Security detection method and system for interactive application in power system, medium and processor

Abstract

The invention discloses a security detection method and system for an interactive application in a power system, a medium and a processor, and relates to the technical field of network security, the method comprises the following steps: acquiring firmware of the interactive application in the power system, and unpacking to extract a target code file function; performing static stain analysis on the extracted target code file, and constructing a pollution propagation call graph; on the basis of a graph search algorithm, traversing the pollution propagation call graph, and detecting whether potential security vulnerabilities exist or not; and classifying and evaluating the detected security vulnerabilities, and outputting a detection result. According to the method, pollution propagation analysis among different programming languages is realized, and the accuracy and range of vulnerability detection are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and particularly relates to a security detection method, system, medium and processor for interactive applications in a power system. Background Art

[0002] With the development of smart grids and the energy Internet, interactive applications in the power system (such as smart meter interaction terminals, power monitoring platforms, distributed energy management systems) are widely deployed to achieve device interconnection, user interaction, and data interaction, improving the operation efficiency of the power grid and the user experience. However, after the interactive applications are connected to the network, they are faced with malicious attack threats (such as data tampering, command injection, service interruption). Once attacked due to application vulnerabilities, serious consequences such as power outages and equipment damage may occur.

[0003] In view of this, a security detection method, system, medium and processor for interactive applications in a power system are needed. Summary of the Invention

[0004] Aiming at the problem that interactive applications in the prior art are faced with malicious attack threats after being connected to the network, the present invention provides a security detection method, system, medium and processor for interactive applications in a power system, which can detect security leaks in third-party libraries and dynamic link libraries in interactive applications of the power system, realize pollution propagation analysis between different programming languages, and improve the accuracy and scope of vulnerability detection. The specific technical solutions are as follows:

[0005] A security detection method for interactive applications in a power system, comprising:

[0006] Obtain the firmware of the interactive application in the power system, and unpack and extract the target code file functions;

[0007] Perform static taint analysis on the extracted target code file to construct a pollution propagation call graph;

[0008] Based on the graph search algorithm, traverse the pollution propagation call graph to detect whether there are potential security vulnerabilities;

[0009] Classify and evaluate the detected security vulnerabilities, and output the detection results.

[0010] Preferably, the obtaining the firmware of the interactive application in the power system and unpacking and extracting the code file includes:

[0011] Obtain the source code of the dependent libraries of the interactive application in the power system, and extract the target code file functions according to the file name suffix;

[0012] Decompile the target dynamic link library of the interactive application in the power system through a decompilation engine to extract the target code file functions.

[0013] Preferably, the source code of the dependency library of the interactive application in the power system includes third-party libraries and plugins relied on by the interactive application in the power system.

[0014] Preferably, the static taint analysis of the extracted code file functions and the construction of the pollution propagation call graph include:

[0015] Identifying and splitting the target code file functions to obtain independent function code segments;

[0016] Classifying the split function code segments using semantic-based taint analysis;

[0017] Based on the classified function code, analyzing the data flow and function call relationships in the code to construct a pollution propagation call graph.

[0018] Preferably, traversing the pollution propagation call graph based on the graph search algorithm to detect whether there are potential security vulnerabilities includes:

[0019] Traversing the pollution propagation call graph using the depth-first search algorithm or the breadth-first search algorithm;

[0020] If a preset dangerous function is traversed, record the current path and determine that there is a potential security vulnerability, or during the traversal process, if it is checked that the tainted data reaches the Sink point without effective verification / filtering, determine that there is a potential security vulnerability.

[0021] Preferably, classifying and evaluating the detected security vulnerabilities and outputting the detection results includes:

[0022] Classify the detected security vulnerabilities according to the characteristics and impacts of the security vulnerabilities;

[0023] Evaluate the classified security vulnerabilities to obtain the severity level and risk level;

[0024] Organize the classified and evaluated vulnerability information into a detection result report, and the detection result report includes detailed information about the vulnerabilities, classification and evaluation results, and repair suggestions.

[0025] A security detection system for an interactive application in a power system, which is applied to the security detection method for an interactive application in the power system described above, includes:

[0026] A firmware parsing unit, configured to obtain the firmware of the interactive application in the power system and unpack and extract the target code file functions;

[0027] A static analysis unit, configured to perform static taint analysis on the extracted target code file and construct a pollution propagation call graph;

[0028] A vulnerability detection unit, which is used to traverse the pollution propagation call graph based on a graph search algorithm to detect whether there are potential security vulnerabilities;

[0029] A result output unit, which is used to classify and evaluate the detected security vulnerabilities and output the detection results.

[0030] A computer-readable storage medium, which includes a stored program. When the program runs, it controls the device where the computer-readable storage medium is located to execute the foregoing security detection method for interactive applications in a power system.

[0031] A processor, which is used to run a program. When the program runs, it executes the foregoing security detection method for interactive applications in a power system.

[0032] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0033] The security detection method for interactive applications in a power system of the present invention analyzes the code of the interactive application in the power system by obtaining the firmware and unpacking and extracting the target code file functions, and comprehensively discovers potential security risks; constructs a pollution propagation call graph using static taint analysis, accurately traces the propagation path of data from the taint source to the taint sink, and accurately locates the specific location of the vulnerability in the code; traverses and detects the pollution propagation call graph based on the graph search algorithm, can more accurately judge whether there are potential security vulnerabilities, and effectively reduce the situation of false positives and missed reports. The present invention realizes the pollution propagation analysis between different programming languages, and improves the accuracy and scope of vulnerability detection. Description of the Drawings

[0034] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the drawings required for the description of the specific embodiments or the prior art. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.

[0035] Figure 1 It is a flowchart of the security detection method for interactive applications in a power system of the present invention.

[0036] Figure 2 It is a schematic diagram of the security detection system for interactive applications in a power system of the present invention. Specific Embodiments

[0037] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0038] It should be understood that when used in this specification, the terms "include" and "comprise" indicate the presence of the described features, wholes, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components, and / or their combinations.

[0039] It should also be understood that the terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an", and "the" are intended to include the plural forms.

[0040] It should be further understood that the term "and / or" used in the specification of the present invention refers to any combination and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0041] For the following embodiments, please refer to Figure 1 and Figure 2 .

[0042] The embodiment of the present application provides a security detection method for interactive applications in a power system, including:

[0043] Step S1: Obtain the firmware of the interactive application in the power system and unpack it to extract the target code file functions;

[0044] Through the power system device management interface or physical connection device, obtain the firmware file (such as a binary image) of the interactive application. Use firmware unpacking tools (such as Binwalk, Firmadyne, etc.) to analyze the firmware file system structure, decompress the file system image, and extract the target code files such as executable programs and dynamic link libraries. For the unpacked target code files, disassemble them using decompilation tools (such as Ghidra, IDAPro), parse the function symbol table, and extract function definitions in the code.

[0045] Step S2: Perform static taint analysis on the extracted target code files to construct a pollution propagation call graph;

[0046] In the target code file, identify possible taint sources and taint sinks. Taint sources are defined as entry points that may introduce untrusted data, such as function parameters, global variables, etc.; taint sinks are located as functions or statements that perform sensitive operations on data, such as file operation functions, network sending functions, etc. By defining sensitive data input points for interactive applications in the power system, mark the data that may introduce security risks. Based on static analysis techniques, scan the target code file, analyze the control flow graph and data dependencies of the program, track the propagation path of taint data in the program, starting from the taint source, along the execution path of the program, and check whether the data can propagate to the taint sink. According to the propagation path of taint data and function call relationships, construct a pollution propagation call graph. Present the flow track of taint data between code functions through the pollution propagation call graph to obtain potential risk propagation links.

[0047] Step S3: Based on the graph search algorithm, traverse the pollution propagation call graph to detect whether there are potential security vulnerabilities;

[0048] By using the depth-first search (DFS) or breadth-first search (BFS) algorithm, traverse the pollution propagation call graph. Starting from the starting node of the pollution propagation call graph (in this embodiment, it refers to the function where the taint source is located), gradually traverse each node and edge in the graph according to the selected search algorithm. During the traversal process, record the propagation path of taint data and relevant function call information. During the traversal process, apply predefined vulnerability detection rules. These rules are based on known security vulnerability patterns and best security practices, and are used to judge whether there are potential security vulnerabilities under the current propagation path and function call situation.

[0049] When a situation that conforms to the vulnerability detection rules is found, mark the corresponding propagation path and function call node as potential security vulnerability locations. Record the relevant vulnerability information, such as vulnerability type, the function where it is located, propagation path, etc.

[0050] Step S4: Classify and evaluate the detected security vulnerabilities and output the detection results.

[0051] Classify the detected security vulnerabilities according to their characteristics and impacts. Common vulnerability classifications include buffer overflows, SQL injection, cross-site scripting attacks (XSS), command injection, etc. Different vulnerability types have different attack principles and risk characteristics, and through classification, these vulnerabilities can be better understood and managed. Evaluate each detected vulnerability to determine its severity and risk level. The evaluation factors include the exploitability of the vulnerability, the scope of impact on the system, the difficulty of repair, etc. For example, use a vulnerability assessment model or framework, such as CVSS (Common Vulnerability Scoring System), etc., to quantify the risk level of the vulnerability. Organize the classified and evaluated vulnerability information into a detection result report. The report should include details of the vulnerability, classification and evaluation results, repair suggestions, and other content.

[0052] A security detection method for interactive applications in a power system according to the present invention analyzes the code of the interactive application in the power system by obtaining the firmware and unpacking it to extract the target code file function, and comprehensively discovers potential security risks; constructs a pollution propagation call graph using static taint analysis, accurately tracks the propagation path of data from the taint source to the taint sink, and accurately locates the specific location of the vulnerability in the code; traverses and detects the pollution propagation call graph based on the graph search algorithm, can more accurately determine whether there are potential security vulnerabilities, and effectively reduce false positives and false negatives. It realizes the pollution propagation analysis between different programming languages, and improves the accuracy and scope of vulnerability detection.

[0053] Specifically, in a preferred implementation manner of the present application, the obtaining the firmware of the interactive application in the power system and unpacking it to extract the code file includes:

[0054] Obtain the source code of the dependent libraries of the interactive application in the power system, and extract the target code file function according to the file name suffix;

[0055] The source code of the dependent libraries includes third-party libraries and plugins relied on by the interactive application in the power system.

[0056] Through the engineering files of the interactive application in the power system, version management systems (such as Git repositories) or officially released SDKs, obtain the source code of third-party libraries (such as open-source encryption libraries, communication protocol libraries) and plugins relied on by the application. The source code is an important part of the application function implementation and may contain code vulnerabilities.

[0057] Traverse the dependent library source code folder, retrieve files named with a specific programming language suffix (such as.c), and the files contain analyzable function logic. For the screened code files, parse the function definitions, extract key information such as function names, parameters, and logic bodies, and form a set of target code file functions.

[0058] Decompile the target dynamic link library of the interactive application in the power system through a decompilation engine, and extract the function of the target code file.

[0059] For the dynamic link libraries (such as.so and.dll files) of the interactive application in the power system, use a decompilation engine (such as Ghidra and IDAPro) for processing. The decompilation engine converts the binary-form dynamic link library into readable high-level language code (such as C language pseudocode), restores the function structure, variable definitions, and call relationships. From the decompiled code, identify the function boundaries, extract the function code segments, input and output parameters, and internal logic to form the function of the target code file for security analysis.

[0060] In this embodiment, filter the code files by file name suffix, quickly filter out non-code files, focus on the source code containing function logic, reduce interference from invalid data, and improve analysis efficiency. Third-party libraries and plugins are common vulnerability carriers. Extracting their function codes can comprehensively detect the security risks of dependent components and avoid power application security problems caused by vulnerabilities in dependent libraries. At the same time, decompile the binary form of the dynamic link library into readable code, enabling security detection tools to parse its function logic and expanding the coverage of code analysis. By decompiling and extracting the function code of the dynamic link library, potential vulnerabilities (such as buffer overflows and unvalidated inputs) in data processing and function calls within the library can be detected, making up for the defect that only analyzing source code cannot cover binary components and improving the comprehensiveness of security detection.

[0061] Specifically, in a preferred implementation manner of the present application, the static taint analysis of the extracted function of the code file and the construction of the pollution propagation call graph include:

[0062] Identify and split the function of the target code file to obtain independent function code segments;

[0063] In this embodiment, use a syntax analysis tool (such as a C language parser) to scan the function of the target code file, identify the function scope through function declarations and code block boundaries, and mark the function entry and exit. Split the complete code into independent function code segments according to the function boundaries, and each code segment contains only the logic of a single function (such as variable definitions, arithmetic logic, and sub-function calls).

[0064] Classify the split function code segments using semantic-based taint analysis;

[0065] By defining the following semantic tags:

[0066] (1) Taint source (Source): Mark the data input point, defined as the source where taint data is generated.

[0067] (2) Propagation Node: Analyze the logic of processing and transmitting data in the function code segment, and mark the functions involved in the tainted data flow as propagation nodes.

[0068] (3) Sink: Identify the functions that perform dangerous operations and mark them as Sink points, i.e., potential vulnerability trigger locations.

[0069] For the split function code segments, analyze the code semantics line by line, match the above tags, and complete the classification of the function code segments.

[0070] Based on the classified function code, analyze the data flow and function call relationships in the code, and construct a pollution propagation call graph.

[0071] Within the function code segment, trace the data flow paths such as variable assignments and parameter passing, and record the flow of tainted data from input to processing. Analyze the function call logic between functions, and combine the classification results to connect the Source, Propagation, and Sink nodes in the order of data propagation. Represent functions or code segments (annotated with types) as nodes, and represent data flow or function call relationships as edges to generate a visual pollution propagation call graph.

[0072] In this embodiment, the construction process of the pollution propagation call graph is as follows:

[0073] The first step, initialization and deduplication check:

[0074] Take the input entry function f, the propagation function set F, the global fuzzy hash set H, the first analysis flag first, and output the pollution propagation call graph G. Calculate the fuzzy hash value h of the function f, and check whether h already exists in H. If it exists, directly return the current call graph G.

[0075] The second step, update the hash set and analyze the type judgment:

[0076] If h does not exist, add h to H.

[0077] Judge the analysis type according to first. If first = True, perform entry function taint analysis (EntryAnalyse(f)) on the entry function; otherwise, perform subfunction taint analysis (SubfuncAnalyse(f)) to obtain the analysis result r.

[0078] The third step, recursively construct the call graph:

[0079] Traverse each function func in the analysis result r:

[0080] If func belongs to the set of propagation functions F, create a node childNode for func, add it as a child node to the call graph G, and recursively call TATINTDFS to analyze func (at this time first = False).

[0081] If func does not belong to F, only create a node childNode for func and add it to the call graph G.

[0082] Return result:

[0083] Step 4: After completing all traversals, return the constructed contamination propagation call graph G.

[0084] The construction of the contamination propagation call graph recursively unfolds the set of propagation functions F, reduces the generation of unnecessary nodes, and the finally constructed call graph G contains a complete contamination propagation chain, reducing memory occupancy compared to the traditional full-graph construction method while maintaining the path detection accuracy.

[0085] In this embodiment, a cross-procedure static taint analysis method based on contamination node tracking. By reconstructing the traditional function call graph into a contamination propagation graph and only recording the call relationships between contaminated nodes, it effectively focuses on the key data flow paths. By streamlining the analysis object, it significantly improves the execution efficiency while maintaining the integrity of the contamination propagation path, achieving a balance between accuracy and performance.

[0086] Specifically, in a preferred embodiment of the present application, traversing the contamination propagation call graph based on the graph search algorithm to detect whether there are potential security vulnerabilities includes:

[0087] Traverse the contamination propagation call graph through the depth-first search algorithm or the breadth-first search algorithm;

[0088] In this embodiment, starting from the starting node of the contamination propagation call graph, along the function call relationship or data flow direction, recursively visit adjacent nodes and deeply explore each path. During the traversal process, record the sequence of nodes passed (i.e., the data propagation path) and save the complete flow trajectory of the taint data from the source to each node.

[0089] If a preset dangerous function is traversed, record the current path and determine that there is a potential security vulnerability, or during the traversal process, if it is checked that the taint data reaches the Sink point without effective verification / filtering, determine that there is a potential security vulnerability.

[0090] In this embodiment, the specific vulnerability detection process steps for determining the existence of potential security vulnerabilities include:

[0091] Step 1: Initialize the traversal:

[0092] Starting from the traversal of the nodes of the pollution call graph G, perform checks on each node node. Determine the sink node: If the current node node belongs to the sink set S, add the node path to the path P through addPath(P,F(node)), and directly return P (indicating that an unsafe path related to the sink is found). Recursively detect child nodes: If the current node is not a sink node, traverse all its child nodes child, and recursively call Detect(child,S,P) for each child node.

[0093] Step 2, Summarize valid paths:

[0094] If the child node path p returned by the recursive call is not empty (i.e., there is an unsafe path in the child node path), add p to the current path P.

[0095] Step 3, Final return:

[0096] After traversing all nodes, if no valid path is found, return NULL; if paths are collected during the process, finally return the summarized unsafe path P.

[0097] In this embodiment, the specific vulnerability detection process steps for determining the existence of potential security vulnerabilities further include:

[0098] Step 1, Initialization:

[0099] Create an empty set S to store the final set of sink functions.

[0100] Step 2, Detection of dangerous functions:

[0101] Determine whether the input script file f contains dangerous functions. If not, directly end the process; if so, continue with subsequent processing.

[0102] Step 3, Code preprocessing:

[0103] Perform preprocessing on the file code to obtain the processed code file.

[0104] Step 4, Extract functions:

[0105] Obtain all the function sets F to be analyzed from the preprocessed code file.

[0106] Step 5, Traverse function analysis:

[0107] For each function f in the function set F, perform the following operations:

[0108] Analyze a single function f to generate a pollution propagation graph G.

[0109] Extract the sink functions from G and add them to the set S.

[0110] Step 6, Return Result:

[0111] After the traversal ends, return the final set S of sink functions.

[0112] In addition, the logical steps of the sub - process Sink(f, G) are explained as follows:

[0113] (1) Sub - function analysis:

[0114] Perform sub - function pollution analysis on the target function f to obtain the set r of sub - functions.

[0115] (2) Traverse sub - functions:

[0116] For each sub - function func in r, perform the following operations:

[0117] If func exists in the function set F:

[0118] Create a node childNode for func and add it as a child node to the pollution propagation graph G.

[0119] Recursively analyze the sink functions of func and update the pollution propagation graph G.

[0120] If func does not exist in F:

[0121] Directly create a node childNode for func and add it to the pollution propagation graph G.

[0122] (3) Return the pollution propagation graph:

[0123] After processing all sub - functions, return the updated pollution propagation graph G.

[0124] In this embodiment, through an independent sink function extraction process (creating the sink function set S), potential dangerous sink functions are first screened out, narrowing the subsequent vulnerability detection scope and improving the detection pertinence and efficiency. By using the pollution propagation graph G and the recursive traversal mechanism, not only the current function is analyzed, but also the sub - function call relationships are deeply explored (such as the recursive analysis of func in the sub - process Sink), covering the code nested call scenarios to avoid missing security vulnerabilities caused by deep - level calls. At the same time, in the vulnerability detection process, by recording the sink node paths (addPath operation), the unsafe path P is finally returned, providing developers with an intuitive vulnerability trigger path for quick location and repair of vulnerabilities.

[0125] In this embodiment, depth-first search can completely explore each potential path of the pollution propagation call graph, avoiding missing hidden vulnerability propagation links. Through recursive traversal, it can quickly trace the complete path of taint data propagation, improving the efficiency of vulnerability location. At the same time, based on the determination of the risk function, it can quickly mark the code paths involving high-risk operations and give early warnings of potential risks.

[0126] Specifically, in a preferred embodiment of the present application, the classification and evaluation of the detected security vulnerabilities, and the output detection results include:

[0127] Classify the detected security vulnerabilities according to the characteristics and impacts of the security vulnerabilities;

[0128] Evaluate the classified security vulnerabilities to obtain the severity and risk level;

[0129] Organize the classified and evaluated vulnerability information into a detection result report, and the detection result report includes details of the vulnerabilities, classification and evaluation results, repair suggestions, etc.

[0130] Based on the selected classification criteria, classify the vulnerabilities into injection vulnerabilities (such as SQL injection, command injection), memory corruption vulnerabilities (such as buffer overflow), logical vulnerabilities (such as unauthorized access), etc. And in view of the characteristics of the interactive applications in the power system, add classification dimensions (such as power protocol instruction tampering, metering data forgery vulnerabilities), and conduct subdivision in combination with the power system function modules (such as SCADA communication, smart meter control).

[0131] According to the type of the vulnerability, analyze the dangerous operations and data propagation characteristics in the vulnerability trigger path, and match the preset vulnerability feature library. If the taint data flows into the system() function without verification, it is classified as a "command injection vulnerability"; if it flows into the sensitive instruction field of the power protocol parsing module, it is classified as a "power protocol instruction tampering vulnerability".

[0132] Use difficulty (such as whether authentication is required, whether it can be remotely triggered), scope of influence (single device / whole network, data leakage volume), vulnerability exploitability (whether there is a known attack payload), impact on the power system (such as causing power outage, equipment damage, user data leakage), and repair cost (code modification complexity, system downtime).

[0133] In this embodiment, a matrix model is adopted to classify the vulnerabilities into four levels: severe, high-risk, medium-risk, and low-risk:

[0134] Severe: Can be remotely triggered, causing critical business interruption or data leakage.

[0135] High-risk: Requires local access and damages local functions.

[0136] Medium risk: Affects non-core functions or has a low data risk.

[0137] Low risk: Requires complex conditions to trigger and has no actual harm.

[0138] Among them, after the detection result report is generated, the report content includes:

[0139] (1) Vulnerability details: Vulnerability location (code path, function name), triggering conditions (such as user input type), and pollution propagation path.

[0140] (2) Classification and evaluation results: Vulnerability type (such as "injection vulnerability - power protocol instruction tampering"), risk level (such as "severe").

[0141] (3) Repair suggestions: Such as code modification examples (such as adding input validation, using secure functions to replace dangerous functions); or strengthening the testing process (such as adding power protocol fuzz testing), updating the version of the dependent library (such as fixing vulnerabilities in third-party libraries).

[0142] The embodiment of the present application provides a security detection system for an interactive application in a power system, which is applied to the security detection method for an interactive application in the aforementioned power system, and includes:

[0143] A firmware parsing unit, configured to obtain the firmware of the interactive application in the power system and unpack and extract the target code file function;

[0144] A static analysis unit, configured to perform static taint analysis on the extracted target code file and construct a pollution propagation call graph;

[0145] A vulnerability detection unit, configured to traverse the pollution propagation call graph based on a graph search algorithm to detect whether there are potential security vulnerabilities;

[0146] A result output unit, configured to classify and evaluate the detected security vulnerabilities and output the detection results.

[0147] The function explanations of each unit in this embodiment are the same as those of a security detection method for an interactive application in a power system, and the technical effects are the same, so they will not be repeated here.

[0148] The embodiment of the present application provides a computer-readable storage medium, and the computer-readable storage medium includes a stored program, wherein when the program runs, it controls the device where the computer-readable storage medium is located to execute the aforementioned security detection method for an interactive application in a power system.

[0149] The technical effect of this embodiment is the same as that of a security detection method for an interactive application in a power system in the embodiment, and will not be repeated here.

[0150] The present invention can be used in numerous general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multi-processor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, and so on.

[0151] An embodiment of this application provides a processor for running a program, wherein when the program runs, it executes the security detection method for interactive applications in the aforementioned power system.

[0152] The technical effects of this embodiment are the same as those of the embodiment of the security detection method for interactive applications in a power system, and will not be repeated here.

[0153] The processor in this embodiment can be a central processing unit (CPU), a controller, a microcontroller, or other data processing chips.

[0154] Those of ordinary skill in the art can realize that the units of each example described in combination with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. To clearly illustrate the interchangeability of hardware and software, the components of each example have been generally described according to their functions in the above description. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0155] In the embodiments provided by the present invention, it should be understood that the division of units is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units can be combined into one unit, one unit can be split into multiple units, or some features can be ignored, etc.

[0156] In addition, the functional units in each embodiment of the present invention can be integrated in a processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit. The above integrated units can be implemented in the form of hardware or in the form of software functional units.

[0157] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, read-only memories (ROMs), random access memories (RAMs), mobile hard disks, magnetic disks, or optical discs.

[0158] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of various embodiments of the present invention, and they should all be covered by the scope of the present invention specification.

Claims

1. A security detection method for interactive applications in a power system, characterized in that Including: Obtain the firmware of the interactive application in the power system and unpack it to extract the target code file function; Perform static taint analysis on the extracted target code file and construct a pollution propagation call graph; Based on the graph search algorithm, traverse the pollution propagation call graph to detect whether there are potential security vulnerabilities; Classify and evaluate the detected security vulnerabilities and output the detection results.

2. The security detection method for interactive applications in the power system according to claim 1, wherein The obtaining the firmware of the interactive application in the power system and unpacking it to extract the code file includes: Obtain the source code of the dependent libraries of the interactive application in the power system and extract the target code file function according to the file name suffix; Decompile the target dynamic link library of the interactive application in the power system through a decompilation engine and extract the target code file function.

3. The security detection method for interactive applications in the power system according to claim 2, wherein The source code of the dependent libraries of the interactive application in the power system includes third-party libraries and plugins on which the interactive application in the power system depends.

4. The security detection method for interactive applications in the power system according to claim 2, wherein The performing static taint analysis on the extracted code file function and constructing a pollution propagation call graph includes: Identify and split the target code file function to obtain independent function code segments; Classify the split function code segments using semantic-based taint analysis; Based on the classified function code, analyze the data flow and function call relationships in the code and construct a pollution propagation call graph.

5. The security detection method for interactive applications in the power system according to claim 1, characterized in that, The based on the graph search algorithm, traversing the pollution propagation call graph to detect whether there are potential security vulnerabilities includes: Traverse the pollution propagation call graph through the depth-first search algorithm or the breadth-first search algorithm; If a preset dangerous function is traversed, record the current path and determine that there are potential security vulnerabilities, or during the traversal process, if it is checked that the tainted data reaches the Sink point without effective verification / filtering, determine that there are potential security vulnerabilities.

6. The security detection method for an interactive application in the power system according to claim 5, wherein The classifying and evaluating the detected security vulnerabilities and outputting the detection results includes: Classify the detected security vulnerabilities according to the characteristics and impacts of the security vulnerabilities; Evaluate the classified security vulnerabilities to obtain the severity and risk level; Organize the classified and evaluated vulnerability information into a detection result report, and the detection result report includes the detailed information of the vulnerabilities, the classification and evaluation results, and repair suggestions.

7. A security detection system for interactive applications in a power system, characterized in that, Applied to the security detection method of the interactive application in the power system according to any one of claims 1 to 6, including: A firmware parsing unit for obtaining the firmware of the interactive application in the power system and unpacking it to extract the target code file function; A static analysis unit for performing static taint analysis on the extracted target code file and constructing a pollution propagation call graph; A vulnerability detection unit for traversing the pollution propagation call graph based on the graph search algorithm to detect whether there are potential security vulnerabilities; A result output unit for classifying and evaluating the detected security vulnerabilities and outputting the detection results.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein when the program runs, it controls the device where the computer-readable storage medium is located to execute the security detection method of the interactive application in the power system according to any one of claims 1 to 6.

9. A processor, characterized in that, The processor is used to run a program, wherein, when the program runs, it executes the security detection method for the interactive application in the power system described in any one of claims 1 to 6.

Images