Power terminal dynamic code immunization method based on genetic map

Abstract

The invention relates to the technical field of power terminal protection, and discloses a power terminal dynamic code immunization method based on a genetic map, which is used for solving the problem that the original sliding time window length is no longer representative during power terminal immunization protection, and comprises the following steps: constructing a code genetic map database, setting an initial sliding window length, acquiring behavior adaptability parameters of the power terminal, evaluating to obtain a window adjustment index, judging whether the sliding window length needs to be adjusted or not, if so, adjusting the sliding window length according to the window adjustment index to obtain an actual sliding window length, and adjusting the actual sliding window length according to the actual sliding window length. According to the actual sliding window length, terminal code behavior abnormity judgment is carried out, if it is judged that terminal code behavior abnormity occurs, terminal code immune protection is carried out according to the behavior similarity, and the real-time performance and precision of abnormity recognition are effectively improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power terminal protection, and more particularly to a power terminal dynamic code immune method based on a gene map. BACKGROUND

[0002] With the continuous advancement of the digitalization process of the power system, embedded power terminal devices are widely deployed in key links such as power transmission, power transformation, power distribution, etc. Such terminals include relay protection devices, intelligent measurement and control units, communication management modules, etc., which usually undertake core business functions such as protection execution, remote control, dispatching communication, etc. To ensure the behavior credibility of power terminals during operation, prevent illegal code from tampering with the running logic or interfering with the control process, and build a runtime security mechanism for embedded software have become a key technology direction to ensure the stable operation of the secondary system.

[0003] To realize the identification and response of illegal code behavior by power terminals, the existing technology usually adopts a static whitelist mechanism or a signature matching mechanism, which verifies the identity and legality of the code fragments before program loading or execution, thereby preventing the execution of unauthorized code.

[0004] However, the above-mentioned technology at least has the following technical problems:

[0005] In the actual running environment, the software run by the power terminal has a high degree of customization, containing a large number of industry-specific logic related to communication protocols, relay protection algorithms, custom state machines, etc., making it difficult for traditional static whitelist or signature matching-based mechanisms to fully cover all legal behavior paths of the terminal in different business scenarios. At the same time, the terminal running process is often accompanied by dynamic behaviors such as remote loading configuration, instruction triggering response, and bootstrap update, making the code execution process highly variable and context-dependent, further exacerbating the blind area problem of static rule identification.

[0006] Even if some existing solutions introduce a sliding window type runtime behavior detection mechanism, the analysis window is usually fixed in length, which is difficult to adapt to the frequent switching of behavior patterns from a steady state to a sudden disturbance, and is prone to misjudgment due to insufficient context information, or protection failure caused by delayed response, etc., limiting the real-time and accuracy of behavior anomaly identification.

[0007] On the other hand, the existing embedded security scheme focuses on static file authentication or peripheral access control, lacks dynamic perception of behavior path during program running and abnormal comparison mechanism, and cannot identify nested illegal instructions or imitated communication behavior under legal entry. In addition, when detecting potential abnormal behavior, the traditional scheme often only records logs or triggers alarms, and it is difficult to interrupt the high-risk behavior path in time, which may miss the key response window. Not only affects the stability of system operation, but also may cause serious consequences such as misoperation of relay protection, failure of remote control channel and abnormality of voltage regulation, thereby destroying the operation reliability and safety redundancy of power system. SUMMARY

[0008] In order to overcome the above-mentioned defects of the prior art, the present application provides a power terminal dynamic code immunization method based on gene map to solve the problems in the above background art.

[0009] In order to achieve the above-mentioned purpose, the present application provides the following technical scheme:

[0010] A power terminal dynamic code immunization method based on gene map, comprising the following steps: step 1: in the initial deployment stage of the terminal, based on the static analysis of the firmware source code, the function fragments related to the key business process are extracted, the function fragments are constructed into behavior characteristic vectors according to the function label, the calling path structure, the global variable usage mode and the control flow graph, and the code gene map library is constructed according to the behavior characteristic vectors; step 2: after the terminal starts, the loaded program module is subjected to dynamic insertion operation through the integrated code dyeing engine, and dyeing marks are marked at each insertion point, which are recorded as dyeing mark flow; step 3: in the process of terminal running, the dyeing mark flow is received in real time, and is sequentially cached according to time sequence to form a behavior time sequence cache area, each sequence containing program fragment position, instruction type, memory access mode, peripheral calling record and behavior context abstract field; step 4: the initial sliding window length is set, the behavior adaptability parameters of the power terminal are obtained, the behavior adaptability parameters include behavior record and key system resource parameters, the window adjustment index is obtained according to the behavior adaptability parameter evaluation, and whether the sliding window length adjustment is needed is judged according to the window adjustment index; step 5: if it is judged that the sliding window length adjustment is needed, the sliding window length is adjusted according to the window adjustment index, and the actual sliding window length is obtained; step 6: according to the actual sliding window length, the behavior subsequence is extracted from the behavior time sequence cache area according to the sliding window mode, the corresponding standard vector subset is screened from the code gene map library in combination with the behavior context abstract field, the vector similarity comparison is carried out, the behavior similarity is obtained, and whether the terminal code behavior abnormality occurs at present is judged according to the behavior similarity; step 7: if it is judged that the terminal code behavior abnormality occurs, the terminal code immunization protection is carried out according to the behavior similarity.

[0011] Preferably, the code gene profile library obtaining step is: for the function fragments, function label features are obtained by labeling the function labels according to the service types in the power terminal system; the function call relationship graph is generated by abstract syntax tree parsing of the function fragments using a static analysis tool, and the function call path features are obtained according to the function call relationship graph; the access analysis result is obtained by analyzing the global variable access behavior in the function fragments, and the global variable access dependency features are constructed according to the access analysis result; the function level control flow graph is constructed based on the intermediate code representation, the path enumeration is performed on the function level control flow graph, and the control flow structure features are extracted; the function label features, the function call path features, the global variable access dependency features and the control flow structure features are normalized and spliced to construct a complete behavior feature vector; one feature vector is generated for each function fragment, and the device model, the firmware version and the time stamp are bound, so as to finally construct the code gene profile library of the specific model power terminal.

[0012] Preferably, the window adjustment index obtaining step is: the behavior records in the initial sliding window are obtained, the behavior sliding window sequence is constructed, and the behavior complexity coefficient is obtained according to the behavior sliding window sequence; the key system resource parameters in the initial sliding window are obtained, and the terminal resource richness coefficient is obtained according to the key system resource parameters; the behavior complexity coefficient and the terminal resource richness coefficient are normalized, and the window adjustment index is obtained according to the normalized behavior complexity coefficient and the normalized terminal resource richness coefficient, and the specific obtaining steps are: ; wherein, the window adjustment index is represented as, the normalized behavior complexity coefficient is represented as, the normalized terminal resource richness coefficient is represented as, , the weight coefficient of the normalized behavior complexity coefficient and the weight coefficient of the normalized terminal resource richness coefficient are represented as.

[0013] Preferably, the behavior complexity coefficient obtaining step is: extracting all behavior records in the initial sliding window from the behavior time sequence cache area, each behavior record including instruction type code, program location identifier, memory access mode and peripheral call label, a total of four fields; calculating the information entropy value of each field respectively to obtain instruction type field entropy, program location field entropy, memory access mode field entropy and peripheral call field entropy; traversing two adjacent behavior records in the behavior sliding window sequence, judging whether the fields change item by item, if the fields change, recording as a jump event, accumulating the number of jumps, calculating the jump number and the total number of steps to obtain the behavior structure jump ratio; and calculating the behavior complexity coefficient according to the instruction type field entropy, the program location field entropy, the memory access mode field entropy, the peripheral call field entropy and the behavior structure jump ratio.

[0014] Preferably, the terminal resource richness coefficient obtaining step is: obtaining key system resource parameters in the initial sliding window during terminal running, the key system resource parameters including CPU occupancy rate sequence, memory remaining space sequence and I / O access waiting time sequence; calculating the average of the data in the CPU occupancy rate sequence to obtain the average CPU occupancy rate, subtracting the average CPU occupancy rate from 1 to obtain the CPU richness degree; calculating the total memory capacity, calculating the memory remaining proportion of each data in the memory remaining space sequence by the total memory capacity to obtain the memory remaining proportion, calculating the average of all memory remaining proportions to obtain the average memory remaining proportion; calculating the average of the data in the I / O access waiting time sequence to obtain the average waiting time, calculating the average waiting time in a reciprocal manner to obtain the waiting time reciprocal factor; calculating the terminal resource richness coefficient according to the CPU richness degree, the average memory remaining proportion and the waiting time reciprocal factor.

[0015] Preferably, the step of determining whether the sliding window length needs to be adjusted according to the window adjustment index is: comparing the window adjustment index with the adjustment threshold value, if the window adjustment index is greater than or equal to the adjustment threshold value, it is determined that the sliding window length needs to be adjusted; if the window adjustment index is less than the adjustment threshold value, it is determined that the sliding window length does not need to be adjusted.

[0016] Preferably, the actual sliding window length obtaining step is: calculating the adjustment factor by the ratio of the window adjustment index and the adjustment threshold value; calculating the product of the adjustment factor and the initial sliding window length to obtain the actual sliding window length.

[0017] Preferably, the behavior similarity obtaining step is: extracting current continuous behavior records from the behavior time sequence cache area according to the actual sliding window length, each record containing a plurality of structured fields, arranging and encoding the fields in time sequence into a vector form, denoted as a current behavior vector; according to the behavior context summary field to which the current behavior vector belongs, screening a standard vector subset with semantic consistency from the code gene map library; for the current behavior vector and each standard vector, calculating the cosine similarity; selecting the maximum value from all cosine similarities, denoted as the behavior similarity of the current behavior.

[0018] Preferably, the step of determining whether the terminal code behavior is abnormal according to the behavior similarity is: comparing the behavior similarity with a similarity threshold value, if the behavior similarity is greater than the similarity threshold value, it is determined that the terminal code behavior is not abnormal at present, and no terminal code immune protection is performed; if the behavior similarity is less than or equal to the similarity threshold value, it is determined that the terminal code behavior is abnormal at present.

[0019] Preferably, the step of performing terminal code immune protection according to the behavior similarity is: comparing the behavior similarity with an abnormal threshold value, if the behavior similarity is greater than or equal to the abnormal threshold value and less than the similarity threshold value, a primary warning response is issued, the data in the controlled memory area is locked, and the safe preset value is forced to return; if the behavior similarity is less than the abnormal threshold value, the terminal internal FPGA hardware fuse logic is called to enter the safe reconstruction mode.

[0020] Technical effects and advantages of the present application:

[0021] The code gene map library is constructed, the initial sliding window length is set, the behavior adaptability parameters of the power terminal are obtained, and the window adjustment index is evaluated to determine whether the sliding window length adjustment is needed, if it is determined that the sliding window length adjustment is needed, the sliding window length is adjusted according to the window adjustment index to obtain the actual sliding window length, the terminal code behavior abnormality is determined according to the actual sliding window length, if it is determined that the terminal code behavior is abnormal, the terminal code immune protection is performed according to the behavior similarity, and the real-time performance and accuracy of abnormal identification are effectively improved. BRIEF DESCRIPTION OF DRAWINGS

[0022] Figure 1 A power terminal dynamic code immune method flowchart based on a gene map is provided for the embodiments of the present application. DETAILED DESCRIPTION

[0023] The technical solutions in the present application will be described clearly and completely below in combination with the drawings in the present application. In addition, the forms of each structure described in the following embodiments are only examples, and the power terminal dynamic code immune method based on a gene map according to the present application is not limited to each structure described in the following embodiments. All other embodiments obtained by those skilled in the art without creative labor belong to the protection scope of the present application.

[0024] The present application provides a power terminal dynamic code immune method based on a gene map, as shown in the following steps: Figure 1

[0025] Step 1: In the initial deployment stage of the power terminal device, based on the static analysis of the firmware source code, the function fragments related to the key business processes are extracted. The key business includes but is not limited to: relay protection logic (such as differential protection, overcurrent protection), communication protocol processing (such as Modbus TCP, IEC 60870-5-104), device self-checking and remote upgrading module.

[0026] The above function fragments are constructed into behavior feature vectors according to the function labels, calling path structures, global variable usage modes and control flow diagrams, and the code gene map library is constructed according to the behavior feature vectors. The map serves as the basis for subsequent comparison and contains the structure identification, access dependencies and context constraints of each characteristic code. The code gene map library is composed of multiple standard vector subsets, each of which is composed of function labels, calling paths and context features to support fast screening and similarity analysis in the subsequent comparison stage.

[0027] In this embodiment, it needs to be specifically pointed out that the code gene map library acquisition step is:

[0028] For function fragments, the function label feature is obtained according to the business type in the power terminal system. The function label specifically includes but is not limited to: relay protection logic, communication protocol processing, self-checking and diagnosis logic, remote upgrade management, etc. The label can be determined by function name feature recognition, annotation semantic analysis, interface mapping table, etc., and is used for semantic classification of function behavior;

[0029] The abstract syntax tree of the function fragments is parsed by using a static analysis tool, the calling relationship between the function fragments is obtained, the function call relationship diagram is generated, and the function call path feature is obtained according to the function call relationship diagram;

[0030] ​An analysis is performed on the global variable access behavior in the function fragment to obtain an access analysis result, the access analysis result including an accessed variable name, an access type (read / write), an access order, and whether there is a shared access relationship with other functions. A global variable access dependency feature is constructed according to the access analysis result, providing data support for subsequent behavior tracing and abnormality identification.

[0031] A function-level control flow graph is constructed based on the intermediate code representation, used to depict the internal execution path structure of the function. Path enumeration is performed on the function-level control flow graph to extract control flow structure features.

[0032] The "intermediate code representation" refers to a standardized instruction expression form between a high-level language and machine code obtained by converting the source code through a compiler front end, commonly such as LLVMIR or GhidraPcode. The intermediate code retains the structure and data flow information of the original program, but removes the syntax differences related to specific platforms, and is suitable for program static analysis.

[0033] The function tag feature, function call path feature, global variable access dependency feature, and control flow structure feature are vector normalized and spliced to construct a complete behavior feature vector. The vector fields include function tag codes (such as 1 for communication processing and 2 for protection logic), call path sequence IDs, variable access matrices (function x variable read / write state), and control flow complexity indicators. Each function fragment generates a feature vector, which is bound to device model, firmware version, timestamp, and other meta information, and finally constructs a "code gene map library" of a specific model power terminal, which is used as a reference template in the subsequent behavior comparison stage.

[0034] Step 2: After the terminal starts, the integrated code dyeing engine performs dynamic patching operations on the loaded program modules. The patching positions include: function entry, key variable writing point, and peripheral access interface call. Dyeing marks are made at each patching point, denoted as a dyeing mark stream. The marks are attached to the execution path through register coding, local stack trace chain, or interrupt vector table annotation, without affecting the business logic, but can be captured by the behavior comparison engine.

[0035] The code dyeing engine is an embedded runtime analysis module that realizes behavior marking and instruction tracking of the terminal program execution path based on dynamic patching technology. The engine injects lightweight tracking logic at the function entry, key variable read / write point, and peripheral access instruction by patching the target binary or intermediate representation program. The patching forms include adding feature identification codes, execution path labels, or context reference indexes. The mark information is attached to the instruction execution path without changing the original program business logic. The dyeing information can be read by the subsequent behavior perception module to construct a program behavior time sequence, realize runtime behavior monitoring and abnormality identification.

[0036] Step 3: During the running of the terminal, real-time receive the dyeing mark stream, and cache it in time sequence to form a behavior time sequence cache area. Each sequence contains program segment position, instruction type, memory access mode, peripheral call record and behavior context abstract, etc. fields, which are used for subsequent sliding extraction of behavior comparison window;

[0037] The ordered cache structure of behavior marks is established to ensure the time sequence integrity and feature consistency of behavior data, providing high-quality input for sliding window analysis. Through the unified cache of multi-dimensional behavior fields, the subsequent sliding window comparison, context restoration and abnormal identification can be effectively supported, and the response accuracy and identification robustness of the system to complex behavior sequences are improved. The mechanism also provides continuous data support for dynamic window adjustment and behavior trend evaluation, which is a key basic link to realize real-time immune discrimination.

[0038] Step 4: Set the initial sliding window length, obtain the behavior adaptability parameters of the power terminal, the behavior adaptability parameters include behavior records and key system resource parameters, evaluate the window adjustment index according to the behavior adaptability parameters, and determine whether the sliding window length needs to be adjusted according to the window adjustment index;

[0039] In this embodiment, it needs to be specifically pointed out that the window adjustment index obtaining step is:

[0040] Obtain the behavior records in the initial sliding window, construct a behavior sliding window sequence, and evaluate the behavior complexity coefficient according to the behavior sliding window sequence;

[0041] Obtain the key system resource parameters in the initial sliding window, and evaluate the terminal resource abundance coefficient according to the key system resource parameters;

[0042] The behavior complexity coefficient and the terminal resource abundance coefficient are normalized, and the window adjustment index is evaluated according to the normalized behavior complexity coefficient and the terminal resource abundance coefficient, and the specific obtaining steps are:

[0043] ;

[0044] In the formula, is the window adjustment index, is the normalized behavior complexity coefficient, and when the code structure complexity of the current execution of the power terminal is higher, such as containing deep function nesting, frequent control flow jump or multi-path dependence, the system needs to expand the sliding window length to cover more sufficient behavior features and improve the accuracy of behavior similarity comparison. Through the positive correlation, the sliding window can be dynamically expanded according to the behavior complexity, enhancing the perception and identification ability of complex behavior segments, thereby improving the robustness and coverage rate of code anomaly detection, It is expressed as the terminal resource abundance coefficient after normalization. When the current system resources of the power terminal are relatively sufficient, such as low CPU usage, high memory idle rate or short I / O waiting time, the system has stronger processing capabilities and can handle behavioral analysis tasks with greater computational overhead. In this case, the sliding window length can be appropriately expanded to obtain staining behavior sequences over a longer period of time, thereby enhancing the recognition effect of complex behavior patterns and the utilization efficiency of time continuity features, and improving the accuracy and response precision of the overall immune detection. 、 It is expressed as the weight coefficient of the normalized behavior complexity coefficient and the weight coefficient of the normalized terminal resource abundance coefficient, and , 、 Obtained through AHP, e.g. 、 The value can be 0.6 or 0.4. The Analytic Hierarchy Process (AHP) is a weight determination method based on multi-factor decision-making theory. It constructs a comparative judgment matrix between the behavioral complexity coefficient and the system resource margin coefficient to calculate the relative importance of each factor in influencing the sliding window adjustment. This method combines expert experience or historical evaluation data with the eigenvalue method to solve for the weight vector. Consistency checks are performed to ensure the logical reliability of the judgment matrix, resulting in a weight distribution result used to calculate the window adjustment index.

[0045] In this embodiment, it should be specifically explained that the steps for obtaining the behavior complexity coefficient are:

[0046] Extract all behavior records within the initial sliding window from the behavior time series buffer and record them as a sequence , where n is the initial sliding window length, Indicates the i-th behavior record, each behavior record Including instruction type encoding , program location identifier , memory access mode and peripheral call tags , a total of four fields;

[0047] Calculate the information entropy value of each field separately to obtain the instruction type field entropy, program location field entropy, memory access mode field entropy and peripheral call field entropy;

[0048] The two adjacent behavior records in the behavior sliding window sequence are traversed, and whether the fields change is judged item by item. If the fields change, it is recorded as a jump event, the jump number is accumulated, the jump number is calculated by the total number of steps in the window, and the behavior structure jump ratio is obtained. The total number of steps in the window is the length of the sliding window minus one. It needs to be specifically pointed out that the judgment criterion for whether the fields change is: the instruction type code changes, the program position crosses different module areas or the peripheral call switches the device type, etc.

[0049] The behavior complexity coefficient is calculated according to the instruction type field entropy, the program position field entropy, the memory access mode field entropy, the peripheral call field entropy and the behavior structure jump ratio. The specific acquisition steps are:

[0050] ;

[0051] In the formula, The behavior complexity coefficient is represented as, The instruction type field entropy is represented as, The program position field entropy is represented as, The memory access mode field entropy is represented as, The peripheral call field entropy is represented as, The behavior structure jump ratio is represented as, The calculation of the behavior complexity coefficient is based on the multi-field dispersion degree and the structure jump frequency of the behavior record in the sliding window. Through the statistical value diversity of the instruction type, the program position, the memory access mode and the peripheral call in the program execution process, as well as the jump ratio of the behavior path between different modules, the dynamic change degree of the current behavior sequence is reflected. The higher the coefficient is, the more complex the behavior sequence structure of the terminal in the current running state is, the more unstable the path is, and the stronger the system dependence on the execution context information is.

[0052] In the embodiment, it needs to be specifically pointed out that the terminal resource richness coefficient acquisition step is:

[0053] In the terminal running process, the key system resource parameters in the initial sliding window are obtained, and the key system resource parameters include the CPU occupancy rate sequence, the memory remaining space sequence and the I / O access waiting time sequence.

[0054] The mean value of the data in the CPU occupancy rate sequence is calculated to obtain the average CPU occupancy rate. The average CPU occupancy rate is subtracted from 1 to obtain the CPU richness degree. The larger the value is, the more idle it is.

[0055] The total memory capacity is obtained, the data in the memory remaining space sequence is calculated by the total memory capacity, the memory remaining ratio is obtained, and the average memory remaining ratio is obtained by the mean value calculation of all memory remaining ratios.

[0056] The data in the I / O access waiting time sequence is mean calculated to obtain an average waiting time, and the average waiting time calculation is inversely proportional calculated to obtain a waiting time inverse factor. The I / O access waiting time reflects the data interaction delay between the terminal and the peripheral, and is an important index for measuring the smoothness of terminal resource scheduling. In this embodiment, the actual average waiting time in the current period is obtained by mean calculating the waiting time sequence, and the average waiting time is converted into a waiting time inverse factor by the inverse proportional calculation method, so that the longer the waiting time is, the smaller the inverse factor is, thereby accurately reflecting the existence of the I / O bottleneck in the overall resource richness evaluation. This processing method not only retains the sensitivity of the waiting time to the performance, but also avoids the interference caused by the amplification of the extreme value, improves the stability and discrimination accuracy of the resource evaluation model, and is beneficial to more reasonably guiding the sliding window adjustment strategy.

[0057] The balance coefficient is calculated according to the CPU assigned richness, the average memory remaining ratio and the waiting time inverse factor, and the specific obtaining steps are as follows:

[0058] ;

[0059] In the formula, is the balance coefficient, is the CPU assigned richness, is the average memory remaining ratio, is the waiting time inverse factor, is the resource state with the maximum value among the three resource indicators (CPU richness, memory remaining rate and I / O waiting time inverse factor) in the evaluation time window, which is used to identify the most rich resource dimension, is the resource state with the minimum value among the three resource indicators in the evaluation time window, which is used to identify the most stressed or most deviated resource dimension. In this embodiment, the difference between the maximum value and the minimum value in the three indicators is calculated, and then divided by the average value of the three indicators to obtain the relative difference degree of resource use, and the balance coefficient is constructed in the form of "1 minus the difference degree". The closer the coefficient is to 1, the more balanced the three types of resource states are; the closer the coefficient is to 0, the more single resource deviates abnormally. This method not only can find the implicit bottleneck of a certain resource, but also can avoid the misdirection of the overall judgment in the resource evaluation process due to a single rich item, and enhance the overall perception ability and robustness of the terminal sliding window adjustment mechanism to the resource use state;

[0060] The terminal resource richness coefficient is calculated according to the CPU assigned richness, the average memory remaining ratio, the waiting time inverse factor and the balance coefficient, and the specific obtaining steps are as follows:

[0061] ;

[0062] In the formula, is expressed as a terminal resource richness coefficient, is expressed as a CPU richness degree, is expressed as an average memory remaining ratio, is expressed as a waiting time inverse factor, is expressed as a balance coefficient, by directly summing the CPU richness degree, the memory remaining ratio, and the I / O waiting time inverse factor, and multiplying the sum by the resource balance coefficient, a comprehensive evaluation index is constructed, which reflects both the overall idle degree of resources and the coordination of resource use. This calculation method avoids using a weighting coefficient or an empirical model and has the characteristics of repeatability and quantifiability. When all three types of resources are rich and the use state is balanced, the coefficient value is the highest, indicating that the terminal has sufficient capacity to support higher complexity behavior analysis; if one resource is extremely tight or the difference between the three is significant, the coefficient value decreases, which helps to limit the sliding window expansion in time and ensure stable operation of the system.

[0063] In this embodiment, it needs to be specifically explained that the step of determining whether the sliding window length needs to be adjusted according to the window adjustment index is as follows:

[0064] The window adjustment index is compared with the adjustment threshold value. If the window adjustment index is greater than or equal to the adjustment threshold value, it is determined that the sliding window length needs to be adjusted. If the window adjustment index is less than the adjustment threshold value, it is determined that the sliding window length does not need to be adjusted. The adjustment threshold value is obtained by an adaptive threshold method, which is a method of dynamically setting the current determination threshold according to the statistical characteristics of the sliding window adjustment index in a historical time window. This method dynamically updates the determination threshold by calculating the historical average value and the standard deviation of the window adjustment index, and combines the current behavior fluctuation degree, to adapt to the behavior change sensitivity under different running states, thereby avoiding the misjudgment or response delay problem caused by the fixed threshold setting.

[0065] Step 5: If it is determined that the sliding window length needs to be adjusted, the sliding window length is adjusted according to the window adjustment index to obtain the actual sliding window length.

[0066] When the window adjustment index is greater than or equal to the adjustment threshold value, it means that the current running state of the terminal has exceeded the judgment limit of stable operation in terms of behavior complexity, resource margin, or behavior fluctuation, reflecting that the system's demand for behavior recognition granularity and context information has significantly increased. At this time, if the original window length is maintained, it may lead to insufficient behavior fragment information, which cannot accurately match the gene map, thereby reducing the sensitivity and accuracy of abnormal detection. Therefore, the sliding window length needs to be appropriately increased to introduce more rich execution context information, improve the coverage of comparison, and ensure the integrity of behavior pattern recognition and the accuracy of system immune response.

[0067] In this embodiment, it needs to be specifically pointed out that the actual sliding window length acquisition step is:

[0068] The window adjustment index is calculated by the ratio of the adjustment threshold to obtain the adjustment factor;

[0069] The adjustment factor is multiplied by the initial sliding window length to obtain the actual sliding window length.

[0070] By constructing the ratio of the window adjustment index and the adjustment threshold as the adjustment factor, and linearly scaling the initial sliding window length with this factor, the continuity, adaptability and proportional control of the sliding window length can be realized. Compared with the fixed step adjustment method, this method can realize fine-grained window dynamic adjustment according to the degree of change of the terminal running state, avoid misjudgment or waste of computing resources caused by too large or too small adjustment range, and improve the response accuracy of the immune system to behavior changes and the flexibility of resource scheduling. At the same time, on the basis of ensuring the consistency of the sliding window adjustment direction, the controllability of parameter adjustment and the transparency of formula logic are retained, which is convenient for subsequent embedded implementation and dynamic optimization.

[0071] Step 6: According to the actual sliding window length, the behavior subsequence is extracted from the current behavior time sequence cache area in the sliding window mode, the corresponding standard vector subset is screened from the code gene map library combined with the current behavior context summary field, the vector similarity is compared, the behavior similarity is obtained, and whether the terminal code behavior is abnormal is determined according to the behavior similarity;

[0072] In this embodiment, it needs to be specifically pointed out that the behavior similarity acquisition step is:

[0073] From the behavior time sequence cache area, the current continuous behavior record is extracted according to the actual sliding window length, each record contains a plurality of structured fields, and the structured fields include program position code, instruction type number, memory access mode code, peripheral call identification, etc. These fields are arranged in time sequence and coded into vector form, denoted as the current behavior vector;

[0074] According to the behavior context summary field to which the current behavior vector belongs, a standard vector subset with consistent semantics is screened from the code gene map library;

[0075] For the current behavior vector and each standard vector, the cosine similarity is calculated, and the value is closer to 1, indicating that the behavior is more similar;

[0076] The maximum value is selected from all cosine similarities, denoted as the behavior similarity of the current behavior.

[0077] In this embodiment, it needs to be specifically pointed out that the step of determining whether the terminal code behavior is abnormal according to the behavior similarity is:

[0078] The behavior similarity is compared with a similarity threshold value, if the behavior similarity is greater than the similarity threshold value, it is determined that the terminal code behavior is normal at present, and the terminal code immune protection is not performed; if the behavior similarity is less than or equal to the similarity threshold value, it is determined that the terminal code behavior is abnormal at present, and the similarity threshold value is obtained by an adaptive threshold method.

[0079] Step 7: If it is determined that the terminal code behavior is abnormal, the terminal code immune protection is performed according to the behavior similarity.

[0080] In the embodiment, it needs to be specifically explained that the terminal code immune protection step according to the behavior similarity is as follows:

[0081] The behavior similarity is compared with an abnormal threshold value, it needs to be explained that the abnormal threshold value is less than the similarity threshold value, if the behavior similarity is greater than or equal to the abnormal threshold value and less than the similarity threshold value, a primary warning response is sent, the data of the controlled memory area is locked, and the safe preset value is forced to return; if the behavior similarity is less than the abnormal threshold value, the terminal internal FPGA hardware fuse logic is called, and the safe reconstruction mode is entered.

[0082] The controlled memory area refers to a memory space of the terminal which can dynamically adjust the access permission at runtime, usually including memory blocks for communication processing, state caching and key intermediate data storage, and the write protection or access restriction can be realized by hardware or kernel mechanism.

[0083] The safe default value refers to that when the behavior of a certain code in the power terminal system is determined to be suspicious or slightly abnormal, the system cannot trust the real-time output generated by the code, in order to avoid abnormal expansion or interference with the control process, the system automatically returns a predefined, verified and fault-free alternative value.

[0084] The FPGA hardware fuse logic refers to a programmable logic control unit pre-deployed in the internal power terminal, when it is detected that the current code behavior similarity is lower than the set serious abnormal threshold value, a predefined hardware fuse process is triggered immediately. The process includes: suspending the instruction execution of the suspicious program area, resetting the selected controlled memory area or communication interface, cutting off the interaction path with the upper master station, restoring the firmware default state or starting the redundant shadow module, to realize the physical level isolation of the risk code.

[0085] Finally, the above only describes the preferred embodiments of the present application, and is not used to limit the present application, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0086] The above merely provides the specific implementation of the present application, but the protection scope of the present application is not limited to this. Any person skilled in the art can easily think of the changes or replacements within the technical range disclosed by the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for dynamic code immunization of power terminals based on gene maps, characterized in that: The following steps are involved: Step 1: During the initial deployment phase of the terminal, static analysis is performed based on the firmware source code to extract function snippets involved in key business processes. Behavioral feature vectors are constructed based on the function labels, call path structure, global variable usage, and control flow graphs. A code gene map library is then constructed based on the behavioral feature vectors. Step 2: After the terminal is started, the loaded program module is dynamically instrumented through the integrated code coloring engine, and a coloring mark is added at each insertion point, which is recorded as a coloring mark flow; Step 3: During the terminal operation, the dye mark stream is received in real time and cached in chronological order to form a behavior time series buffer. Each sequence contains the program fragment location, instruction type, memory access mode, peripheral call record, and behavior context summary fields; Step 4: Set the initial sliding window length and obtain the behavioral adaptability parameters of the power terminal. The behavioral adaptability parameters include behavioral records and key system resource parameters. The window adjustment index is evaluated based on the behavioral adaptability parameters. The window adjustment index is used to determine whether the sliding window length needs to be adjusted. Step 5: If it is determined that the sliding window length needs to be adjusted, the sliding window length is adjusted according to the window adjustment index to obtain the actual sliding window length; Step 6: Based on the actual sliding window length, extract the behavior subsequence from the behavior time series buffer using a sliding window method. Combined with the behavior context summary field, select the corresponding standard vector subset from the code gene map library, perform vector similarity comparison, and obtain the behavior similarity. Based on the behavior similarity, determine whether the terminal code behavior is currently abnormal. Step 7: If it is determined that the terminal code behavior is abnormal, terminal code immunization protection is performed based on the behavior similarity.

2. The method for dynamic code immunization of power terminals based on gene maps according to claim 1, characterized in that: The steps for obtaining the code gene atlas library are: For function fragments, function labels are annotated according to the business type in the power terminal system to obtain function label features; Use static analysis tools to parse the abstract syntax tree of function fragments, obtain the calling relationship between each function fragment, generate a function call relationship graph, and obtain the function call path characteristics based on the function call relationship graph; Analyze the global variable access behavior in the function fragment, obtain the access analysis results, and construct the global variable access dependency characteristics based on the access analysis results; Construct a function-level control flow graph based on the intermediate code representation, enumerate the execution paths of the function-level control flow graph, and extract the control flow structure features; Perform vector normalization and splicing on function label features, function call path features, global variable access dependency features, and control flow structure features to construct a complete behavior feature vector; Each function fragment generates a feature vector and is bound to the device model, firmware version, and timestamp, ultimately constructing a code gene map library for a specific model of power terminal.

3. The method for dynamic code immunization of power terminals based on gene maps according to claim 2 is characterized in that: The steps for obtaining the window adjustment index are as follows: Obtain behavior records within the initial sliding window, construct a behavior sliding window sequence, and evaluate the behavior sliding window sequence to obtain the behavior complexity coefficient; Obtain key system resource parameters within the initial sliding window, and obtain the terminal resource abundance coefficient based on the key system resource parameters; The behavior complexity coefficient and the terminal resource abundance coefficient are normalized, and the window adjustment index is obtained based on the normalized behavior complexity coefficient and the terminal resource abundance coefficient. The specific steps for obtaining the index are as follows: ； Where, Expressed as a window adjustment index, Expressed as the normalized behavioral complexity coefficient, It is expressed as the terminal resource abundance coefficient after normalization. 、 It is expressed as the weight coefficient of the normalized behavior complexity coefficient and the weight coefficient of the normalized terminal resource abundance coefficient.

4. The method for dynamic code immunization of power terminals based on gene maps according to claim 3 is characterized in that: The steps for obtaining the behavior complexity coefficient are: Extract all behavior records within the initial sliding window from the behavior time series buffer. Each behavior record includes four fields: instruction type code, program location identifier, memory access mode, and peripheral call tag. Calculate the information entropy value of each field separately to obtain the instruction type field entropy, program location field entropy, memory access mode field entropy and peripheral call field entropy; Traverse two adjacent behavior records in the behavior sliding window sequence and determine whether their fields have changed item by item. If the field has changed, it is recorded as a jump event. The number of jumps is accumulated and the ratio of the jump number to the total number of window steps is calculated to obtain the behavior structure jump ratio. The behavioral complexity coefficient is calculated based on the instruction type field entropy, program location field entropy, memory access mode field entropy, peripheral call field entropy and behavioral structure jump ratio.

5. The method for dynamic code immunization of power terminals based on gene maps according to claim 3 is characterized by: The steps for obtaining the terminal resource abundance coefficient are as follows: During the terminal operation, key system resource parameters within the initial sliding window are obtained. The key system resource parameters include a CPU usage sequence, a memory remaining space sequence, and an I / O access waiting time sequence. Calculate the mean of the data in the CPU usage sequence to get the average CPU usage, and subtract the average CPU usage from 1 to get the CPU abundance. Get the total memory capacity, calculate the ratio of each data in the memory remaining space sequence to the total memory capacity to obtain the memory remaining ratio, and calculate the average of all memory remaining ratios to obtain the average memory remaining ratio; The data in the I / O access waiting time series are averaged to obtain the average waiting time, and the average waiting time is normalized and inversely proportional to obtain the waiting time inverse factor. The balance coefficient is calculated based on the CPU abundance, average memory surplus ratio and the inverse factor of the waiting time; The terminal resource abundance coefficient is calculated based on the CPU abundance, average memory remaining ratio, waiting time inverse factor and balance coefficient.

6. The method for dynamic code immunization of power terminals based on gene maps according to claim 1, characterized in that: The step of determining whether the sliding window length needs to be adjusted according to the window adjustment index is as follows: The window adjustment index is compared with the adjustment threshold. If the window adjustment index is greater than or equal to the adjustment threshold, it is determined that the sliding window length adjustment is required; if the window adjustment index is less than the adjustment threshold, it is determined that the sliding window length adjustment is not required.

7. The method for dynamic code immunization of power terminals based on gene maps according to claim 6, characterized in that: The actual sliding window length acquisition step is: Calculate the ratio of the window adjustment index to the adjustment threshold to obtain the adjustment factor; The actual sliding window length is obtained by multiplying the adjustment factor by the initial sliding window length.

8. The method for dynamic code immunization of power terminals based on gene maps according to claim 1, characterized in that: The steps for obtaining the behavior similarity are: Extract the current continuous behavior records from the behavior time series buffer according to the actual sliding window length. Each record contains several structured fields. Arrange these fields in chronological order and encode them into a vector form, which is recorded as the current behavior vector. According to the behavior context summary field to which the current behavior vector belongs, a standard vector subset with semantic consistency is screened from the code gene map library; For the current behavior vector and each standard vector, calculate the cosine similarity; The maximum value is selected from all cosine similarities and recorded as the behavior similarity of the current behavior.

9. The method for dynamic code immunization of power terminals based on gene maps according to claim 5, characterized in that: The steps of determining whether the terminal code behavior is abnormal based on the behavior similarity are as follows: The behavior similarity is compared with the similarity threshold. If the behavior similarity is greater than the similarity threshold, it is determined that no terminal code behavior abnormality has occurred, and terminal code immunization protection is not performed; if the behavior similarity is less than or equal to the similarity threshold, it is determined that the terminal code behavior abnormality has occurred.

10. The method for dynamic code immunization of power terminals based on gene maps according to claim 1, characterized in that: The steps for performing terminal code immunization protection based on behavior similarity are: The behavior similarity is compared with the abnormality threshold. If the behavior similarity is greater than or equal to the abnormality threshold and less than the similarity threshold, a primary warning response is issued, the data in the controlled memory area is locked, and the safe preset value is forced to return; if the behavior similarity is less than the abnormality threshold, the terminal's internal FPGA hardware fuse logic is called to enter the safe reconstruction mode.

Images