A gene map-based dynamic code immunization method for power terminal

Abstract

The application relates to the technical field of power terminal protection, and discloses a power terminal dynamic code immunization method based on a gene map, which is used for solving the problem that the original sliding time window length is no longer representative when power terminal immunization protection is carried out, and comprises the following steps: constructing a code gene map library, setting an initial sliding window length, obtaining behavior adaptability parameters of the power terminal, and evaluating a window adjustment index to determine whether the sliding window length needs to be adjusted; if it is determined that the sliding window length needs to be adjusted, the sliding window length is adjusted according to the window adjustment index to obtain an actual sliding window length; and terminal code behavior anomaly is judged according to the actual sliding window length; if it is determined that terminal code behavior anomaly occurs, terminal code immunization protection is carried out according to behavior similarity, and the real-time performance and the accuracy of abnormal identification are effectively improved.

Description

Technical Field

[0001] This invention relates to the field of power terminal protection technology, and more specifically to a dynamic code immunization method for power terminals based on gene mapping. Background Technology

[0002] With the continuous advancement of power system digitalization, embedded power terminal equipment is widely deployed in key links such as power transmission, substation, and distribution. These terminals include relay protection devices, intelligent measurement and control units, and communication management modules, typically undertaking core business functions such as protection execution, remote control, and dispatch communication. To ensure the reliability of power terminal behavior during operation and prevent unauthorized code from tampering with operating logic or interfering with control processes, building runtime security mechanisms for embedded software has become a key technical direction for ensuring the stable operation of secondary systems.

[0003] To enable power terminals to identify and respond to illegal code behavior, existing technologies typically employ static whitelist mechanisms or signature matching mechanisms. These mechanisms verify the identity and legitimacy of code fragments before the program is loaded or executed, thereby preventing the execution of unauthorized code.

[0004] However, the above-mentioned technologies have at least the following technical problems:

[0005] In real-world operating environments, the software running on power terminals is highly customized, containing a large amount of industry-specific logic related to communication protocols, relay protection algorithms, and custom state machines. This makes traditional mechanisms based on static whitelists or signature matching insufficient to fully cover all legitimate behavioral paths of the terminal in different business scenarios. Furthermore, the terminal's operation is often accompanied by dynamic behaviors such as remote configuration loading, command-triggered responses, and bootstrapping updates, making the code execution flow highly variable and context-dependent, further exacerbating the blind spots of static rule-based identification methods.

[0006] Even though some existing solutions have introduced a sliding window-based runtime behavior detection mechanism, the analysis window is usually of a fixed length, which makes it difficult to adapt to the frequent switching of behavior patterns from a stable state to sudden disturbances. This can easily lead to misjudgment due to insufficient context information or failure of protection due to delayed response, thus limiting the real-time performance and accuracy of abnormal behavior identification.

[0007] On the other hand, existing embedded security solutions mostly focus on static file authentication or peripheral access control, lacking dynamic perception and anomaly comparison mechanisms for program execution paths. They are unable to identify nested illegal instructions or spoofing communication behaviors within legitimate entry points. Furthermore, when potential abnormal behavior is detected, traditional solutions often only log or trigger alarms, failing to promptly interrupt high-risk behavior paths and easily missing critical response windows. This not only affects system operational stability but may also lead to serious consequences such as relay protection malfunctions, remote control channel failures, and abnormal voltage regulation, thereby compromising the operational reliability and safety redundancy of the power system. Summary of the Invention

[0008] In order to overcome the above-mentioned defects of the prior art, the present invention provides a dynamic code immunization method for power terminals based on gene maps, so as to solve the problems existing in the background art.

[0009] To achieve the above objectives, the present invention provides the following technical solution:

[0010] A dynamic code immunity method for power terminals based on gene maps includes the following steps: Step 1: In the initial deployment phase of the terminal, static analysis is performed based on the firmware source code to extract function fragments involving key business processes. Behavioral feature vectors are constructed from these function fragments based on function tags, call path structures, global variable usage, and control flow graphs. A code gene map library is then constructed based on these behavioral feature vectors. Step 2: After the terminal starts, the loaded program modules are dynamically instrumented using an integrated code coloring engine. Each instrumentation point is marked with a coloring mark, referred to as a coloring mark stream. Step 3: During terminal operation, the coloring mark stream is received in real time and cached sequentially according to time sequence, forming a behavioral time series cache. Each sequence contains program fragment location, instruction type, memory access mode, peripheral call records, and a behavioral context summary field. Step 4: Initial... Step 5: If the sliding window length needs adjustment, adjust the sliding window length according to the window adjustment index to obtain the actual sliding window length. Step 6: Based on the actual sliding window length, extract the behavior subsequence from the behavior time series cache using the sliding window method. Combine the behavior context summary field with the corresponding standard vector subset selected from the code gene map library, perform vector similarity comparison to obtain the behavior similarity, and determine whether the terminal code behavior is abnormal based on the behavior similarity. Step 7: If the terminal code behavior is abnormal, perform terminal code immunity protection based on the behavior similarity.

[0011] Preferably, the code gene map library acquisition steps are as follows: For function fragments, function tags are marked according to the service type in the power terminal system to obtain function tag features; static analysis tools are used to perform abstract syntax tree parsing on the function fragments to obtain the call relationships between each function fragment, generate a function call relationship graph, and obtain function call path features based on the function call relationship graph; the global variable access behavior in the function fragments is analyzed to obtain access analysis results, and global variable access dependency features are constructed based on the access analysis results; a function-level control flow graph is constructed based on the intermediate code representation, and the execution path of the function-level control flow graph is enumerated to extract control flow structure features; the function tag features, function call path features, global variable access dependency features, and control flow structure features are vectorized and concatenated to construct a complete behavior feature vector; a feature vector is generated for each function fragment and bound to the device model, firmware version, and timestamp, ultimately constructing a code gene map library for a specific type of power terminal.

[0012] Preferably, the step of obtaining the window adjustment index is as follows: acquiring behavior records within the initial sliding window, constructing a behavior sliding window sequence, and evaluating the behavior complexity coefficient based on the behavior sliding window sequence; acquiring key system resource parameters within the initial sliding window, and evaluating the terminal resource abundance coefficient based on the key system resource parameters; normalizing the behavior complexity coefficient and the terminal resource abundance coefficient, and evaluating the window adjustment index based on the normalized behavior complexity coefficient and the terminal resource abundance coefficient. The specific steps are as follows: In the formula, This is represented as the window adjustment index. Represented as the normalized behavioral complexity coefficient. This is expressed as the normalized terminal resource abundance coefficient. , This represents the weighting coefficients of the normalized behavioral complexity coefficient and the normalized terminal resource abundance coefficient.

[0013] Preferably, the step of obtaining the behavior complexity coefficient is as follows: extract all behavior records within the initial sliding window from the behavior time series buffer. Each behavior record includes four fields: instruction type code, program location identifier, memory access mode, and peripheral call label. Calculate the information entropy value of each field to obtain the instruction type field entropy, program location field entropy, memory access mode field entropy, and peripheral call field entropy. Traverse two adjacent behavior records in the behavior sliding window sequence and determine whether their fields have changed. If a field changes, it is recorded as a jump event. Accumulate the number of jumps and calculate the ratio of the number of jumps to the total number of window steps to obtain the behavior structure jump ratio. Calculate the behavior complexity coefficient based on the instruction type field entropy, program location field entropy, memory access mode field entropy, peripheral call field entropy, and behavior structure jump ratio.

[0014] Preferably, the step of obtaining the terminal resource abundance coefficient is as follows: During terminal operation, key system resource parameters within the initial sliding window are obtained. These key system resource parameters include a CPU utilization rate sequence, a memory remaining space sequence, and an I / O access wait time sequence. The average CPU utilization rate is calculated by averaging the data in the CPU utilization rate sequence. The CPU abundance rate is obtained by subtracting the average CPU utilization rate from 1. The total memory capacity is obtained. The ratio of each data point in the memory remaining space sequence to the total memory capacity is calculated to obtain the memory remaining ratio. The average memory remaining ratio is calculated by averaging all memory remaining ratios to obtain the average memory remaining ratio. The average waiting time is calculated by averaging the data in the I / O access wait time sequence to obtain the average waiting time. The average waiting time is then normalized and inversely proportional to obtain the waiting time inverse factor. The balance coefficient is calculated based on the CPU abundance rate, the average memory remaining ratio, and the waiting time inverse factor. Finally, the terminal resource abundance coefficient is calculated based on the CPU abundance rate, the average memory remaining ratio, the waiting time inverse factor, and the balance coefficient.

[0015] Preferably, the step of determining whether to adjust the sliding window length based on the window adjustment index is as follows: compare the window adjustment index with the adjustment threshold; if the window adjustment index is greater than or equal to the adjustment threshold, it is determined that the sliding window length needs to be adjusted; if the window adjustment index is less than the adjustment threshold, it is determined that the sliding window length does not need to be adjusted.

[0016] Preferably, the step of obtaining the actual sliding window length is as follows: calculate the ratio of the window adjustment index to the adjustment threshold to obtain the adjustment factor; multiply the adjustment factor by the initial sliding window length to obtain the actual sliding window length.

[0017] Preferably, the behavior similarity acquisition step is as follows: extract the current continuous behavior records from the behavior time series cache according to the actual sliding window length. Each record contains several structured fields. Arrange these fields in chronological order and encode them into a vector form, which is denoted as the current behavior vector. Based on the behavior context summary field to which the current behavior vector belongs, select a subset of standard vectors with semantic consistency from the code gene map library. For the current behavior vector and each standard vector, calculate the cosine similarity. Select the maximum value from all cosine similarities and denot it as the behavior similarity of the current behavior.

[0018] Preferably, the step of determining whether terminal code behavior abnormality has occurred based on behavior similarity is as follows: comparing behavior similarity with a similarity threshold; if behavior similarity is greater than the similarity threshold, it is determined that no terminal code behavior abnormality has occurred and terminal code immunity protection is not performed; if behavior similarity is less than or equal to the similarity threshold, it is determined that terminal code behavior abnormality has occurred.

[0019] Preferably, the step of performing terminal code immunity protection based on behavior similarity is as follows: comparing behavior similarity with an anomaly threshold; if behavior similarity is greater than or equal to the anomaly threshold but less than the similarity threshold, a primary warning response is issued, the controlled memory area data is locked, and a security preset value is forcibly returned; if behavior similarity is less than the anomaly threshold, the terminal's internal FPGA hardware circuit breaker logic is invoked to enter a security reconstruction mode.

[0020] The technical effects and advantages of this invention are as follows:

[0021] A code gene map library is constructed, an initial sliding window length is set, behavioral adaptability parameters of power terminals are obtained, and a window adjustment index is evaluated to determine whether the sliding window length needs to be adjusted. If the sliding window length needs to be adjusted, the sliding window length is adjusted according to the window adjustment index to obtain the actual sliding window length. Based on the actual sliding window length, terminal code behavior anomaly judgment is performed. If terminal code behavior anomaly is detected, terminal code immune protection is performed based on behavior similarity, effectively improving the real-time performance and accuracy of anomaly identification. Attached Figure Description

[0022] Figure 1 A flowchart of a dynamic code immunization method for power terminals based on gene mapping is provided for an embodiment of this application. Detailed Implementation

[0023] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. In addition, the morphology of each structure described in the following embodiments is merely illustrative. The dynamic code immunity method for power terminals based on gene maps involved in the present invention is not limited to the structures described in the following embodiments. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] This invention provides a dynamic code immunization method for power terminals based on gene mapping, such as... Figure 1 As shown, it includes the following steps:

[0025] Step 1: During the initial deployment phase of the power terminal equipment, perform static analysis based on its firmware source code to extract function fragments involving key business processes. These key business processes include, but are not limited to: relay protection logic (such as differential protection and overcurrent protection), communication protocol processing (such as Modbus TCP and IEC 60870-5-104), and equipment self-testing and remote upgrade modules.

[0026] The aforementioned function fragments are used to construct behavioral feature vectors based on their function labels, call path structure, global variable usage, and control flow graph. A code gene map library is then constructed based on these behavioral feature vectors. This map serves as the basis for subsequent comparisons and includes the structural identifier, access dependencies, and contextual constraints for each feature code segment. The code gene map library consists of multiple standard vector subsets, each composed of function labels, call paths, and contextual features, to support rapid filtering and similarity analysis in subsequent comparison stages.

[0027] In this embodiment, it should be specifically explained that the steps for obtaining the code gene map library are as follows:

[0028] For function fragments, functional labels are assigned based on the service type in the power terminal system to obtain functional label characteristics. Functional labels specifically include, but are not limited to: relay protection logic, communication protocol processing, self-testing and diagnostic logic, and remote upgrade management. Labels can be determined through function name feature recognition, annotation semantic analysis, and interface mapping tables, and are used for semantic classification of function behavior.

[0029] Static analysis tools are used to perform abstract syntax tree parsing on function fragments to obtain the call relationships between function fragments, generate a function call relationship graph, and obtain the function call path characteristics based on the function call relationship graph.

[0030] The access behavior of global variables in function fragments is analyzed to obtain access analysis results, including the names of accessed variables, access types (read / write), access order, and whether there are shared access relationships with other functions. Based on the access analysis results, global variable access dependency features are constructed to provide data support for subsequent behavior tracing and anomaly identification.

[0031] Based on intermediate code representation, a function-level control flow graph is constructed to characterize the internal execution path structure of a function. The execution path of the function-level control flow graph is enumerated to extract control flow structure features.

[0032] The "intermediate code representation" refers to a standardized instruction expression form that lies between high-level language and machine code, obtained by converting source code through a compiler front-end. Common examples include LLVMIR or GhidraPcode. This intermediate code retains the structure and data flow information of the original program but removes platform-specific syntactic differences, making it suitable for static program analysis.

[0033] Functional label features, function call path features, global variable access dependency features, and control flow structure features are vectorized and concatenated to construct a complete behavioral feature vector. Vector fields include functional label encoding (e.g., 1 for communication processing, 2 for protection logic), call path sequence ID, variable access matrix (function × variable read / write status), and control flow complexity index. Each function fragment generates a feature vector and binds it to metadata such as device model, firmware version, and timestamp. This ultimately constructs a "code gene map library" for a specific type of power terminal, serving as a reference template for subsequent behavior comparison stages.

[0034] Step 2: After the terminal starts, the integrated code coloring engine dynamically instrumentes the loaded program modules. Instrumentation locations include function entry points, key variable write points, and peripheral access interface call points. Each instrumentation point is marked with a coloring mark, denoted as a coloring mark stream. This mark is attached to the execution path through register encoding, local stack tracing chains, or interrupt vector table comments, etc. It does not affect business logic but can be captured by the behavior comparison engine.

[0035] The code coloring engine is an embedded runtime analysis module that uses dynamic instrumentation technology to mark behavior and trace instructions along the execution path of a terminal program. This engine injects lightweight tracing logic into function entry points, critical variable read / write points, and peripheral access instructions by instrumenting the target binary or intermediate representation program. Instrumentation methods include adding feature identifiers, execution path labels, or context reference indexes. This marking information is appended to the instruction execution path without altering the original program's business logic. The coloring information can be read by a subsequent behavior awareness module to construct a program behavior time series, enabling runtime behavior monitoring and anomaly identification.

[0036] Step 3: During terminal operation, the colored marker stream is received in real time and cached sequentially according to time order to form a behavior time series cache. Each sequence contains fields such as program segment location, instruction type, memory access mode, peripheral call record, and behavior context summary, which are used for subsequent sliding extraction in the behavior comparison window;

[0037] An ordered caching structure for behavioral tags is established to ensure the temporal integrity and feature consistency of behavioral data, providing high-quality input for sliding window analysis. Unified caching of multi-dimensional behavioral fields effectively supports subsequent sliding window comparisons, context reconstruction, and anomaly detection, improving the system's response accuracy and robustness to complex behavioral sequences. This mechanism also provides continuous data support for dynamic window adjustment and behavioral trend assessment, serving as a crucial foundation for real-time immune discrimination.

[0038] Step 4: Set the initial sliding window length, obtain the behavioral adaptation parameters of the power terminal, including behavioral records and key system resource parameters, evaluate the window adjustment index based on the behavioral adaptation parameters, and determine whether the sliding window length needs to be adjusted based on the window adjustment index.

[0039] In this embodiment, it should be specifically explained that the window adjustment index acquisition step is as follows:

[0040] Within the initial sliding window, acquire behavior records, construct a behavior sliding window sequence, and evaluate the behavior complexity coefficient based on the behavior sliding window sequence.

[0041] Within the initial sliding window, key system resource parameters are obtained, and the terminal resource abundance coefficient is evaluated based on the key system resource parameters.

[0042] The behavioral complexity coefficient and the terminal resource abundance coefficient are normalized. The window adjustment index is then evaluated based on the normalized behavioral complexity coefficient and the terminal resource abundance coefficient. The specific steps for obtaining the index are as follows:

[0043] ;

[0044] In the formula, This is represented as the window adjustment index. This represents the normalized behavioral complexity coefficient. When the complexity of the code structure currently being executed by the power terminal increases—such as containing deep function nesting, frequent control flow jumps, or multiple path dependencies—the system needs to increase the sliding window length to cover more behavioral features and improve the accuracy of behavioral similarity comparison. Through this positive correlation, the sliding window can dynamically expand according to the degree of behavioral complexity, enhancing the perception and recognition of complex behavioral fragments, thereby improving the robustness and coverage of code anomaly detection. This represents the normalized terminal resource abundance coefficient. When the power terminal's current system resources are relatively abundant, such as low CPU utilization, high memory idle rate, or short I / O wait time, the system has stronger processing capabilities and can handle behavioral analysis tasks with greater computational overhead. In this case, the sliding window length can be appropriately increased to obtain staining behavior sequences over a longer time period, thereby enhancing the recognition effect of complex behavioral patterns and the utilization efficiency of temporal continuity features, and improving the overall accuracy and response precision of immune detection. , This represents the weighting coefficients of the normalized behavioral complexity coefficient and the normalized terminal resource abundance coefficient, and... , , Obtained through the analytic hierarchy process, for example , The values ​​can be 0.6 or 0.4. The Analytic Hierarchy Process (AHP) is a weight determination method based on multi-factor decision theory. It calculates the relative importance weights of each factor influencing the sliding window adjustment by constructing a comparison judgment matrix between the behavioral complexity coefficient and the system resource margin coefficient. This method combines expert experience or historical evaluation data, uses the eigenvalue method to solve for the weight vector, and ensures the logical reliability of the judgment matrix through consistency checks, thereby obtaining the weight allocation results used to calculate the window adjustment index.

[0045] In this embodiment, it should be specifically explained that the steps for obtaining the behavioral complexity coefficient are as follows:

[0046] Extract all behavior records within the initial sliding window from the behavior time series buffer, denoted as the sequence. Where n is the initial sliding window length, This represents the i-th behavior record, and each behavior record... Including instruction type encoding Program location identifier Memory access mode and peripheral call tags There are four fields in total;

[0047] Calculate the information entropy value of each field to obtain the instruction type field entropy, program location field entropy, memory access mode field entropy, and peripheral call field entropy.

[0048] The algorithm iterates through adjacent behavior records in the behavior sliding window sequence, checking each record for changes in its fields. If a field changes, it's recorded as a jump event. The cumulative jump count is calculated, and the ratio of this count to the total number of window steps yields the behavior structure jump ratio. The total number of window steps is the sliding window length minus one. Specifically, the criteria for determining whether a field has changed include: changes in instruction type encoding, whether the program location crosses different module regions, or whether peripheral calls switch device types, etc.

[0049] The behavioral complexity coefficient is calculated based on the instruction type field entropy, program location field entropy, memory access mode field entropy, peripheral call field entropy, and behavioral structure jump ratio. The specific steps for obtaining this coefficient are as follows:

[0050] ;

[0051] In the formula, Represented as the behavioral complexity coefficient, Represented as the instruction type field entropy, Represented as program location field entropy, Represented as the memory access pattern field entropy, This is represented as the entropy field of the peripheral device call. This represents the proportion of behavioral structure jumps. The behavioral complexity coefficient is calculated based on two factors: the dispersion of multiple fields in the behavioral record within the sliding window and the frequency of structural jumps. It reflects the dynamic variability of the current behavioral sequence by statistically analyzing the diversity of values ​​for behavioral fields such as instruction type, program location, memory access mode, and peripheral calls during program execution, as well as the jump proportion of the behavioral path between different modules. The higher the coefficient, the more complex the behavioral sequence structure and the more unstable the path in the current running state of the terminal, and the stronger the system's dependence on execution context information.

[0052] In this embodiment, it should be specifically explained that the steps for obtaining the terminal resource abundance coefficient are as follows:

[0053] During terminal operation, key system resource parameters within the initial sliding window are obtained. These key system resource parameters include CPU utilization sequence, memory remaining space sequence, and I / O access wait time sequence.

[0054] The average CPU utilization rate is calculated by averaging the data within the CPU utilization rate sequence. The CPU availability is obtained by subtracting the average CPU utilization rate from 1. The larger the value, the more idle the CPU is.

[0055] Get the total memory capacity, calculate the ratio of each data in the memory remaining space sequence to the total memory capacity to get the memory remaining ratio, and calculate the average memory remaining ratio of all memory remaining ratios.

[0056] The average waiting time is calculated by averaging the data in the I / O access waiting time series. Then, a normalized inverse proportion calculation is performed on this average waiting time to obtain a waiting time inverse proportion factor. I / O access waiting time reflects the data interaction latency between the terminal and peripherals and is an important indicator for measuring the smoothness of terminal resource scheduling. This embodiment calculates the average waiting time within the current time period by averaging the waiting time series and converts it into a waiting time inverse proportion factor using a normalized inverse proportion calculation method. The longer the waiting time, the smaller the inverse proportion factor, thus accurately reflecting the existence of I / O bottlenecks in the overall resource abundance assessment. This processing method retains the sensitivity of waiting time to performance while avoiding interference from extreme value amplification, improving the stability and accuracy of the resource assessment model and facilitating more reasonable guidance for sliding window adjustment strategies.

[0057] The balance coefficient is calculated based on CPU sufficiency, average remaining memory ratio, and inverse waiting time factor. The specific steps for obtaining the coefficient are as follows:

[0058] ;

[0059] In the formula, Represented as the balance coefficient, This represents the CPU's slack. This is expressed as the average percentage of memory remaining. This is expressed as an inverse factor for waiting time. This indicates the resource status with the highest value among the three resource metrics (CPU abundance, memory availability, and I / O wait time inverse factor) within the evaluation time window, used to identify the resource dimension with the most abundant resources. This indicates the resource state with the lowest value among the three resource indicators within the evaluation time window. It is used to identify the most strained or most unbalanced resource dimension. In this embodiment, the difference between the maximum and minimum values ​​of these three indicators is calculated, and then divided by the average of the three indicators to obtain the relative difference in resource usage. A positive balance coefficient is constructed using the method of "1 minus the difference coefficient". The closer this coefficient is to 1, the more balanced the three resource states are; the closer it is to 0, the more likely there is an abnormal deviation in a single resource. This method can not only discover hidden bottlenecks in a certain resource, but also avoid misleading the overall judgment during resource evaluation due to a single surplus item, enhancing the terminal sliding window adjustment mechanism's overall perception and robustness of resource usage status.

[0060] The terminal resource abundance coefficient is calculated based on CPU resource abundance, average remaining memory ratio, inverse waiting time factor, and balance coefficient. The specific steps for obtaining this coefficient are as follows:

[0061] ;

[0062] In the formula, This is expressed as the terminal resource abundance coefficient. This represents the CPU's slack. This is expressed as the average percentage of memory remaining. This is expressed as an inverse factor for waiting time. The resource balance coefficient is represented by a summation of three resource indicators—CPU sufficiency, memory availability, and I / O latency inverse factor—and multiplied by the resource balance coefficient. This constructs a comprehensive evaluation index that reflects both the overall resource availability and the coordination of resource usage. This calculation method avoids the use of weighted coefficients or empirical models, and is repeatable and quantifiable. The coefficient is highest when all three types of resources are abundant and their usage is balanced, indicating that the terminal has sufficient capacity to support more complex behavioral analysis. If one resource is extremely scarce or the differences among the three are significant, the coefficient decreases, which helps to limit sliding window expansion in a timely manner and ensure stable system operation.

[0063] In this embodiment, it should be specifically explained that the step of determining whether to adjust the sliding window length based on the window adjustment index is as follows:

[0064] The window adjustment index is compared with an adjustment threshold. If the window adjustment index is greater than or equal to the adjustment threshold, it is determined that the sliding window length needs to be adjusted; if the window adjustment index is less than the adjustment threshold, it is determined that the sliding window length does not need to be adjusted. The adjustment threshold is obtained through an adaptive threshold method, which refers to a method of dynamically setting the current judgment threshold based on the statistical characteristics of the sliding window adjustment index over a historical time window. This method calculates the historical average and standard deviation of the window adjustment index and combines them with the current degree of behavioral fluctuation to dynamically update the judgment threshold, adapting to the sensitivity of behavioral changes under different operating conditions, thereby avoiding misjudgment or response lag problems caused by fixed threshold settings.

[0065] Step 5: If it is determined that the sliding window length needs to be adjusted, the sliding window length is adjusted according to the window adjustment index to obtain the actual sliding window length;

[0066] When the window adjustment index is greater than or equal to the adjustment threshold, it indicates that the terminal's current operating state has exceeded the judgment limit for stable operation in terms of behavioral complexity, resource adequacy, or behavioral volatility, reflecting a significantly increased demand for granular behavior recognition and contextual information. Maintaining the original window length at this point may result in insufficient behavioral fragment information, making accurate matching of gene maps impossible, thereby reducing the sensitivity and accuracy of anomaly detection. Therefore, the sliding window length needs to be appropriately increased to introduce richer execution context information, improve comparison coverage, and ensure the integrity of behavioral pattern recognition and the accuracy of the system's immune response.

[0067] In this embodiment, it should be specifically explained that the actual sliding window length acquisition step is as follows:

[0068] The adjustment factor is obtained by calculating the ratio of the window adjustment index to the adjustment threshold;

[0069] The actual sliding window length is obtained by multiplying the adjustment factor by the initial sliding window length.

[0070] By constructing an adjustment factor based on the ratio of the window adjustment exponent to the adjustment threshold, and using this factor to linearly scale the initial sliding window length, continuous, adaptive, and proportional control of the sliding window length can be achieved. Compared to fixed-step adjustment methods, this method can achieve fine-grained dynamic window adjustment based on changes in the terminal's operating state, avoiding misjudgments or wasted computational resources due to excessively large or small adjustment ranges, and improving the response accuracy of the immune system to behavioral changes and the flexibility of resource scheduling. Simultaneously, while ensuring consistency in the sliding window adjustment direction, this mechanism retains the controllability of parameter adjustment and the transparency of formula logic, facilitating subsequent embedded implementation and dynamic optimization.

[0071] Step 6: Based on the actual sliding window length, extract the behavior subsequence from the current behavior time series cache in a sliding window manner. Combine it with the current behavior context summary field, select the corresponding standard vector subset from the code gene map library, compare the vector similarity, obtain the behavior similarity, and determine whether there is an abnormal terminal code behavior based on the behavior similarity.

[0072] In this embodiment, it should be specifically explained that the behavioral similarity acquisition step is as follows:

[0073] From the behavior time-series buffer, extract the current consecutive behavior records according to the actual sliding window length. Each record contains several structured fields, including program location code, instruction type number, memory access mode code, peripheral call identifier, etc. Arrange these fields in chronological order and encode them into a vector form, denoted as the current behavior vector;

[0074] Based on the behavior context summary field to which the current behavior vector belongs, a standard vector subset with semantic consistency is selected from the code gene map library;

[0075] For the current behavior vector and each standard vector, calculate the cosine similarity. The closer the value is to 1, the more similar the behaviors are.

[0076] Select the maximum value from all cosine similarities and denote it as the behavior similarity of the current behavior.

[0077] In this embodiment, it should be specifically explained that the step of determining whether abnormal terminal code behavior has occurred based on behavioral similarity is as follows:

[0078] The behavior similarity is compared with a similarity threshold. If the behavior similarity is greater than the similarity threshold, it is determined that no terminal code behavior abnormality has occurred, and terminal code immunity protection is not performed. If the behavior similarity is less than or equal to the similarity threshold, it is determined that terminal code behavior abnormality has occurred. The similarity threshold is obtained through an adaptive thresholding method.

[0079] Step 7: If abnormal terminal code behavior is detected, terminal code immunity protection is performed based on behavior similarity.

[0080] In this embodiment, it should be specifically explained that the steps for terminal code immunity protection based on behavioral similarity are as follows:

[0081] The behavior similarity is compared with the anomaly threshold. It should be noted that if the anomaly threshold is less than the similarity threshold, and the behavior similarity is greater than or equal to the anomaly threshold but less than the similarity threshold, a primary warning response is issued, the controlled memory area data is locked, and a safe preset value is forcibly returned. If the behavior similarity is less than the anomaly threshold, the terminal's internal FPGA hardware fuse logic is invoked, and a safe reconstruction mode is entered.

[0082] Controlled memory regions refer to memory spaces where access permissions can be dynamically adjusted during terminal operation. They typically include memory blocks used for communication processing, state caching, and critical intermediate data storage, and write protection or access restrictions can be implemented through hardware or kernel mechanisms.

[0083] The safety default value refers to a predefined, verified alternative value that will not cause a fault, which is automatically returned by the system when the behavior of a certain code segment in the power terminal system is judged to be suspicious or slightly abnormal, and the system cannot trust the real-time output generated by that code segment, in order to avoid the spread of the abnormality or interference with the control process.

[0084] FPGA hardware circuit breaker logic refers to a programmable logic control unit pre-deployed inside a power terminal. When the similarity of the current code behavior is detected to be lower than a set severe anomaly threshold, a predefined hardware circuit breaker procedure is immediately triggered. This procedure includes: suspending instruction execution in the suspicious program area, resetting the selected controlled memory area or communication interface, cutting off the interaction path with the upper-level master station, restoring the firmware to its default state, or activating a redundant shadow module to achieve physical-level isolation of the risky code.

[0085] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

[0086] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A dynamic code immunization method for power terminals based on gene mapping, characterized in that, Includes the following steps: Step 1: In the initial deployment phase of the terminal, static analysis is performed based on the firmware source code to extract function fragments involving key business processes. The function fragments are then used to construct behavioral feature vectors based on function tags, call path structure, global variable usage, and control flow graph. A code gene map library is then constructed based on the behavioral feature vectors. Step 2: After the terminal starts, the integrated code coloring engine performs dynamic instrumentation on the loaded program modules, and marks each instrumentation point with color, which is recorded as the coloring mark stream; Step 3: During terminal operation, receive the coloring and marking stream in real time and cache it sequentially according to time order to form a behavior time series cache area. Each sequence contains program segment location, instruction type, memory access mode, peripheral call record and behavior context summary field. Step 4: Set the initial sliding window length, obtain the behavioral adaptation parameters of the power terminal, including behavioral records and key system resource parameters, evaluate the window adjustment index based on the behavioral adaptation parameters, and determine whether the sliding window length needs to be adjusted based on the window adjustment index. Step 5: If it is determined that the sliding window length needs to be adjusted, the sliding window length is adjusted according to the window adjustment index to obtain the actual sliding window length; Step 6: Based on the actual sliding window length, extract the behavior subsequence from the behavior time series cache in a sliding window manner. Combined with the behavior context summary field, select the corresponding standard vector subset from the code gene map library, compare the vector similarity, obtain the behavior similarity, and determine whether there is an abnormal terminal code behavior based on the behavior similarity. Step 7: If abnormal terminal code behavior is detected, terminal code immunity protection is performed based on behavior similarity.

2. The method for dynamic code immunization of power terminals based on gene mapping according to claim 1, characterized in that: The steps for obtaining the code gene map library are as follows: For function fragments, function labels are generated based on the service type in the power terminal system to obtain function label features; Static analysis tools are used to perform abstract syntax tree parsing on function fragments to obtain the call relationships between function fragments, generate a function call relationship graph, and obtain the function call path characteristics based on the function call relationship graph. The access behavior of global variables in function fragments is analyzed to obtain access analysis results, and global variable access dependency features are constructed based on the access analysis results; Based on intermediate code representation, construct function-level control flow graphs, enumerate execution paths of function-level control flow graphs, and extract control flow structure features; The functional label features, function call path features, global variable access dependency features, and control flow structure features are vectorized and concatenated to construct a complete behavioral feature vector. Each function fragment generates a feature vector and binds it to the device model, firmware version, and timestamp, ultimately constructing a code gene map library for a specific type of power terminal.

3. The method for dynamic code immunization of power terminals based on gene mapping according to claim 2, characterized in that, The steps for obtaining the window adjustment index are as follows: Within the initial sliding window, acquire behavior records, construct a behavior sliding window sequence, and evaluate the behavior complexity coefficient based on the behavior sliding window sequence. Within the initial sliding window, key system resource parameters are obtained, and the terminal resource abundance coefficient is evaluated based on the key system resource parameters. The behavioral complexity coefficient and the terminal resource abundance coefficient are normalized. The window adjustment index is then evaluated based on the normalized behavioral complexity coefficient and the terminal resource abundance coefficient. The specific steps for obtaining the index are as follows: ； In the formula, This is represented as the window adjustment index. Represented as the normalized behavioral complexity coefficient. This is expressed as the normalized terminal resource abundance coefficient. , It represents the weighting coefficients of the normalized behavioral complexity coefficient and the normalized terminal resource abundance coefficient.

4. The method for dynamic code immunization of power terminals based on gene mapping according to claim 3, characterized in that, The steps for obtaining the behavioral complexity coefficient are as follows: Extract all behavior records within the initial sliding window from the behavior time series buffer. Each behavior record includes four fields: instruction type code, program location identifier, memory access mode, and peripheral call label. Calculate the information entropy value of each field to obtain the instruction type field entropy, program location field entropy, memory access mode field entropy, and peripheral call field entropy. Traverse two adjacent behavior records in the behavior sliding window sequence, check whether their fields have changed for each item. If a field changes, it is recorded as a jump event. Accumulate the number of jumps, and calculate the ratio of the number of jumps to the total number of window steps to obtain the behavior structure jump ratio. The behavioral complexity coefficient is calculated based on the instruction type field entropy, program location field entropy, memory access mode field entropy, peripheral call field entropy, and behavioral structure jump ratio.

5. The method for dynamic code immunization of power terminals based on gene mapping according to claim 3, characterized in that: The steps for obtaining the terminal resource abundance coefficient are as follows: During terminal operation, key system resource parameters within the initial sliding window are obtained. These key system resource parameters include CPU utilization sequence, memory remaining space sequence, and I / O access wait time sequence. The average CPU utilization rate is calculated by averaging the data within the CPU utilization rate sequence. The CPU slack is obtained by subtracting the average CPU utilization rate from 1. Get the total memory capacity, calculate the ratio of each data in the memory remaining space sequence to the total memory capacity to get the memory remaining ratio, and calculate the average memory remaining ratio of all memory remaining ratios. The average waiting time is calculated by averaging the data in the I / O access waiting time series. Then, the average waiting time is normalized and inversely proportional to obtain the waiting time inverse proportional factor. The balance coefficient is calculated based on CPU abundance, average remaining memory ratio, and inverse waiting time factor. The terminal resource abundance coefficient is calculated based on CPU resource abundance, average remaining memory ratio, waiting time inverse factor, and balance coefficient.

6. The method for dynamic code immunization of power terminals based on gene mapping according to claim 1, characterized in that: The step of determining whether the sliding window length needs to be adjusted based on the window adjustment index is as follows: The window adjustment index is compared with the adjustment threshold. If the window adjustment index is greater than or equal to the adjustment threshold, it is determined that the sliding window length needs to be adjusted; if the window adjustment index is less than the adjustment threshold, it is determined that the sliding window length does not need to be adjusted.

7. The method for dynamic code immunization of power terminals based on gene mapping according to claim 6, characterized in that: The steps for obtaining the actual sliding window length are as follows: The adjustment factor is obtained by calculating the ratio of the window adjustment index to the adjustment threshold; The actual sliding window length is obtained by multiplying the adjustment factor by the initial sliding window length.

8. The method for dynamic code immunization of power terminals based on gene mapping according to claim 1, characterized in that: The steps for obtaining behavioral similarity are as follows: Extract the current consecutive behavior records from the behavior time series buffer according to the actual sliding window length. Each record contains several structured fields. Arrange these fields in chronological order and encode them into a vector form, which is denoted as the current behavior vector. Based on the behavior context summary field to which the current behavior vector belongs, a standard vector subset with semantic consistency is selected from the code gene map library; For the current action vector and each standard vector, calculate the cosine similarity; Select the maximum value from all cosine similarities and denote it as the behavior similarity of the current behavior.

9. The method for dynamic code immunization of power terminals based on gene mapping according to claim 5, characterized in that: The steps for determining whether abnormal terminal code behavior has occurred based on behavioral similarity are as follows: The behavior similarity is compared with a similarity threshold. If the behavior similarity is greater than the similarity threshold, it is determined that no terminal code behavior abnormality has occurred, and terminal code immunity protection is not performed. If the behavior similarity is less than or equal to the similarity threshold, it is determined that terminal code behavior abnormality has occurred.

10. The method for dynamic code immunization of power terminals based on gene mapping according to claim 1, characterized in that: The steps for terminal code immunity protection based on behavioral similarity are as follows: The behavior similarity is compared with the anomaly threshold. If the behavior similarity is greater than or equal to the anomaly threshold but less than the similarity threshold, a primary warning response is issued, the controlled memory area data is locked, and a safe preset value is forcibly returned. If the behavior similarity is less than the anomaly threshold, the terminal's internal FPGA hardware fuse logic is invoked, and a safe reconstruction mode is entered.

Images