Dynamic and static combined detection method for security vulnerabilities of power system software

Abstract

The invention is applicable to the technical field of vulnerability detection, and provides a power system software security vulnerability dynamic and static combined detection method, which comprises the following steps: acquiring static source code data of power system software and dynamic behavior log data during operation; generating a hierarchical abstract syntax tree and structured time series data; performing multi-dimensional feature extraction on the static source code data and the dynamic behavior log data based on a vulnerability knowledge graph of the power system; generating a domain constraint confrontation sample based on the power protocol features and the abnormal features during operation, and inputting the domain constraint confrontation sample into the constructed hybrid detection model for confrontation training to obtain a trained hybrid detection model; and performing automatic detection on the power system software by utilizing the trained hybrid detection model, and outputting a detection result containing a static code defect position and a dynamic attack path. The full-life-cycle accurate detection of the software vulnerability of the power system is realized, and the network security protection capability of the power system is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability detection, and particularly relates to a method for dynamically and statically combining the detection of software security vulnerabilities in a power system. Background Art

[0002] With the continuous improvement of the intelligence and networking level of the power system, the scale and complexity of its software have increased exponentially. As a core component of critical information infrastructure, power system software covers multiple functional modules such as data acquisition, communication protocol parsing, and real-time control logic, and its security is directly related to the stable operation of the power grid and social and economic security. At present, software security vulnerability detection technologies are mainly divided into two categories: static analysis and dynamic analysis. Static analysis identifies potential vulnerabilities through means such as code review and abstract syntax tree parsing, but it is difficult to detect vulnerabilities related to runtime behavior; dynamic analysis relies on methods such as fuzz testing and runtime monitoring to capture exceptions during program execution. Although it can discover vulnerabilities in actual attack scenarios, it is limited by test case coverage and resource consumption and is difficult to comprehensively cover code paths.

[0003] In the field of power systems, existing detection technologies are mostly improved based on general software security solutions. For example, static code scanning tools are used to screen for buffer overflow risks, or dynamic instrumentation techniques are used to monitor communication message anomalies. However, due to the unique real-time requirements, dedicated protocols, and complex state dependencies between devices in the power system, there are problems such as insufficient generalization ability of the detection model and low accuracy of the detection results in traditional methods. Summary of the Invention

[0004] The present invention provides a method for dynamically and statically combining the detection of software security vulnerabilities in a power system, which is used to solve the problems of insufficient generalization ability of the detection model and low accuracy of the detection results in traditional methods.

[0005] The present invention provides a method for dynamically and statically combining the detection of software security vulnerabilities in a power system, including:

[0006] Obtaining the static source code data of the power system software and the dynamic behavior log data during runtime;

[0007] Performing syntax structure parsing and semantic annotation on the static source code data to generate a hierarchical abstract syntax tree; performing time series alignment and time slicing processing on the dynamic behavior log data to generate structured time series data;

[0008] Performing multi-dimensional feature extraction on the static source code data and the dynamic behavior log data based on the power system vulnerability knowledge graph; wherein, extracting power protocol features from the hierarchical abstract syntax tree and extracting runtime anomaly features from the structured time series data;

[0009] Generate domain-constrained adversarial samples based on the power protocol features and runtime exception features, and input the domain-constrained adversarial samples into the constructed hybrid detection model for adversarial training to obtain the trained hybrid detection model;

[0010] Use the trained hybrid detection model to automatically detect the power system software, and output the detection results including the static code defect locations and dynamic attack paths.

[0011] Furthermore, the syntax structure parsing and semantic annotation of the static source code data to generate a hierarchical abstract syntax tree includes:

[0012] Use a syntax parser based on the power system's dedicated communication protocol to perform syntax analysis and syntax tree construction on the protocol parsing module in the static source code, and identify protocol field definitions, message formats, and verification rules;

[0013] Perform semantic annotation on the code of the real-time control module and device interaction module in the static source code according to the semantic rules of the power system control logic;

[0014] Aggregate the annotated code entities according to the functional hierarchy to generate a multi-level abstract syntax tree.

[0015] Furthermore, the time series alignment and time slicing processing of the dynamic behavior log data to generate structured time series data includes:

[0016] Perform cross-log source timestamp alignment on the communication message time series, device status jump sequence, and system call records in the dynamic behavior log data;

[0017] Perform slicing processing on the aligned log data based on a preset time window strategy, and perform structured conversion on the log data within each time window to generate time series data units;

[0018] Perform context correlation analysis on the data units of adjacent time windows to extract cross-window event dependency chains.

[0019] Furthermore, the extraction of power protocol features from the hierarchical abstract syntax tree includes:

[0020] Traverse the protocol parsing module code nodes in the hierarchical abstract syntax tree to extract protocol field call pattern features;

[0021] Identify risk pattern features by analyzing the buffer allocation function call chain;

[0022] Enhance the extracted features based on the protocol specification constraints in the power system vulnerability knowledge graph to generate protocol feature vectors, where the vectors include field call pattern encodings, buffer risk levels, and protocol compliance scores.

[0023] Furthermore, extracting runtime anomaly features from the structured time series data includes:

[0024] Determine the runtime anomaly feature vector by statistically controlling the deviation of instruction execution intervals and detecting abnormal device state jump frequencies, where the vector includes interval deviation intensity, jump frequency anomaly index, and violation status path encoding.

[0025] Furthermore, the constructed hybrid detection model includes:

[0026] The hybrid detection model includes a static detection branch, a dynamic detection branch, and a cross-modal fusion module;

[0027] The static detection branch uses a hierarchical convolutional neural network, where the size of the underlying convolutional kernel is set to the minimum unit of the power protocol field, and the connection method of the high-level residual blocks is dynamically adjusted according to the code control flow density;

[0028] The dynamic detection branch uses a bidirectional long short-term memory network, where the length of the time series window matches the control period of the power system, and the weight allocation of the attention mechanism is associated with the device state priority in the knowledge graph;

[0029] The cross-modal fusion module calculates the correlation weights between the static code features and the dynamic behavior features through a knowledge graph-driven attention mechanism, and outputs a fused vulnerability determination vector.

[0030] Furthermore, generating domain-constrained adversarial samples based on the power protocol features and runtime anomaly features includes:

[0031] Generate static adversarial samples by injecting power domain vulnerability patterns into the protocol parsing module code;

[0032] Generate dynamic adversarial samples by simulating attack behaviors during the operation of the power system.

[0033] Furthermore, inputting the domain-constrained adversarial samples into the constructed hybrid detection model for adversarial training to obtain the trained hybrid detection model includes:

[0034] Input the static adversarial samples into the static detection branch and the dynamic adversarial samples into the dynamic detection branch, and optimize the model through the following steps:

[0035] Calculate the vulnerability classification loss of the static detection branch and the temporal anomaly detection loss of the dynamic detection branch respectively;

[0036] Optimizing the feature representations corresponding to the static detection branch and the dynamic detection branch through the attention weight of the cross-modal fusion module;

[0037] The model parameters are updated iteratively until the accuracy of static detection and the false alarm rate of dynamic detection meet the preset threshold conditions.

[0038] Furthermore, the inputting of the domain-constrained adversarial samples into the constructed hybrid detection model for adversarial training to obtain a trained hybrid detection model further includes:

[0039] Adopt a two-stage strategy for adversarial training;

[0040] The first stage independently trains the static detection branch and the dynamic detection branch, including: training the static detection branch to freeze the parameters of the dynamic detection branch, and updating the convolution kernel weights and residual connections of the layered convolutional neural network through static adversarial samples; training the dynamic detection branch to freeze the parameters of the static detection branch, and optimizing the timing window parameters and attention weights of the bidirectional long short-term memory network through dynamic adversarial samples;

[0041] The second stage jointly optimizes the cross-modal fusion module, including unfreezing all parameters of the static detection branch and the dynamic detection branch, and optimizing them using a joint loss function driven by a knowledge graph.

[0042] The parameters of the static detection branch, the dynamic detection branch and the cross-modal fusion module are optimized by the gradient descent algorithm until the model converges to obtain a trained hybrid detection model.

[0043] Furthermore, the trained hybrid detection model is used to automatically detect the power system software and output detection results containing static code defect locations and dynamic attack paths, including:

[0044] Associating the detected protocol parsing defect or buffer overflow vulnerability with a specific line number and a corresponding functional module in the source code file according to the node mapping relationship of the hierarchical abstract syntax tree;

[0045] Determine the propagation links and key nodes of the attack path based on the event chain in structured time series data;

[0046] By using the attention weights of the cross-modal fusion module to associate static code defects with dynamic attack paths, vulnerabilities with logical coupling are marked.

[0047] Generates a comprehensive vulnerability report that includes static defect repair priorities and emergency response plans for dynamic attack paths.

[0048] It can be seen from the above technical solutions that the present invention has the following advantages:

[0049] Based on obtaining the static source code and dynamic behavior log data of the power system software, a hierarchical abstract syntax tree and structured time series data are generated. Then, through multi-dimensional feature extraction based on a knowledge graph, the misjudgment rate of general rules is reduced and the sensitivity to covert attacks is enhanced. Domain constraint adversarial samples are generated and a hybrid detection model is trained to improve the generalization ability of the model to power-specific vulnerabilities. Finally, the visualization of static code line numbers and dynamic attack paths can provide actionable repair guidelines. Through the fusion of dynamic and static data, feature extraction driven by domain knowledge, and a hybrid model optimized by adversarial training, accurate detection of power system software vulnerabilities throughout the entire life cycle is achieved. At the same time, it supports code-level defect repair and runtime attack emergency response, significantly enhancing the network security protection ability of the power system. Brief Description of the Drawings

[0050] Figure 1 It is a schematic flowchart of an embodiment of a dynamic and static combined detection method for power system software security vulnerabilities in the present invention. Detailed Embodiment

[0051] In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0052] In this embodiment, the dynamic and static combined detection method for power system software security vulnerabilities is used to improve the accuracy of vulnerability detection. The implementation method in this embodiment can be implemented in a system, on a server, or on a terminal, and no specific limitation is made.

[0053] Embodiment 1

[0054] Please refer to Figure 1 , an embodiment of a dynamic and static combined detection method for power system software security vulnerabilities in the present invention includes the following steps:

[0055] S11. Obtain the static source code data of the power system software and the dynamic behavior log data during runtime;

[0056] Obtain the static source code of the core modules of the power system software through a version control system, including protocol parsing and control logic code, and perform coding unification and redundancy cleaning; at the same time, use network packet capture tools and log agents to collect dynamic behavior data in real time, including communication messages, device status logs, and system call records, generate structured time series data through time series alignment, event slicing, and protocol compliance checking, and perform adaptation preprocessing in combination with a power-specific protocol parser and device state machine rules to ensure data integrity and security, providing high-quality input for subsequent dynamic and static feature extraction and vulnerability detection.

[0057] S12. Parse the syntax structure and perform semantic annotation on the static source code data to generate a hierarchical abstract syntax tree; perform time series alignment and time slicing processing on the dynamic behavior log data to generate structured time series data;

[0058] S121. Parse the syntax structure and perform semantic annotation on the static source code data to generate a hierarchical abstract syntax tree, including:

[0059] 1. Use a syntax parser based on the power system's dedicated communication protocol to perform syntax analysis and syntax tree construction on the protocol parsing module in the static source code, and identify protocol field definitions, message formats, and verification rules;

[0060] When parsing the IEC 61850 protocol module, identify the definition of the APDU (Application Protocol Data Unit) length field, extract its ASN.1 encoding rule, and verify whether the CRC checksum generation logic complies with the standard specification, such as the checksum covering all message fields.

[0061] 2. Perform semantic annotation on the code of the real-time control module and device interaction module in the static source code according to the semantic rules of the power system control logic;

[0062] Perform semantic annotation on the code of the real-time control module and device interaction module based on the semantic rules of the power control logic. For example, add time series tags and data flow direction identifiers according to the time series constraints of the circuit breaker opening and closing commands. In the circuit breaker control logic code, add a time series tag of "must be executed after overcurrent detection" to the "opening" command, and mark the data flow direction for the device communication interface code, such as SCADA system → circuit breaker as an output command, and circuit breaker status feedback → SCADA as input data.

[0063] 3. Aggregate the annotated code entities at the functional level to generate a multi-level abstract syntax tree.

[0064] The top layer of the aggregated abstract syntax tree is the "relay protection module", the middle layer contains the "DNP3 message parsing function", and the leaf nodes are bound to specific code lines, providing structured input for subsequent vulnerability feature extraction.

[0065] S122. Perform time series alignment and time slicing on the dynamic behavior log data to generate structured time series data, including:

[0066] 1. Align the timestamps across log sources for the communication message timings, device state transition sequences, and system call records in the dynamic behavior log data;

[0067] Align the timestamps across log sources for the dynamic behavior log data, unify them to the UTC millisecond level benchmark, and eliminate time series misalignment. For example, convert the log timestamps of the SCADA system and the Unix timestamps of the RTU devices to UTC millisecond level time, and compensate for the clock deviation through interpolation.

[0068] 2. Perform slicing on the aligned log data based on a preset time window strategy, and perform structured conversion on the log data within each time window to generate time series data units;

[0069] The preset time window strategy is fixed window + event trigger. Split the communication message stream according to a 1-second fixed window, and at the same time trigger an event window when a breaker state transition is detected, generating data units containing timestamp intervals, event types ("breaker trip"), event parameters (pre-transition state "closed", post-transition state "open"), and device IDs.

[0070] 3. Perform context correlation analysis on the data units of adjacent time windows to extract cross-window event dependency chains.

[0071] Analysis finds that an abnormal Modbus TCP message (function code 0x10 tampered) in time window W1 triggers a breaker mis-trip event in time window W2, and constructs an attack chain "malicious message injection → breaker abnormal operation → SCADA control failure".

[0072] The above steps construct an attack scenario graph through time series alignment and event chain analysis, such as abnormal message → device misoperation → system out of control, to support the restoration of dynamic attack paths. The combination of the two achieves a full-dimensional detection of power system vulnerabilities.

[0073] S13. Extract multi-dimensional features from the static source code data and dynamic behavior log data based on the power system vulnerability knowledge graph; among them, extract power protocol features from the hierarchical abstract syntax tree and runtime anomaly features from the structured time series data;

[0074] In this embodiment, the power system vulnerability knowledge graph here is a structured knowledge base that systematically organizes security vulnerabilities, protocol specifications, device behavior rules, and repair strategies in the field of power systems in the form of triples of entities, relationships, and attributes. Its core components are as follows: The protocol specification entity includes protocol field definitions, message format rules, and legal operation constraints; the vulnerability pattern entity includes static vulnerabilities, dynamic vulnerabilities, and associated vulnerability chains; the device behavior rule entity includes state machine constraints, control cycle requirements, and abnormal behavior thresholds; the repair strategy entity includes static repair suggestions, dynamic emergency plans, and priority rules.

[0075] Knowledge graph construction: Extract field definitions, message formats, and verification rules from standard documents such as IEC 61850 and DNP3; integrate power system-related vulnerabilities in CVE and NVD; extract state machine rules from SCADA systems and breaker device manuals; annotate vulnerability repair strategies and attack scenarios by security experts. Use a graph database to store entity relationships and define logical relationships through a rule engine. Compare the protocol parsing code in the abstract syntax tree with the protocol specifications in the knowledge graph, and match the function call chain in the code with the vulnerability patterns in the knowledge graph. According to the device state rules in the knowledge graph, judge whether the behavior in the log is compliant; use the vulnerability association chain in the knowledge graph to restore the attack scenario; finally, generate adversarial samples based on the vulnerability patterns in the knowledge graph.

[0076] S131. Extract power protocol features from the hierarchical abstract syntax tree, including:

[0077] 1. Traverse the protocol parsing module code nodes in the hierarchical abstract syntax tree to extract protocol field call pattern features;

[0078] Identify the nested call levels of the DataAttribute field by the IEC 61850 message parsing function in the code, and count the call frequency of function codes (such as the 0x02 read operation of DNP3) and the parameter passing path (such as reading the message length from the buffer). Among them, use the syntax parser generated by ANTLR to traverse the abstract syntax tree nodes and match the protocol field definitions in combination with regular expressions.

[0079] 2. Identify risk pattern features by analyzing the buffer allocation function call chain;

[0080] Detect that the len parameter in memcpy(dest,src,len) is not verified whether it exceeds the length of the dest buffer, and mark it as a high risk; find that the number of dynamic memory allocations (malloc(1024)) and releases (free) do not match, and mark it as a memory leak risk. Among them, the rule library matching is based on the vulnerability pattern library in the knowledge graph (such as CWE-120 buffer overflow), and the risk patterns are classified (high / medium / low).

[0081] 3. Enhance the extracted features based on the protocol specification constraints in the power system vulnerability knowledge graph to generate protocol feature vectors, where the vectors include field call pattern encodings, buffer risk levels, and protocol compliance scores.

[0082] Verify whether the length of the IEC 61850 message field meets the threshold defined in the knowledge graph (e.g., APDU length ≤ 1024 bytes), and the score for the exceeded field is 0. Verify whether the Modbus TCP function code is within the legal range (0x01 - 0x06), and the score for the illegal function code (e.g., 0x1B) is 0. The protocol feature vector includes field call pattern encodings (such as binary bitmaps), buffer risk levels (0 - 5 levels), and protocol compliance scores (0 - 100%).

[0083] S132. Extract runtime anomaly features from the structured time - series data, including:

[0084] Determine the runtime anomaly feature vector by statistically controlling the execution interval deviation of control instructions and detecting the abnormal frequency of device state jumps. The vector includes the interval deviation intensity, jump frequency anomaly index, and violation status path encoding.

[0085] By statistically controlling the execution interval deviation of control instructions (e.g., the actual interval between circuit breaker opening and closing instructions is 150 ms, less than the minimum safety interval of 200 ms defined in the knowledge graph, and the deviation intensity is - 50 ms), detecting the abnormal frequency of device state jumps (e.g., the relay state switches 5 times per second, exceeding the knowledge graph threshold of 3 times / second), and extracting the violation status path (such as "running → fault → running" without the "stopping" state); filter legal data based on the device state machine rules in the knowledge graph (such as the SCADA control cycle of 1 second) to generate the runtime anomaly feature vector, which includes the interval deviation intensity (numeric), jump frequency anomaly index (such as 1.67 times the threshold), and violation path encoding (such as the binary sequence 1011). For example, [- 50, 1.67, 1011] provides quantitative input for dynamic attack detection.

[0086] S14. Generate domain - constrained adversarial samples based on the power protocol features and runtime anomaly features, and input the domain - constrained adversarial samples into the constructed hybrid detection model for adversarial training to obtain the trained hybrid detection model;

[0087] In this embodiment, the constructed hybrid detection model includes:

[0088] 1. The hybrid detection model includes a static detection branch, a dynamic detection branch, and a cross - modal fusion module;

[0089] 2. The static detection branch adopts a hierarchical convolutional neural network. Among them, the size of the bottom-layer convolutional kernel is set to the minimum unit of the power protocol field, and the connection method of the upper-layer residual block is dynamically adjusted according to the code control flow density;

[0090] Setting the size of the bottom-layer convolutional kernel to the minimum unit of the power protocol field is for the bottom-layer convolutional kernel to adapt to the protocol field. For example, for the function code (occupying 1 byte) of the Modbus TCP protocol, the bottom-layer convolutional kernel is set to 3×1 to accurately capture the local features of a single-byte field (such as the read operation corresponding to function code 0x02).

[0091] Dynamically adjust the residual connection according to the code control flow density (such as the number of loop nestings). For example, when it is detected that the number of loop nestings > 3, add skip connections in the residual block to alleviate the problem of gradient disappearance and enhance the feature extraction ability for complex control logics (such as the multi-level control loop of the SCADA system).

[0092] 3. The dynamic detection branch adopts a bidirectional long short-term memory network. Among them, the length of the time series window matches the control period of the power system, and the weight allocation of the attention mechanism is associated with the device status priority in the knowledge graph;

[0093] Set the length of the time series window of the Bi-LSTM to match the control period of the power system. For example, if the sampling period of the SCADA system is 100 ms, the window length is set to 10 (covering 1 second of data) to ensure that the model captures the complete control instruction sequence (such as continuously detecting the breaker status 10 times). Allocate attention weights according to the priority of the device status in the knowledge graph. For example, the weight of the "emergency shutdown instruction" is increased by 50% to enhance the sensitivity of the model to key events.

[0094] 4. The cross-modal fusion module calculates the correlation weight between the static code features and the dynamic behavior features through the attention mechanism driven by the knowledge graph, and outputs the fused vulnerability determination vector.

[0095] Calculate the correlation weight between the static code features and the dynamic behavior features through the domain rules in the knowledge graph, such as device status dependencies and protocol compliance constraints. For example, if there is a DNP3 protocol parsing defect in the static code and abnormal message injection is detected in the dynamic log, the correlation weight is increased to 0.9.

[0096] Specifically, generate domain constraint adversarial samples based on power protocol features and runtime anomaly features, including:

[0097] 1. Generate static adversarial samples by injecting power domain vulnerability patterns into the code of the protocol parsing module;

[0098] Inject power domain vulnerability patterns into the protocol parsing module code. For example, modify the length field in the DNP3 protocol parsing code to exceed the threshold defined in the knowledge graph (such as a maximum length of 100 bytes), while maintaining syntactic correctness. Or add an unvalidated length memcpy operation in the control logic code.

[0099] 2. Generate dynamic adversarial samples by simulating attack behaviors during the operation of the power system

[0100] Simulate attack behaviors during the operation of the power system. For example, construct a sequence of repeated legitimate messages (such as repeatedly sending recorded DNP3 read instructions) to trigger abnormal device states; generate a sequence of device state jumps (such as a circuit breaker opening and closing continuously within 200 ms), violating the state machine rules in the knowledge graph (minimum interval ≥ 200 ms).

[0101] Specifically, the training process of the hybrid detection model includes the following:

[0102] Input static adversarial samples into the static detection branch and dynamic adversarial samples into the dynamic detection branch, and optimize the model through the following steps:

[0103] 1. Calculate the vulnerability classification loss of the static detection branch and the temporal anomaly detection loss of the dynamic detection branch respectively;

[0104] 2. Optimize the feature representations corresponding to the static detection branch and the dynamic detection branch through the attention weights of the cross-modal fusion module;

[0105] 3. Iteratively update the model parameters until the accuracy of static detection and the false positive rate of dynamic detection meet the preset threshold conditions.

[0106] Here, the vulnerability classification loss is the cross-entropy loss, and the temporal anomaly detection loss is the mean squared error loss; the preset threshold conditions set the static detection accuracy ≥ 95% and the dynamic detection false positive rate ≤ 5%.

[0107] Adopt a two-stage strategy for adversarial training;

[0108] 1. In the first stage, independently train the static detection branch and the dynamic detection branch, including: training the static detection branch by freezing the parameters of the dynamic detection branch and updating the convolutional kernel weights and residual connections of the hierarchical convolutional neural network through static adversarial samples; training the dynamic detection branch by freezing the parameters of the static detection branch and optimizing the temporal window parameters and attention weights of the bidirectional long short-term memory network through dynamic adversarial samples;

[0109] Static detection branch training is to optimize the parameters of the hierarchical convolutional neural network (CNN) to accurately extract the features of power protocols and buffer vulnerabilities. Implementation steps: Freeze all the parameters of the dynamic detection branch (Bi-LSTM) to ensure that the dynamic branch does not participate in the gradient update during the static training process; Input static adversarial samples (such as codes that tamper with protocol fields) to generate corresponding feature vectors; The static branch processes the input features and outputs the vulnerability classification results, such as buffer overflow or protocol parsing defects; Only update the convolutional kernel weights and residual connection parameters of the static branch; The convergence condition is that the static detection accuracy ≥ 95% or the loss value changes < 1e-4 for 5 consecutive epochs.

[0110] Dynamic detection branch training is to optimize the parameters of the bidirectional long short-term memory network (Bi-LSTM) to improve the ability of time series anomaly detection. Implementation steps: Freeze all the parameters of the static detection branch (CNN); Input dynamic adversarial samples (such as replay attack message sequences) to generate structured time series data, such as a legal DNP3 message sequence being sent 10 times repeatedly to simulate a replay attack; The dynamic branch processes the time series data and outputs an anomaly score (such as an anomaly probability between 0 and 1); Only update the time series window parameters and attention weights of the dynamic branch; The convergence condition is that the dynamic detection false alarm rate ≤ 5% or the loss value changes < 1e-4 for 5 consecutive epochs.

[0111] 2. In the second stage, jointly optimize the cross-modal fusion module, including: Unfreeze all the parameters of the static detection branch and the dynamic detection branch, and optimize using a knowledge graph-driven joint loss function;

[0112] Jointly optimizing the cross-modal fusion module is to synchronously optimize the parameters of all branches to achieve deep fusion of dynamic and static features. Implementation steps: Unfreeze all the parameters of the static branch and the dynamic branch to allow global optimization; Combine the static classification loss, the dynamic regression loss, and the knowledge graph-driven regularization term: L 总 = 0.6L 静态 + 0.3L 动态 + 0.1 ‖ W 融合 ‖ 2, where: L 静态 is the cross-entropy loss, L 动态 is the MSE loss, ‖ W 融合 ‖ 2 is the fusion module weight L2 regularization term; At the same time, input static adversarial samples and dynamic adversarial samples, and calculate the correlation weights of dynamic and static features through the attention mechanism.

[0113] 3. Optimize the parameters of the static detection branch, the dynamic detection branch, and the cross-modal fusion module through the gradient descent algorithm until the model converges to obtain the trained hybrid detection model.

[0114] All parameters are synchronously optimized by the Adam gradient descent algorithm. The convergence condition is that the total loss value changes less than 1e-5 for 10 consecutive epochs, or the maximum number of training rounds is reached. In the second stage, joint training is achieved through the attention mechanism to enhance the model's adaptability to complex attack scenarios.

[0115] The adversarial samples generated in the above steps conform to the actual vulnerability patterns of the power system, improving the model's generalization ability for hidden vulnerabilities; the hybrid detection model first trains independently to ensure the convergence of branches, and then jointly optimizes to achieve the global optimum. Finally, the model reaches a static detection accuracy of 96% and a dynamic false alarm rate of 4% on the test set, which is significantly improved compared with the baseline method.

[0116] S15. Use the trained hybrid detection model to automatically detect the power system software, and output the detection results including the locations of static code defects and dynamic attack paths.

[0117] 1. According to the node mapping relationship of the hierarchical abstract syntax tree, associate the detected protocol parsing defects or buffer overflow vulnerabilities with the specific line numbers and the functional modules to which they belong in the source code file;

[0118] Traverse the leaf nodes of the hierarchical abstract syntax tree, and parse the corresponding relationship between the nodes and the source code file through the symbol table (SymbolTable). For example, in the abstract syntax tree of the protocol parsing module, the memcpy call node of the parse_dnp3() function is mapped to the 45th line of code in the dnp3_parser.c file. Among them, the node metadata is extracted using the syntax tree parser generated by ANTLR.

[0119] According to the hierarchical structure of the abstract syntax tree (top layer → middle layer → leaf nodes), determine the functional module to which the vulnerability belongs. For example, if the vulnerability node is under the "SCADA control loop" subtree in the middle layer, it is marked as the "SCADA control logic module". Finally, combined with the vulnerability repair rules in the knowledge graph, generate repair suggestions for each defect.

[0120] 2. Based on the event chain in the structured time series data, determine the propagation link and key nodes of the attack path;

[0121] Extract the event sequence from the structured time series data, and generate an event chain sorted by timestamp. Based on the attack pattern library in the knowledge graph, mark the key attack nodes. For example, identify "malicious DNP3 message injection" as the initial penetration point and "circuit breaker tripping" as the key diffusion node. Use a graph database to store the event chain, and generate an attack path topology graph through a visualization tool. For example, in the graph, nodes represent devices / events, and edges represent the attack propagation direction (such as "RTU device → circuit breaker → SCADA master station").

[0122] 3. Associate static code defects with dynamic attack paths through the attention weights of the cross-modal fusion module, and mark the vulnerabilities with logical coupling.

[0123] Calculate the logical coupling degree between static code defects and dynamic attack paths through the attention weight matrix of the cross-modal fusion module. For example, the lack of DNP3 length check in static code (weight 0.8) is associated with the injection of an extremely long message in dynamic logs (weight 0.9), and the coupling degree is 0.72. Set the coupling degree threshold to mark the vulnerabilities that need to be prioritized for handling. For example, if the coupling degree between a protocol parsing defect and a message injection attack reaches 0.85, it is marked as a "severely associated vulnerability".

[0124] 4. Generate a comprehensive vulnerability report, which includes the repair priority of static defects and the emergency handling plan for dynamic attack paths.

[0125] Generate repair priorities including high, medium, and low based on the CVSS scores of vulnerabilities and the criticality of devices in the knowledge graph. For example, a buffer overflow vulnerability in the SCADA master station (CVSS 9.0 + device criticality weight 0.9) is marked as "highest priority". Generate solutions such as device isolation and instruction rollback according to the dynamic attack path. For example, perform network isolation on the device with abnormal message injection (RTU device ID = 001) and roll back the controlled circuit breaker to a safe state. Finally, use a template engine to generate an HTML / PDF report, including the highlighted code segments of the static defect locations, the topology diagram of the dynamic attack path, and the repair and handling suggestions for associated vulnerabilities.

[0126] The above steps are accurate to the code line level for static vulnerabilities and restored to the device level for dynamic attack paths; reveal the causal relationship between static and dynamic vulnerabilities; the report provides repair priorities and emergency plans to support rapid response.

[0127] Those of ordinary skill in the art can realize that the units of each example described in combination with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. To clearly illustrate the interchangeability of hardware and software, the components of each example have been generally described according to their functions in the above description. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0128] In the embodiments provided by the present invention, it should be understood that the division of units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units can be combined into one unit, one unit can be split into multiple units, or some features can be ignored, etc. In addition, in each embodiment of the present invention, the functional units can be integrated in a processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit. The above integrated units can be implemented in the form of hardware or in the form of software functional units.

[0129] If the above integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in each embodiment of the present invention. The foregoing storage medium includes: various media such as USB flash drives, read-only memories (ROMs), random access memories (RAMs), mobile hard disks, magnetic disks, or optical discs that can store program codes.

[0130] It can be understood that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features. These modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of each embodiment of the present invention, and they should all be covered by the scope of the claims and the description of the present invention.

Claims

1. A dynamic and static combined detection method for software security vulnerabilities in a power system, characterized in that, Including: Obtain the static source code data of the power system software and the dynamic behavior log data during runtime; Perform syntactic structure parsing and semantic annotation on the static source code data to generate a hierarchical abstract syntax tree; Perform temporal alignment and time slicing processing on the dynamic behavior log data to generate structured time series data; Extract multi-dimensional features from the static source code data and the dynamic behavior log data based on the power system vulnerability knowledge graph; among them, extract power protocol features from the hierarchical abstract syntax tree and extract runtime anomaly features from the structured time series data; Generate domain-constrained adversarial samples based on the power protocol features and runtime anomaly features, and input the domain-constrained adversarial samples into the constructed hybrid detection model for adversarial training to obtain the trained hybrid detection model; Use the trained hybrid detection model to automatically detect the power system software and output the detection results including the static code defect locations and dynamic attack paths.

2. The dynamic and static combined detection method for software security vulnerabilities of a power system according to claim 1, characterized in that The performing syntactic structure parsing and semantic annotation on the static source code data to generate a hierarchical abstract syntax tree includes: Use a syntax parser based on the power system's dedicated communication protocol to perform syntax analysis and syntax tree construction on the protocol parsing module in the static source code, and identify protocol field definitions, message formats, and verification rules; Perform semantic annotation on the code of the real-time control module and device interaction module in the static source code according to the semantic rules of the power system control logic; Aggregate the annotated code entities by functional levels to generate a multi-level abstract syntax tree.

3. The dynamic and static combined detection method for software security vulnerabilities of the power system according to claim 1, characterized in that The performing temporal alignment and time slicing processing on the dynamic behavior log data to generate structured time series data includes: Perform cross-log-source timestamp alignment on the communication message timings, device state transition sequences, and system call records in the dynamic behavior log data; Perform slicing processing on the aligned log data based on a preset time window strategy, and perform structured conversion on the log data within each time window to generate time series data units; Perform context correlation analysis on the data units in adjacent time windows to extract cross-window event dependency chains.

4. The dynamic and static combined detection method for software security vulnerabilities of the power system according to claim 1, characterized in that The extracting power protocol features from the hierarchical abstract syntax tree includes: Traverse the protocol parsing module code nodes in the hierarchical abstract syntax tree to extract protocol field call pattern features; Identify risk pattern features by analyzing the buffer allocation function call chain; Enhance the extracted features based on the protocol specification constraints in the power system vulnerability knowledge graph to generate protocol feature vectors, where the vectors include field call pattern encodings, buffer risk levels, and protocol compliance scores.

5. The dynamic and static combined detection method for software security vulnerabilities of a power system according to claim 1, characterized in that The extracting runtime anomaly features from the structured time series data includes: Determine the runtime anomaly feature vector by statistically analyzing the control instruction execution interval deviation and detecting abnormal device state transition frequencies, where the vector includes the interval deviation intensity, jump frequency anomaly index, and violation status path encoding.

6. The dynamic and static combined detection method for software security vulnerabilities of a power system according to claim 1, characterized in that The constructed hybrid detection model includes: The hybrid detection model includes a static detection branch, a dynamic detection branch, and a cross-modal fusion module; The static detection branch uses a layered convolutional neural network, in which the bottom convolution kernel size is set to the minimum unit of the power protocol field, and the high-level residual block connection method is dynamically adjusted according to the code control flow density; The dynamic detection branch uses a bidirectional long short-term memory network, in which the time window length matches the power system control cycle, and the attention mechanism weight distribution is associated with the device status priority in the knowledge graph; The cross-modal fusion module calculates the association weights of static code features and dynamic behavior features through the knowledge graph-driven attention mechanism, and outputs the fused vulnerability judgment vector.

7. The dynamic and static combined detection method for software security vulnerabilities of a power system according to claim 6, characterized in that, The generating of domain-constrained adversarial samples based on the power protocol features and runtime anomaly features includes: Generate static adversarial samples by injecting power sector vulnerability patterns into the protocol parsing module code; Generate dynamic adversarial samples by simulating attack behaviors during power system operation.

8. The dynamic and static combined detection method for software security vulnerabilities of a power system according to claim 7, characterized in that The domain-constrained adversarial sample is input into the constructed hybrid detection model for adversarial training to obtain a trained hybrid detection model, including: The static adversarial sample is input into the static detection branch, and the dynamic adversarial sample is input into the dynamic detection branch, and the model is optimized by the following steps: Calculating the vulnerability classification loss of the static detection branch and the timing anomaly detection loss of the dynamic detection branch respectively; Optimizing the feature representations corresponding to the static detection branch and the dynamic detection branch through the attention weight of the cross-modal fusion module; The model parameters are updated iteratively until the accuracy of static detection and the false alarm rate of dynamic detection meet the preset threshold conditions.

9. The dynamic and static combined detection method for software security vulnerabilities of a power system according to claim 8, characterized in that The inputting the domain-constrained adversarial sample into the constructed hybrid detection model for adversarial training to obtain a trained hybrid detection model further includes: Adopt a two-stage strategy for adversarial training; The first stage independently trains the static detection branch and the dynamic detection branch, including: training the static detection branch to freeze the parameters of the dynamic detection branch, and updating the convolution kernel weights and residual connections of the layered convolutional neural network through static adversarial samples; training the dynamic detection branch to freeze the parameters of the static detection branch, and optimizing the timing window parameters and attention weights of the bidirectional long short-term memory network through dynamic adversarial samples; The second stage jointly optimizes the cross-modal fusion module, including unfreezing all parameters of the static detection branch and the dynamic detection branch, and optimizing them using a joint loss function driven by a knowledge graph. The parameters of the static detection branch, the dynamic detection branch and the cross-modal fusion module are optimized by the gradient descent algorithm until the model converges to obtain a trained hybrid detection model.

10. The dynamic and static combined detection method for software security vulnerabilities of the power system according to claim 1, characterized in that, The method of automatically detecting the power system software using the trained hybrid detection model and outputting detection results including static code defect locations and dynamic attack paths includes: Associating the detected protocol parsing defect or buffer overflow vulnerability with a specific line number and a corresponding functional module in the source code file according to the node mapping relationship of the hierarchical abstract syntax tree; Determine the propagation links and key nodes of the attack path based on the event chain in structured time series data; Associate static code defects with dynamic attack paths through the attention weights of the cross-modal fusion module, and mark the vulnerabilities with logical coupling. Generate a comprehensive vulnerability report, which includes the repair priorities of static defects and the emergency response plans for dynamic attack paths.

Images