pearson correlation coefficient between the reduced dimension feature matrix and the feature matrix of the development stage, delivery stage and / or use stage in the preset software supply chain attack stage is as follows:

[0029]

[0030] Where: r is the correlation coefficient, X i and Y i are the ith element in the reduced dimension feature matrix X of the target feature measurement and the feature matrix Y of any preset software supply chain attack stage, and is the mean value of the variable.

[0031] As a preferred solution of the power information software supply chain security risk automated testing method described in the present invention, wherein: the attack method type of the program code is analyzed according to the target feature measurement, including:

[0032] The target feature metric is input into a pre-built graph model, and the attack method type of the program code in the development phase, delivery phase and / or use phase is analyzed based on the pre-built graph model.

[0033] As a preferred solution of the power information software supply chain security risk automation testing system described in the present invention, it includes:

[0034] A real-time data acquisition unit, used to connect to the back-end database of the power information system and acquire data in the program code database of the power information system software in real time;

[0035] A program code feature information determination unit, configured to convert the data in the program code database into a text vector sequence using a natural language processing technique, and to construct an abstract syntax tree based on the text vector sequence to obtain feature information of the program code;

[0036] A target feature metric determination unit, configured to determine the target feature metric corresponding to the feature information using an improved ant colony algorithm;

[0037] A feature metric correlation determination unit, used to determine whether the correlation between the target feature metric and a feature metric in a preset software supply chain attack stage is within a threshold range, wherein the preset software supply chain attack stage includes a development stage, a delivery stage, and / or a use stage;

[0038] An attack technique type analysis unit, configured to analyze the attack technique type of the program code according to the target feature metric when the correlation between the target feature metric and the feature metric in the preset software supply chain attack phase is within a threshold range;

[0039] The security risk prediction result determination unit is used to perform attack behavior simulation processing through the attack technique type to obtain simulation response data, and determine the security risk prediction result according to the simulation response data.

[0040] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and is characterized in that when the processor executes the computer program, the steps of any one of the methods for automated testing of security risks in the power information software supply chain are implemented.

[0041] A computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of any one of the methods described in a method for automated testing of security risks in a power information software supply chain are implemented.

[0042] The beneficial effects of the present invention are as follows: first, after establishing a connection, the data in the program code database of the power information system software is obtained in real time, the data in the program code database is converted into a text vector sequence using natural language processing technology, and an abstract syntax tree is constructed based on the text vector sequence to obtain the feature information of the program code, and then the target feature metric corresponding to the feature information is determined by using an improved ant colony algorithm, and then the correlation between the target feature metric and the feature metric of each preset attack stage is determined to be within the threshold range. If so, the attack method type is analyzed, and finally the attack behavior simulation is performed according to the attack method type to obtain the simulated response data, thereby determining the security risk prediction result. The present application determines the representative target feature metric in the program code, and then calculates the correlation between the target feature metric and the feature metric of each preset stage, determines whether the program code has a risk through the correlation, and can predict the stage and location of the attack behavior. The method used in the present application has a simple calculation process, and can predict the stage of the attack based on the program code source data, and then refines the location of the attack according to the stage of occurrence, providing an effective data basis for subsequent solution of the attack problem. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0044] Figure 1 A flowchart of an automated testing method for power information software supply chain security risks provided by an embodiment of the present invention.

[0045] Figure 2 A flowchart of another embodiment of a method for automated testing of security risks in a power information software supply chain provided by an embodiment of the present invention.

[0046] Figure 3 A structural framework diagram of an electric power information software supply chain security risk automation testing system provided for an embodiment of the present invention.

[0047] Figure 4 A structural block diagram of a computer device for an automated testing method for security risks in a power information software supply chain provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0049] Example 1: From the perspective of the server, the automated testing method for the security risk of the power information system software supply chain in this application is introduced. Figure 1 , the method provided in the embodiment of the present application comprises the following steps:

[0050] S11. Connect to the power information system backend database and obtain data in the program code database of the power information system software in real time;

[0051] S12. Using natural language processing technology to convert the data in the program code database into a text vector sequence, and constructing an abstract syntax tree based on the text vector sequence to obtain feature information of the program code;

[0052] In actual applications, the targets of software supply chain attacks mainly include software binary codes and software installation packages. Attackers usually use the unused space of a section of the PE file or add new nodes to directly embed malicious files into the binary code of the PE file; or directly add or inject malicious binary files into the downloaded compressed package, which is directly loaded and executed during the software running process. Therefore, the program code analysis here is based on the program code of the software running.

[0053] When the system obtains data from the program code database, it uses semi-automatic crawling or crawler algorithms to crawl data in real time. After obtaining the data, it converts the data into a vector form, that is, the program source code is treated as plain text, and the word segmentation method in natural language processing technology is used to obtain the corresponding word sequence, and then word embedding is performed to obtain the word vector, and finally the text vector corresponding to the entire text is obtained. On the basis of determining the text vector, an abstract syntax tree is constructed according to the structured feature information, where each node in the abstract syntax tree represents a structure in the source code, and the semantic relationship between different code elements can also be determined by the hierarchical relationship between the nodes. Therefore, the feature information of the program code can be determined according to the constructed abstract syntax tree, where the feature information includes program code structure information and grammatical semantic information.

[0054] S13. Determine the target feature metric corresponding to the feature information using an improved ant colony algorithm;

[0055] In this embodiment, an ant colony algorithm is used to screen the optimal feature information among all the converted feature information. Since the amount of text vector data processed by natural language processing technology is relatively large, if all text vectors are compared and calculated, the calculation efficiency will be relatively slow. Therefore, an ant colony algorithm based on a clustering algorithm is used to optimize the vector to obtain the most representative target feature measurement, wherein the number of target feature measurements is not limited here, and can be a single measurement or multiple measurements, which is specifically set according to the data flow generated by the program code in the power information system software running at different time periods.

[0056] S14. Determine whether the correlation between the target feature metric and the feature metric in a preset software supply chain attack stage is within a threshold range, where the preset software supply chain attack stage includes a development stage, a delivery stage, and / or a use stage;

[0057] In this embodiment, determining whether the correlation between the target feature metric and the feature metric in the preset software supply chain attack stage is within a threshold range includes the following steps:

[0058] 1. Construct a reduced dimension feature matrix of target feature measurement;

[0059] 2. Calculate the Pearson correlation coefficient between the reduced dimension feature matrix and the feature matrix of the development phase, delivery phase and / or use phase in the preset software supply chain attack phase,

[0060] 3. Determine whether the Pearson correlation coefficient is within the threshold range.

[0061] Specifically, when the target feature metric is a plurality of metrics, a corresponding dimension reduction feature matrix is ​​constructed for comparison. Then, the Pearson correlation coefficient of the feature matrix of the preset software supply chain attack stage is calculated in turn according to the constructed matrix, wherein the comparison calculation is performed according to the set priority when calculating the correlation, wherein the priority of the development stage is greater than the priority of the delivery stage, and the priority of the delivery stage is greater than the priority of the use stage. In the process of calculating the correlation, when the correlation between the target feature metric and the feature metric of the three stages is within the threshold range, the attack path is given priority according to the calculated priority order. For example, when it is detected that the feature metric in the attack event is related to the development stage, the delivery stage, and the use stage, it means that the attack event may inject malicious files in each stage, or the malicious files injected in the development stage directly affect the programs in the downstream stage, so the impact of the development stage is given priority, and the development stage is determined as the first attack path. If the attack location cannot be found in the development stage, the attack paths of the delivery stage and the use stage are considered again.

[0062] The expression for calculating the Pearson correlation coefficient is as follows:

[0063]

[0064] Where: r is the correlation coefficient, X i and Y i are the ith element in the reduced dimension feature matrix X of the target feature measurement and the feature matrix Y of any preset software supply chain attack stage, and is the mean value of the variable.

[0065] It should be noted that when calculating the characteristic metrics of the development stage, Y is the characteristic matrix of the software supply chain development stage, and so on to the delivery stage and the use stage. The characteristic matrix for each stage has a different form of expression, and thus the calculated correlation coefficient is also different.

[0066] S15. When the correlation between the target feature metric and the feature metric in the preset software supply chain attack phase is within a threshold range, the attack method type of the program code is analyzed according to the target feature metric;

[0067] In this embodiment, the attack method type of the program code is analyzed based on the target feature measurement, including:

[0068] The target feature measurement is input into a pre-built graph model, and the attack method type of the program code in the development stage, delivery stage and / or use stage is analyzed based on the pre-built graph model.

[0069] Specifically, the graph model reflects the supply chain attack methods involved in the development, delivery and use stages of the power information system software. The main attack methods in the development stage include development tool attacks, third-party library attacks, and source code attacks; the main attack methods in the delivery stage include software bundled downloads, download hijacking, and logistics chain hijacking; the main attack methods in the use stage include upgrade hijacking, and the specific determination of the attack method type in each stage requires further data analysis based on the graph model. The graph model reflects the attack paths and attack locations corresponding to most attack events. For example, the XcodeGhost event, the corresponding attack method is a third-party library attack, the attack method is to implant malicious code in the integrated development tool Xcode, and the attacked location is the program compiled using the attacked Xcode tool; for another example, the Jingguang teacher event, the attack method type is software bundled download, the attack method is to bundle the malicious code in the host software package, and the attacked location is when downloading the software installation package. In addition, there are many different attack paths and attack time locations based on different attack method types. The specific settings are obtained by model learning based on historical attack events, which will not be repeated here.

[0070] S16. Simulate the attack behavior by attack method type to obtain simulated response data, and determine the security risk prediction result based on the simulated response data.

[0071] In this embodiment, after determining the type of attack method, the power information system software is simulated attacked using the determined attack method at different time nodes. For example, when the attack method type in the development stage is a third-party library attack, that is, there are several corresponding attack events, attack paths or attack locations in the graph model, then different time nodes are set at this time, and feature data is obtained by segmenting according to the time window based on the above-determined target feature measurement, and the feature data is input into the power information system simulation program for simulation operation. In addition, the attack behavior and operation are recorded, and the recorded attack action is executed on the power information system to obtain simulated response data, that is, data with program abnormalities, and then the response data is compared with the corresponding attack path and attack location in the graph model, and finally the prediction result of the power information system software security risk is determined according to the comparison result.

[0072] The above embodiment determines at which stage the attack behavior of the power information system software occurs by calculating the correlation between the representative target feature metric and the feature metric of the pre-set software supply chain attack stage, and the specific attack method type can be determined based on the feature metric of the specific stage, and finally the attack path and attack location are predicted based on the attack method type. Based on a large amount of data based on the program code running process, the stage where the attack behavior occurs is determined, and then the method is determined based on the stage. In this way, the attack behavior is determined according to the level, which effectively improves the accuracy of the test, and the algorithm is used in the calculation process, so that the calculation efficiency is relatively fast.

[0073] For example 2, please refer to Figure 2 In the present invention, the target feature metric corresponding to the feature information determined by using the improved ant colony algorithm also includes the following steps:

[0074] S131. Set the original value of the feature information of the program code, the number of ants and the maximum evolutionary generation;

[0075] S132. Initialize k cluster centers, randomly select several text vectors in the abstract syntax tree as original cluster centers, and calculate the distance and heuristic function from the text vector to each cluster center;

[0076] S133. Determine the class to which the text vector belongs, derive the value of the objective function, and determine the sum of the distances from each text vector to the cluster center;

[0077] S134. Compare the objective function values ​​solved by all ants and update the global pheromone;

[0078] S135. Sort all clustering results and determine the target feature measurement according to the set abnormal critical value.

[0079] Specifically, setting the text vector as a sample set can be expressed as:

[0080] X-{X i |X i =(x i1 ,x i2 ,…,x im )}

[0081] There are n samples in the sample set, among which sample X i is an m-dimensional vector, the sample set contains k classification modes, C is the segmentation standard, and the sum of the discrete degrees within the class is minimized:

[0082]

[0083] Among them, d(X i ,m j ) is C j In-class sample X i Reach class center m j The Euclidean distance.

[0084] Specifically, when determining sample X i Reach class center m j The Euclidean distance is d(X i ,m j ), the heuristic function is set to η(i,j)=1 / d(i,j); sample X i and cluster center m j The pheromone between is τ(i,j), τ(i,j) exists between the sample and the S cluster center, the objective function of the pheromone is the minimum value of F, and the probability expression of the ant searching for the cluster center to which the sample belongs is as follows:

[0085]

[0086] Among them: s is the cluster center.

[0087] Randomly select k sample points as the original cluster centers, cluster centers m j The component value is of class C j The average value of all attributes of the internal samples, the cluster center calculation formula is:

[0088]

[0089] The expression for updating the global pheromone is as follows:

[0090]

[0091] Where: τ ij (t) is the pheromone concentration between time periods i and j, is the pheromone exertion level, Δτ ij is the pheromone increment, and Q is the enhancement value of pheromone intensity.

[0092] The above is carried out to obtain the calculation formula of the cluster center s of the target feature measurement as follows:

[0093]

[0094] Where: τ(i, j) is the pheromone between the text vector sample and the cluster center, η(i, j) is the heuristic function, p is the probability p∈[0,1] of the target feature measuring the cluster center, p0 is the pre-set text variable, and S is the cluster center of other text vectors.

[0095] The above embodiment performs clustering optimization on the ant colony algorithm based on the data form of the program code, and screens the most representative target feature measurement through the improved ant colony algorithm, thereby providing an effective data basis for subsequent attack behavior analysis.

[0096] For example 3, please refer to Figure 3 , an embodiment of an automatic testing system for security risks of software supply chain of power information system in the present invention comprises the following steps:

[0097] The real-time data acquisition unit 101 is used to connect to the power information system backend database and acquire the data in the program code database of the power information system software in real time;

[0098] A program code feature information determination unit 102 is used to convert the data in the program code database into a text vector sequence using natural language processing technology, and to construct an abstract syntax tree based on the text vector sequence to obtain feature information of the program code;

[0099] A target feature metric determination unit 103, configured to determine a target feature metric corresponding to the feature information using an improved ant colony algorithm;

[0100] The feature metric correlation determination unit 104 is used to determine whether the correlation between the target feature metric and the feature metric in the preset software supply chain attack stage is within a threshold range, and the preset software supply chain attack stage includes a development stage, a delivery stage, and / or a use stage;

[0101] The attack technique type analysis unit 105 is used to analyze the attack technique type of the program code according to the target feature measurement when the correlation between the target feature measurement and the feature measurement in the preset software supply chain attack stage is within a threshold range;

[0102] The security risk prediction result determination unit 106 is used to perform attack behavior simulation processing according to the attack method type, obtain simulation response data, and determine the security risk prediction result according to the simulation response data.

[0103] For the specific definition of the system, please refer to the definition of the method above, which will not be repeated here. Each module in the above system can be implemented in whole or in part by software, hardware and a combination thereof. The above modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0104] Example 4, please refer to Figure 4 The present invention provides a computer device, including a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor. When the processor executes the computer-readable instructions, the steps of the above method are implemented.

[0105] Those of ordinary skill in the art will appreciate that the units of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition of each example has been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0106] In the embodiments provided by the present invention, it should be understood that the division of units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units can be combined into one unit, one unit can be split into multiple units, or some features can be ignored. In addition, each functional unit in each embodiment of the present invention can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units.

[0107] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-0nlyMemory), random access memory (RAM, RandomAccessMemory), mobile hard disk, magnetic disk or optical disk, etc., which can store program code.

[0108] It can be understood that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein by equivalents. These modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be included in the scope of the claims and specification of the present invention.

Claims

1. An automated testing method for security risks in the power information software supply chain, characterized by: include, Connect to the backend database of the power information system and obtain data from the program code database of the power information system software in real time; Using natural language processing technology to convert the data in the program code database into a text vector sequence, and constructing an abstract syntax tree based on the text vector sequence to obtain feature information of the program code; Determine the target feature metric corresponding to the feature information using an improved ant colony algorithm; Determining whether the correlation between the target feature metric and a feature metric in a preset software supply chain attack stage is within a threshold range, wherein the preset software supply chain attack stage includes a development stage, a delivery stage, and / or a use stage; If yes, then analyzing the attack method type of the program code according to the target feature measurement; Attack behavior simulation processing is performed through the attack technique type to obtain simulation response data, and the security risk prediction result is determined based on the simulation response data.

2. The method for automated testing of security risks in the power information software supply chain according to claim 1, characterized in that: The step of using the improved ant colony algorithm to determine the target feature metric corresponding to the feature information includes: Setting the original value of the characteristic information of the program code, the number of ants and the maximum evolutionary generation; Initialize k cluster centers, randomly select several text vectors in the abstract syntax tree as the original cluster centers, and calculate the distance and heuristic function from the text vector to each cluster center; Determine the class to which the text vector belongs, derive the value of the objective function, and determine the sum of the distances from each text vector to the cluster center; Compare the objective function values ​​solved by all ants and update the global pheromone; All clustering results are sorted and the target feature measurement is determined according to the set abnormal critical value.

3. The method for automated testing of security risks in the power information software supply chain according to claim 2, characterized in that: The calculation formula of the cluster center s of the target feature metric is as follows: Among them, τ(i,j) is the pheromone between the text vector sample and the cluster center, η(i,j) is the heuristic function, p is the probability of the target feature measuring the cluster center, p0 is the pre-set text variable, and S is the cluster center of other text vectors.

4. The method for automated testing of security risks in the power information software supply chain according to claim 3, characterized in that: The expression for updating the global pheromone is as follows: Where: τ ij ( t ) is the pheromone concentration between time periods i and j, ρ is the pheromone level, Δτ ij is the pheromone increment, and Q is the enhancement value of pheromone intensity.

5. The method for automated testing of security risks in the power information software supply chain according to claim 4, characterized in that: The determining whether the correlation between the target feature metric and the feature metric in a preset software supply chain attack stage is within a threshold range, wherein the preset software supply chain attack stage includes a development stage, a delivery stage, and / or a use stage, comprises: Constructing a reduced-dimensional feature matrix of the target feature metric; The Pearson correlation coefficients of the reduced dimension feature matrix and the feature matrices of the development phase, the delivery phase and / or the use phase in the preset software supply chain attack phase are calculated in sequence; It is determined whether the Pearson correlation coefficient is within a threshold range.

6. The method for automated testing of security risks in the power information software supply chain according to claim 5, characterized in that: The expression for calculating the Pearson correlation coefficient between the dimension reduction feature matrix and the feature matrix of the development stage, delivery stage and / or use stage in the preset software supply chain attack stage is as follows: In the formula: r is the correlation coefficient, X i and Y i are the ith element in the reduced dimension feature matrix X of the target feature measurement and the feature matrix Y of any preset software supply chain attack stage, and is the mean value of the variable.

7. The method for automated testing of security risks in the power information software supply chain according to claim 6, characterized in that: The analyzing the attack method type of the program code according to the target feature measurement includes: The target feature metric is input into a pre-built graph model, and the attack method type of the program code in the development phase, delivery phase and / or use phase is analyzed based on the pre-built graph model.

8. A system based on the method for automated testing of security risks in the power information software supply chain according to any one of claims 1 to 7, characterized in that: include, A real-time data acquisition unit, used to connect to the back-end database of the power information system and acquire data in the program code database of the power information system software in real time; A program code feature information determination unit, configured to convert the data in the program code database into a text vector sequence using a natural language processing technique, and to construct an abstract syntax tree based on the text vector sequence to obtain feature information of the program code; A target feature metric determination unit, configured to determine the target feature metric corresponding to the feature information using an improved ant colony algorithm; A feature metric correlation determination unit, used to determine whether the correlation between the target feature metric and a feature metric in a preset software supply chain attack stage is within a threshold range, wherein the preset software supply chain attack stage includes a development stage, a delivery stage, and / or a use stage; An attack technique type analysis unit, configured to analyze the attack technique type of the program code according to the target feature metric when the correlation between the target feature metric and the feature metric in the preset software supply chain attack phase is within a threshold range; The security risk prediction result determination unit is used to perform attack behavior simulation processing through the attack technique type to obtain simulation response data, and determine the security risk prediction result according to the simulation response data.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images