Power near-field network communication protocol security detection method and system

Abstract

The invention belongs to the technical field of network communication protocol security detection, and discloses a power near-field network communication protocol security detection method and system, and the method comprises the steps: constructing a state transition rule set based on an extracted power near-field network communication protocol state set, event set and action set, and generating a protocol standard finite-state machine; generating a state path sequence set based on a protocol standard finite-state machine; recording a protocol state according to messages sent and received in an actual protocol interaction process, and obtaining a state change path in real time; comparing the difference between the state path sequence set and the state change path, scoring, and carrying out safety alarm according to the score; according to the invention, score and weight adjustment is carried out based on a consistency feature neural network and depth deterministic strategy gradient reinforcement learning; and deep path traversal and analysis are carried out on the standard finite-state machine to generate a high-coverage-rate state change path sequence set, so that the automatic comparison efficiency in the execution process is remarkably improved.

Description

Technical Field

[0001] This invention belongs to the field of network communication protocol security detection technology, and specifically relates to a method and system for security detection of power near-field network communication protocols. Background Technology

[0002] With the rapid development of power systems, information and intelligent technologies have been widely applied in the power industry, especially in near-field network environments where the communication needs between power equipment have increased significantly. These devices undertake important tasks such as power monitoring, data acquisition, and equipment control, and the security of their communication protocols directly affects the stable operation and information security of the power system. However, the power industry uses a wide variety of communication protocols with complex and diverse standards and specifications. Coupled with the variability of actual operating environments, traditional protocol security detection methods often struggle to provide comprehensive coverage when faced with complex protocol state transitions, resulting in missed and false alarms.

[0003] Traditional protocol security detection methods primarily rely on rule matching and pattern recognition. These methods typically detect communication protocols based on preset rules or patterns. While effective in certain specific scenarios, they often fall short in the face of the complex and ever-changing real-world application environment of power systems. Specifically, the state transition process of power communication protocols is complex, involving numerous states and events. Traditional methods struggle to accurately capture all possible state changes, leading to insufficient accuracy and reliability in detection. Furthermore, manually constructing and analyzing protocol state machines is time-consuming, labor-intensive, and error-prone, failing to meet the high requirements for detection efficiency and accuracy in practical applications. Summary of the Invention

[0004] The purpose of this invention is to provide a method and system for security detection of power near-field network communication protocols, so as to solve the problems of insufficient accuracy and reliability of traditional protocol security detection.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, the present invention provides a method for security detection of power near-field network communication protocols, comprising: Based on the extracted state set, event set, and action set of the power near-field network communication protocol, a set of state transition rules is constructed to generate a standard finite state machine for the protocol. A set of state path sequences is generated based on the protocol standard finite state machine. Based on the message records sent and received during the actual protocol interaction process, the protocol status is recorded, and the status change path is obtained in real time. The system compares and scores the differences between the set of state path sequences and the state change paths, and issues security alerts based on the scores.

[0006] Furthermore, the extracted power near-field network communication protocol state set, event set, and action set include: The protocol flow, message categories, events, and behavioral information of the power near-field network communication protocol are extracted and summarized into states, events, actions, event triggering conditions, and event impact categories, resulting in a list of core concepts. Based on the list of core concepts The protocol states are summarized in the text, extracting the initial state, all intermediate states, and all final states of the power near-field network communication protocol, and defining them as the protocol state set. This includes the protocol initial state set. Protocol intermediate state set and the set of terminated states Based on the list of core concepts The process involves summarizing events, their triggering conditions, and their impact to extract an event set. Define a set of actions based on the actions necessary for an event to occur. ;

[0007]

[0008]

[0009] in, It is the first in the agreement One event, It is the first step executed in the protocol when the event occurs. One action.

[0010] Furthermore, the construction of the state transition rule set to generate the protocol standard finite state machine includes: Based on the obtained protocol state set event collection Action set Construct a set of state transition rules using the following algorithm: Iterate through each state in the protocol state set For each state Iterate through each event in the protocol event set. Identify the triggering conditions and impacts of an event in a given state from the list of core concepts; determine the new state to which the event transitions based on the identified impacts. and possible actions ; Construct state transition variables ; Add the state transition variables to the state transition rule set; Based on protocol state set event collection Action set The set of state transition rules constructs a standard finite state machine for the protocol: A state machine contains a set of states. event collection Action set State transition rule set, protocol initial state Protocol suspension status set Each state in a state machine is represented as a point, and a state transition is represented as an edge, which is equivalent to a directed graph. ;

[0011] in, For the set of state transition rules: .

[0012] Furthermore, the generation of a set of state path sequences based on the protocol standard finite state machine includes: From the initial state of the protocol Initially, a breadth-first search algorithm is used to generate a set of state path sequences based on the initial state coverage. ; Using a depth-first search algorithm, the initial state is... Perform transitions and generate a state path sequence based on the transition coverage. ; The state path sequence generation algorithm with path enhancement is used to generate all possible transition paths, resulting in a state path sequence with coverage enhancement. ; The set of state path sequences based on the initial state coverage State path sequence based on transition coverage State path sequence with enhanced coverage By comparing and merging state path sequences with the same prefix, removing redundant path sequences and unreachable paths, the final set of high-coverage state path sequences is output.

[0013] Furthermore, the steps of the path-enhanced state path sequence generation algorithm are as follows: Traverse each node ,calculate , including indegree s and outdegree s These represent the in-degree and out-degree of a node, respectively. If it is an asymmetric directed graph: for node pairs ,in and and At the node and Add a directed redundant edge between them, such that ; Find using Dijkstra's algorithm Zhong Cong arrive The shortest path; When the in-degree of all nodes equals their out-degree, for each ,have This yields a symmetric directed graph; Assumption Represents the current node, defined For state The core set of events; From the initial state To begin, solve for the Euler circuit. Add an Euler circuit and set... ,choose ,and Not in an Euler circuit, and will Add an Euler circuit; if The output edge points to ,Will join in renew

[0014] Repeat the above steps until all edges are in an Eulerian circuit; After obtaining the complete Eulerian circuit, the events in the Eulerian circuit are extracted in a first-in-first-out order. Redundant events are replaced with the shortest path obtained by Dijkstra's algorithm. The final set of events is the set of state path sequences.

[0015] Furthermore, the step of recording the protocol status of messages sent and received during the actual protocol interaction process and obtaining the status change path in real time includes: Network packet capture software was used to capture power near-field network communication traffic. A protocol parser was used to parse the captured packets into understandable structured data and extract key fields: source address, destination address, protocol type, and data payload. Based on the obtained protocol state set event collection Action set The captured messages are formalized; specifically: (1) For messages sent to the client, update the current status and events according to the message content; (2) For messages sent to the server, based on the message content, Perform a state transition to obtain a path based on the original state. Starting from, the state after the change As the endpoint, the event Directed edges that provide edge information; Continuously record the state change path of the protocol to obtain the state change path of the actual protocol interaction.

[0016] Furthermore, the comparison and scoring of the differences between the set of state path sequences and the state change paths, and the issuance of security alerts based on the scores, include: To address the differences between the actual state change paths and the set of state path sequences, the following differences are defined: State Differences: When the state in the actual path does not match the state in the protocol's standard state machine, the differences are recorded, including the following situations: State offset: The actual path enters a state that is not in the standard protocol state machine; State jump: Some states in the protocol's standard state machine are skipped in the actual path; State duplication: A state is unnecessarily repeated in the actual path; State transition discrepancy: When the state change path in the actual path is inconsistent with the state transition in the set of state path sequences, the discrepancy is recorded, including: Illegal transition: A state transition that does not exist in the set of state path sequences occurred in the actual path; Missing transition: A state transition that should have occurred in the set of state path sequences did not occur in the actual path; Base score is set based on the severity of the difference: State offset: State jump: The state repeats: Illegal transfer: Missing transfer: ; Traverse the state transition path of the actual protocol interaction, for each edge The two connected state nodes are compared with the standard path transition sequence set and the standard finite state machine of the protocol. Each time a difference is found, the score is accumulated.

[0017] in, A threshold is set for the total number of differences that occur during the comparison process. ,when Issue security alerts in a timely manner; Based on consistency feature neural networks and deep deterministic policy gradient reinforcement learning, the difference score is calculated. Adjustments will be made by updating the critic network and the actor network; the reinforcement learning model will then... The value estimate is closer to the actual cumulative reward, ultimately enabling the actor network to learn better strategies, select the optimal action in each state, maximize the system's cumulative reward, and obtain the optimal difference score. ; In the current state Based on this, motion is generated through an actor network. ,action This includes the agent's adjustments to the difference weights and thresholds; among which, This indicates an adjustment to the weights; This indicates an adjustment to the alarm threshold;

[0018]

[0019] Execute action Subsequently, the agent adjusts the system's difference weights and thresholds, and generates a new state after issuing an alarm based on the new weights and thresholds. and rewards ;

[0020] Secondly, the present invention provides a security detection system for power near-field network communication protocols, comprising: The information extraction module is used to construct a set of state transition rules and generate a standard finite state machine based on the extracted power near-field network communication protocol state set, event set, and action set. The state path sequence set generation module is used to generate a state path sequence set based on the protocol standard finite state machine. The state change path acquisition module is used to acquire the state change path in real time based on the protocol state of the sent and received messages during the actual protocol interaction process. The comparison output module is used to compare the differences between the set of state path sequences and the state change paths and score them, and issue security alarms based on the scores.

[0021] Furthermore, in the information extraction module, the extracted power near-field network communication protocol state set, event set, and action set include: The protocol flow, message categories, events, and behavioral information of the power near-field network communication protocol are extracted and summarized into states, events, actions, event triggering conditions, and event impact categories, resulting in a list of core concepts. Based on the list of core concepts The protocol states are summarized in the text, extracting the initial state, all intermediate states, and all final states of the power near-field network communication protocol, and defining them as the protocol state set. This includes the protocol initial state set. Protocol intermediate state set and the set of terminated states Based on the list of core concepts The process involves summarizing events, their triggering conditions, and their impact to extract an event set. Define a set of actions based on the actions necessary for an event to occur. ;

[0022]

[0023]

[0024] in, It is the first in the agreement One event, It is the first step executed in the protocol when the event occurs. One action.

[0025] Furthermore, in the information extraction module, the construction of the state transition rule set and the generation of the protocol standard finite state machine include: Based on the obtained protocol state set event collection Action set Construct a set of state transition rules using the following algorithm: Iterate through each state in the protocol state set For each state Iterate through each event in the protocol event set. Identify the triggering conditions and impacts of an event in a given state from the list of core concepts; determine the new state to which the event transitions based on the identified impacts. and possible actions ; Construct state transition variables ; Add the state transition variables to the state transition rule set; Based on protocol state set event collection Action set The set of state transition rules constructs a standard finite state machine for the protocol: A state machine contains a set of states. event collection Action set State transition rule set, protocol initial state Protocol suspension status set Each state in a state machine is represented as a point, and a state transition is represented as an edge, which is equivalent to a directed graph. ;

[0026] in, For the set of state transition rules: .

[0027] Furthermore, in the state path sequence set generation module, the generation of the state path sequence set based on the protocol standard finite state machine includes: From the initial state of the protocol Initially, a breadth-first search algorithm is used to generate a set of state path sequences based on the initial state coverage. ; Using a depth-first search algorithm, the initial state is... Perform transitions and generate a state path sequence based on the transition coverage. ; The state path sequence generation algorithm with path enhancement is used to generate all possible transition paths, resulting in a state path sequence with coverage enhancement. ; The set of state path sequences based on the initial state coverage State path sequence based on transition coverage State path sequence with enhanced coverage By comparing and merging state path sequences with the same prefix, removing redundant path sequences and unreachable paths, the final set of high-coverage state path sequences is output.

[0028] Furthermore, the steps of the path-enhanced state path sequence generation algorithm are as follows: Traverse each node ,calculate , including indegree s and outdegree s These represent the in-degree and out-degree of a node, respectively. If it is an asymmetric directed graph: for node pairs ,in and and At the node and Add a directed redundant edge between them, such that ; Find using Dijkstra's algorithm Zhong Cong arrive The shortest path; Repeat the above steps until the in-degree of all nodes equals their out-degree. ,have This yields a symmetric directed graph; Assumption Represents the current node, defined For state The core set of events; From the initial state To begin, solve for the Euler circuit. Add an Euler circuit and set... ,choose ,and Not in an Euler circuit, and will Add an Euler circuit; if The output edge points to ,Will join in renew

[0029] Repeat the above steps until all edges are in an Eulerian circuit; After obtaining the complete Eulerian circuit, the events in the Eulerian circuit are extracted in a first-in-first-out order. Redundant events are replaced with the shortest path obtained by Dijkstra's algorithm. The final set of events is the set of state path sequences.

[0030] Furthermore, in the state change path acquisition module, the step of acquiring the state change path in real time based on the message record protocol status of the actual protocol interaction process includes: Network packet capture software was used to capture power near-field network communication traffic. A protocol parser was used to parse the captured packets into understandable structured data and extract key fields: source address, destination address, protocol type, and data payload. Based on the obtained protocol state set event collection Action set The captured messages are formalized; specifically: (1) For messages sent to the client, update the current status and events according to the message content; (2) For messages sent to the server, based on the message content, Perform a state transition to obtain a path based on the original state. Starting from, the state after the change As the endpoint, the event Directed edges that provide edge information; Continuously record the state change path of the protocol to obtain the state change path of the actual protocol interaction.

[0031] Furthermore, in the comparison output module, the differences between the set of state path sequences and the state change paths are compared and scored. Based on the scores, security alarms are issued, including: To address the differences between the actual state change paths and the set of state path sequences, the following differences are defined: State Differences: When the state in the actual path does not match the state in the protocol's standard state machine, the differences are recorded, including the following situations: State offset: The actual path enters a state that is not in the standard protocol state machine; State jump: Some states in the protocol's standard state machine are skipped in the actual path; State duplication: A state is unnecessarily repeated in the actual path; State transition discrepancy: When the state change path in the actual path is inconsistent with the state transition in the set of state path sequences, the discrepancy is recorded, including: Illegal transition: A state transition that does not exist in the set of state path sequences occurred in the actual path; Missing transition: A state transition that should have occurred in the set of state path sequences did not occur in the actual path; Base score is set based on the severity of the difference: State offset: State jump: The state repeats: Illegal transfer: Missing transfer: ; Traverse the state transition path of the actual protocol interaction, for each edge The two connected state nodes are compared with the standard path transition sequence set and the standard finite state machine of the protocol. Each time a difference is found, the score is accumulated.

[0032] in, A threshold is set for the total number of differences that occur during the comparison process. ,when Issue security alerts in a timely manner; Based on consistency feature neural networks and deep deterministic policy gradient reinforcement learning, the difference score is calculated. Adjustments will be made by updating the critic network and the actor network; the reinforcement learning model will then... The value estimate is closer to the actual cumulative reward, ultimately enabling the actor network to learn better strategies, select the optimal action in each state, maximize the system's cumulative reward, and obtain the optimal difference score. ; In the current state Based on this, motion is generated through an actor network. ,action This includes the agent's adjustments to the difference weights and thresholds; among which, This indicates an adjustment to the weights; This indicates an adjustment to the alarm threshold;

[0033]

[0034] Execute action Subsequently, the agent adjusts the system's difference weights and thresholds, and generates a new state after issuing an alarm based on the new weights and thresholds. and rewards ;

[0035] Thirdly, the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the security detection method for a power near-field network communication protocol.

[0036] Fourthly, the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the power near-field network communication protocol security detection method.

[0037] Compared with the prior art, the present invention has the following technical effects: This invention first analyzes and summarizes information from standard protocol specifications to obtain a list of core concepts, thereby determining the protocol standard's state set, event set, and action set, and constructing a set of state transition rules to build a finite state machine for the protocol standard. Next, based on the protocol standard finite state machine, a high-coverage set of state path sequences is generated, improving the efficiency of comparing the protocol standard and the actual protocol interaction state machine. Then, the protocol interaction process is captured and monitored in real time, recording message sending and receiving and protocol state transitions, tracking the state change paths. Finally, a quantitative score is calculated based on the difference between the standard protocol's state path sequence and the actual interaction state path. Different levels of alarms are issued based on the difference scores, and the scores and weights are adjusted based on a consistency feature neural network and deep deterministic policy gradient reinforcement learning, ensuring the accuracy and effectiveness of security detection. This invention significantly improves the efficiency of comparing the protocol standard and the actual protocol interaction state machine, and more accurately identifies security vulnerabilities in the protocol execution process. Furthermore, by monitoring and capturing the protocol interaction process in real time, this invention can promptly detect abnormal states in protocol execution and perform quantitative analysis, providing accurate security scoring and graded alarms. By dynamically adjusting the scoring and weighting, this invention further enhances the accuracy and relevance of alarms, thereby providing reliable security for power near-field networks and effectively preventing potential communication protocol security threats. Attached Figure Description

[0038] Figure 1 This is a flowchart of the present invention.

[0039] Figure 2 This is a logic block diagram of the present invention.

[0040] Figure 3 This is a system structure diagram of the present invention. Detailed Implementation

[0041] The present invention will be further described below with reference to the accompanying drawings: Example 1, please refer to Figure 1 This invention provides a method for security detection of power near-field network communication protocols, comprising: Based on the extracted state set, event set, and action set of the power near-field network communication protocol, a set of state transition rules is constructed to generate a standard finite state machine for the protocol. A set of state path sequences is generated based on the protocol standard finite state machine. Based on the message records sent and received during the actual protocol interaction process, the protocol status is recorded, and the status change path is obtained in real time. The system compares and scores the differences between the set of state path sequences and the state change paths, and issues security alerts based on the scores.

[0042] This invention provides a security detection method for dedicated communication protocols in power near-field networks based on state machine comparison and reinforcement learning neural network optimization, effectively solving the problem of refined identification and quantitative evaluation of protocol security status in existing technologies. The method's technical solution involves systematically analyzing and reducing the information of the target communication protocol specification, accurately extracting its core conceptual elements, and constructing a complete set of states, events, and actions. Based on these sets, a rigorous finite state machine model reflecting the standard protocol behavior is constructed. Furthermore, through in-depth path traversal and analysis of this standard finite state machine, a high-coverage set of state change path sequences is intelligently generated, thereby significantly improving the efficiency of automated comparison between the standard protocol process and the actual execution process.

[0043] Example 2, please refer to Figure 2 This invention provides a method for security detection of power near-field network communication protocols, comprising: Step 1: Analyze the protocol standard specification in detail, extract the protocol state set, event set, and action set, and construct a set of state transition rules. Finally, formalize this into a protocol standard finite state machine.

[0044] Step 2: Based on the standard finite state machine, integrate the state path sequence generation algorithms of breadth-first search, depth-first search and path enhancement to generate a set of state path sequences covering all states, state transitions and critical paths in the standard finite state machine.

[0045] Step 3: Monitor and capture the actual protocol interaction process, record the protocol state based on the sent and received messages, construct state transitions in real time, and track the state change path.

[0046] Step 4: Compare and score the differences between the standard protocol state path sequence and the actual protocol interaction state change path, and issue security alerts based on the scores. Simultaneously, optimize the quantization criteria and alert thresholds based on a consistency feature neural network and deep deterministic policy gradient reinforcement learning.

[0047] The protocol standard specification is described based on finite state machines, including: Step 1.1: Analyze in detail the protocol flow, message categories, events, behaviors, and other specific concepts specified in the protocol standard, extract key information, and summarize them into categories such as status, event, action, event triggering conditions, and event impact to obtain a list of core concepts. .

[0048] Step 1.2: Based on the list of core concepts The protocol states are summarized by extracting the initial state, all intermediate states, and all final states, which are defined as the protocol state set. This includes the protocol's initial state. intermediate state of the protocol and the set of terminated states Based on the list of core concepts The process involves summarizing events, their triggering conditions, and their impact to extract an event set. Define a set of actions based on the necessary actions (operations) required for an event to occur. .

[0049]

[0050]

[0051]

[0052] in, It is the first in the agreement One event, It is the first step executed in the protocol when the event occurs. One action.

[0053] Step 1.3: Based on the protocol state set obtained in Step 1.2 event collection Action set Construct a set of state transition rules. State transition rules define how a protocol transitions from its current state to a new state when a specific event occurs within a given state, potentially accompanied by specific actions. Use the following algorithm to construct the set of state transition rules.

[0054] Iterate through each state in the protocol state set .

[0055] For each state, iterate through every event in the protocol event set. .

[0056] Identify the triggering conditions and impacts of an event in a given state from the list of core concepts.

[0057] Determine the new state to which you have transitioned based on the impact of the identified events. and possible actions .

[0058] Construct state transition variables .

[0059] Add the state transition variables to the set of state transition rules.

[0060] Step 1.4: Based on the protocol state set event collection Action set The set of state transition rules constructs a standard finite state machine. This state machine contains a set of states. event collection Action set State transition rule set, protocol initial state Protocol suspension status set Each state in a state machine can be represented as a point, and a state transition can be represented as an edge; therefore, this state machine model can be viewed as a directed graph. This state machine lays the foundation for generating a set of state path sequences.

[0061]

[0062] in, For the set of state transition rules:

[0063] A high-coverage State Path Sequence Set (SPSS) is generated based on the protocol standard finite state machine, including: Step 2.1: From the initial state of the protocol Initially, a breadth-first search algorithm is used to generate a set of state path sequences based on the initial state coverage. .

[0064] Step 2.2: Use a depth-first search algorithm to search the initial state. Perform transitions and generate a state path sequence based on the transition coverage. .

[0065] Step 2.3: Use the path-enhanced state path sequence generation algorithm to generate all possible transition paths, generating a state path sequence with enhanced coverage. The steps of the path-enhanced state path sequence generation algorithm used are as follows: Determine whether a finite state machine is an asymmetric directed graph (i.e., there are nodes with unequal in-degree and out-degree).

[0066] Traverse each node ,calculate , including indegree s and outdegree s These represent the in-degree and out-degree of a node, respectively.

[0067] If it is an asymmetric directed graph: For node pairs ,in and and At the node and Add a directed redundant edge between them, such that .

[0068] Find using Dijkstra's algorithm Zhong Cong arrive The shortest path.

[0069] Repeat the above steps until the in-degree of all nodes equals their out-degree, that is, for each node... ,have This yields a symmetric directed graph.

[0070] Assumption Represents the current node, defined For state The core event set. From the initial state Begin by solving for the Euler circuit. Add an Euler circuit and set... .choose ,and Not in an Euler circuit, and will Add an Euler circuit.

[0071] if The output edge points to :Will join in renew

[0072] Repeat the above steps until all edges are in an Eulerian circuit.

[0073] After obtaining the complete Eulerian circuit, extract the events in the Eulerian circuit in a first-in-first-out order.

[0074] The redundant events are replaced by the shortest path obtained by Dijkstra's algorithm, and the final set of events is the set of state path sequences.

[0075] Step 2.4: Compare and analyze the three obtained state path sequences. By merging state path sequences with the same prefix and removing redundant path sequences and paths that are unreachable due to state machine characteristics, the final high-coverage state path sequence set is output. This set covers all states, state transition paths, and critical paths in the protocol standard finite state machine, laying the foundation for comparing state transitions with actual protocol interactions.

[0076] Monitoring and constructing state transitions during real-time protocol interactions includes: Step 3.1: Use network packet capture software to capture power near-field network communication traffic. Use a protocol parser to parse the captured packets into understandable structured data and extract key fields such as source address, destination address, protocol type, and data payload.

[0077] Step 3.2: Based on the protocol state set obtained in Step 1.2 event collection Action set The captured messages are formalized. Specifically: (1) For messages sent to the client, the current state and events are updated according to the message content. (2) For messages sent to the server, the current state and events are updated according to the message content (the changed state and possible actions). Perform a state transition. This yields a state transition from the original state. Starting from, the state after the change As the endpoint, the event A directed edge is an edge containing edge information.

[0078] Step 3.3: Continuously record the state change paths of the protocol to obtain the actual state transition paths of the protocol interactions, i.e., the directed graph. This is so that further analysis can be conducted.

[0079] The system quantifies and compares state differences, issuing security alerts based on these differences. It also optimizes the quantification criteria and alert thresholds using a consistency feature neural network and deep deterministic policy gradient reinforcement learning. This includes: Step 4.1: To address the potential differences between the actual state path and the protocol standard path transition sequence set, the following differences are defined: State discrepancy: When the state in the actual path does not match the state in the protocol's standard state machine, this discrepancy is recorded. Such discrepancies include the following situations: State offset: The actual path enters a state that is not in the protocol's standard state machine.

[0080] State jump: Some states in the protocol's standard state machine are skipped during the actual path.

[0081] State duplication: A state is unnecessarily repeated in the actual path.

[0082] State transition discrepancy: When the state transitions in the actual path differ from the state transitions in the set of state path sequences, this discrepancy is recorded. This includes: Illegal transition: A state transition that does not exist in the set of state path sequences occurs in the actual path.

[0083] Missing transition: A state transition that should have occurred in the set of state path sequences did not occur in the actual path.

[0084] Step 4.2: Set base scores based on the severity of the difference: State Offset: State jump: The state repeats: Illegal transfer: Missing transfer:

[0085] Step 4.3: Traverse the state transition paths of the actual protocol interactions, i.e., the directed graph. For each edge The two connected state nodes are compared with the standard path transition sequence set and the standard finite state machine of the protocol. Each time a difference is found, the score is accumulated.

[0086]

[0087] in, This represents the total number of differences that occurred during the comparison process. A threshold is set. ,when It will issue a security alert in a timely manner.

[0088] Step 4.4: Applying consistency feature neural networks and deep deterministic policy gradient reinforcement learning to the difference scores Adjustments will be made. By updating the critic network and actor network, the reinforcement learning model will... The value estimate is closer to the actual cumulative reward, ultimately enabling the actor network to learn better strategies, thus selecting the optimal action in each state to maximize the system's cumulative reward and obtain the optimal difference score. .

[0089] In the current state Based on this, motion is generated through an actor network. ,action This includes the adjustments the agent will make to the difference weights and thresholds. This indicates an adjustment to the weights; This indicates an adjustment to the alarm threshold.

[0090]

[0091]

[0092] Execute action Subsequently, the agent adjusts the system's difference weights and thresholds. Simultaneously, based on the new weights and thresholds, an alarm is triggered, and a new state is generated. and rewards .

[0093]

[0094] In practical security testing, this invention innovatively captures and monitors the communication interaction process of the protocol in real time, meticulously recording the sending / receiving events of each message and the state transitions they trigger, thus achieving complete tracking and reproduction of the protocol's runtime state change path. The core technical effects are reflected in: accurately comparing the captured actual state path with the aforementioned standard state path to scientifically quantify the degree of difference between the two; dynamically generating corresponding security risk scores and alarm information based on this quantification result; and, most importantly, flexibly adjusting the weighting mechanism of the scoring and alarms according to actual application scenarios and needs, ensuring highly accurate and real-time effectiveness of the detection results, ultimately providing strong dynamic technical support for the communication security of power near-field networks.

[0095] Example 3: This invention provides a method for security detection of power near-field network communication protocols, comprising: Step 1: Describe the protocol standard specification based on finite state machines. Step 1.1: Extract key information from the protocol standard, focusing on various types of information in the protocol document, including state descriptions, event definitions, action descriptions, event triggering conditions, and the potential impact of events. This will yield a list of core concepts. .

[0096] Status: Extract the various possible states of the device or system from the protocol document. For example, electrical equipment may be in a state of "normal operation", "overload", or "fault".

[0097] Events: Identify all events defined in the protocol, such as "packet reception", "command execution", "connection establishment", etc.

[0098] Actions: Define all operations or behaviors specified in the protocol standard. These actions may include "sending alarms", "switching modes", "logging", etc.

[0099] Event triggering conditions: Analyze the triggering conditions of events, such as "triggering an alarm when the temperature exceeds a threshold" or "reconnecting when the data packet loss rate exceeds a certain percentage".

[0100] Event Impact: Record the possible consequences or impacts of each event, such as "causing system restart", "triggering security alerts", "entering degrade mode", etc.

[0101] Step 1.2: Based on the list of core concepts The protocol states are summarized by extracting the initial state, all intermediate states, and all final states, which are defined as the protocol state set. This includes the protocol's initial state. intermediate state of the protocol and the set of terminated states Based on the list of core concepts The process involves summarizing events, their triggering conditions, and their impact to extract an event set. Define a set of actions based on the necessary actions (operations) required for an event to occur. .

[0102]

[0103]

[0104]

[0105] in, It is the first in the agreement One event, It is the first step executed in the protocol when the event occurs. One action.

[0106] Step 1.3: Based on the protocol state set event collection Action set Construct a set of state transition rules.

[0107] Step 1.3.1: Traverse each state s in the protocol state set.

[0108] Step 1.3.2: For each state, iterate through each event e in the protocol event set.

[0109] Step 1.3.3: Identify the triggering conditions and impacts of an event in a given state from the list of core concepts.

[0110] Step 1.3.4: Determine the new state to which the transition occurs based on the identified event impacts. and possible actions .

[0111] Step 1.3.5: Construct state transition variables .

[0112] Step 1.3.6: Add the state transition variables to the set of state transition rules.

[0113] Step 1.4: Based on the protocol state set event collection Action set The set of state transition rules constructs a standard finite state machine for the protocol. This state machine contains a set of states. event collection Action set State transition rule set, protocol initial state Protocol suspension status set .

[0114]

[0115] in, For the set of state transition rules:

[0116] Step 2: Generate a high-coverage set of state path sequences based on the protocol standard finite state machine. Step 2.1: From the initial state of the protocol Initially, a breadth-first search algorithm is used to generate a set of state path sequences based on the initial state coverage. .

[0117] Create an empty queue and the initial state Enqueue. This queue is used to store the state paths that will be expanded.

[0118] Initialize an empty set of state path sequences. It is used to store the final state path sequence.

[0119] From queue Extract the current path Get the end state of the path. .

[0120] Iterate through all states s through a certain event. The new state to which it has been transferred And extend the event and new state to the current path. Generate a new path .

[0121] New path Enqueue Further expansion is pending.

[0122] For each complete state path Store it in In the collection.

[0123] Continue expanding until the queue is full If empty, it means that all possible state paths have been searched.

[0124] Step 2.2: Use a depth-first search algorithm to search the initial state. Perform transitions and generate a state path sequence based on the transition coverage. .

[0125] Create an empty stack , initial state Push onto the stack and initialize an empty set of state path sequences. It is used to store the final state path sequence.

[0126] From stack Extract the current path Get the end state of the path. .

[0127] Iterate through all states Through a certain event The new state to which it has been transferred And extend the event and new state to the current path. Generate a new path .

[0128] New path Push onto stack Continue to expand the new path.

[0129] If path If a terminating state is reached or there are no more extensible events, the path will be... Store to In the collection.

[0130] Repeat the steps until the stack is complete. An empty value means that all possible state paths have been explored.

[0131] During the search process, if a loop path is detected, you can choose to skip the path or record it as a special case.

[0132] final, The set will contain from Starting from this point, a depth-first search is performed to generate all state path sequences based on transition coverage.

[0133] Step 2.3: Use the path-enhanced state path sequence generation algorithm to generate all possible transition paths, generating a state path sequence with enhanced coverage. .

[0134] Traverse each node ,calculate , including indegree s and outdegree s These represent the in-degree and out-degree of a node, respectively. If a node exists... Then it is an asymmetric directed graph.

[0135] If it is an asymmetric directed graph, for node pairs ,in and and At the node and Add a directed redundant edge between them, such that Find using Dijkstra's algorithm Zhong Cong arrive Find the shortest path. Repeat step 2.3.2 until all nodes are found. That is, for each ,have .

[0136] Assumption Represents the current node, defined For state The core event set. From the initial state Begin by solving for the Euler circuit. Add an Euler circuit and set... .choose ,and Not in an Euler circuit, and will Add an Euler circuit. If The output edge points to ,Will join in renew Repeat the steps until all edges are in an Eulerian circuit.

[0137] After obtaining the complete Eulerian circuit, the events in the Eulerian circuit are extracted in a first-in, first-out (FIFO) order. Redundant events are replaced with the shortest paths obtained using Dijkstra's algorithm, and the final set of events is the set of state path sequences.

[0138] Step 2.4: Compare and analyze the three obtained state path sequences.

[0139] Step 2.5: Collect data generated from breadth-first search Depth-first search generated and any other generated set of state path sequences The path sequences in these three sets are compared pairwise to identify paths with the same prefix.

[0140] Step 2.6: For paths with the same prefix, merge the paths, retain the prefix portion, and continue expanding the branch paths. For example, path and They can be merged into a single path with a common prefix. And continue to expand the branches under this path. and .

[0141] Step 3: Monitor and build state transitions for real-time protocol interaction. Step 3.1: Use network packet capture software to capture power near-field network communication traffic. Use a protocol parser to parse the captured packets into understandable structured data and extract key fields: source address, destination address, protocol type, and data payload.

[0142] Step 3.2: Based on the protocol state set event collection Action set The captured messages are formalized.

[0143] For messages sent to the client, update the current status and events based on the message content.

[0144] For messages sent to the server, based on the message content (changed state and possible actions), Perform a state transition. This yields a state transition from the original state. Starting from, the state after the change As the endpoint, the event A directed edge is an edge containing edge information.

[0145] Step 3.3: Continuously record the state change paths of the protocol to obtain the actual state transition paths of the protocol interactions, i.e., the directed graph. .

[0146] Step 4: Quantify and compare state differences, and issue security alerts based on these differences. The quantification criteria and alert thresholds are optimized using a consistency feature neural network and deep deterministic policy gradient reinforcement learning.

[0147] Step 4.1: To address the potential differences between the actual state path and the protocol standard path transition sequence set, the following differences are defined: State discrepancy: When the state in the actual path does not match the state in the protocol's standard state machine, this discrepancy is recorded. Such discrepancies include the following situations: State offset: The actual path enters a state that is not in the protocol's standard state machine.

[0148] State jump: Some states in the protocol's standard state machine are skipped during the actual path.

[0149] State duplication: A state is unnecessarily repeated in the actual path.

[0150] State transition discrepancy: When the state transitions in the actual path differ from the state transitions in the set of state path sequences, this discrepancy is recorded. This includes: Illegal transition: A state transition that does not exist in the set of state path sequences occurs in the actual path.

[0151] Missing transition: A state transition that should have occurred in the set of state path sequences did not occur in the actual path.

[0152] Step 4.2: Set base scores based on the severity of the differences: State offset:

[0153] State jump:

[0154] State repeats:

[0155] Illegal transfer:

[0156] Missing transfer:

[0157] Step 4.3: Traverse the state transition paths of the actual protocol interactions, i.e., the directed graph. For each edge The two connected state nodes are compared with the standard path transition sequence set and the standard finite state machine of the protocol. Each time a difference is found, the score is accumulated.

[0158]

[0159] in, This represents the total number of differences that occurred during the comparison process. A threshold is set. ,when It will issue a security alert in a timely manner.

[0160] Step 4.4: Applying consistency feature neural networks and deep deterministic policy gradient reinforcement learning to the difference scores Adjustments can provide more effective security testing results.

[0161] (1) State space: Define time The system status is as follows . It is a multidimensional vector, where, For the difference vector, This indicates the weight at the current moment (before modification). This is represented as the current threshold. This is historical warning information.

[0162] Difference vector It includes the difference results obtained from the aforementioned difference comparison, containing information on both the type and severity of the difference. Defined as shown in Formula 4-10 The matrix. Indicates time Time The existence of class differences; if differences exist, then... ,otherwise ; Indicates the first Class differences in time The severity is a continuous numerical value, measured against historical data of the system based on the difference. The greater the security threat posed by this difference, the higher the value.

[0163]

[0164] In time Weight vector at the location This represents the weight difference value used in the previous time period. The difference type of each item and One-to-one correspondence. Similarly, This represents the alarm threshold used in the previous time period, which is a The vector.

[0165]

[0166] Historical alarm information The system records past performance data for the alarm system, including metrics such as alarm accuracy, false alarm rate, and false negative rate. This historical data helps the agent understand the effectiveness of previous decisions and guides current strategy adjustments. The vector representation of historical alarm information can be shown as:

[0167] A real, existing security threat is defined as positive, and a non-existent threat as negative. (Definition) Indicates time The number of true positives at that time; Indicates the number of true negatives; The number of false positives. This represents the number of false negatives.

[0168] (2) State transition: State transition function Describes the actions performed After that, the system starts from the current state. Transition to the state of the next moment Each time the agent performs an action Then, the alarm system will adjust the weights accordingly. and threshold The system makes alarm decisions and generates new alarm information. These new alarm results are fed back to the agent to form the basis for the next action. status The state transition can be represented as:

[0169] (3) Reward function: In reinforcement learning, a reward function is defined to correctly guide the agent to optimize weights and thresholds. (As shown in Formula 4-14). Wherein, These are true positive, true negative, false positive, and false negative, respectively. These are weighting coefficients for different performance indicators, used to balance the various indicators of the alarm system.

[0170]

[0171] The goal of agent learning is to maximize future cumulative rewards, that is:

[0172] (4) Strategy update: at each time step The agent optimizes the policy function. To select the optimal action The policy is updated using gradient ascent, with the goal of maximizing the reward function:

[0173] It is output by the online critics. Values ​​are used to estimate future rewards for a given state and action.

[0174] After completing the reinforcement learning model, the reinforcement learning is trained using the deterministic policy gradient algorithm, as follows: (1) Initialization: This section requires initializing the components needed for the deterministic policy gradient reinforcement learning algorithm to facilitate subsequent learning. Initialize the Actor Network parameters. This network is used to generate a given state. The following action (i.e., adjusting weights and thresholds); initializing the Critic Network parameters. This network is used to estimate the state. and actions The Q value is the system's cumulative reward after taking a certain action. Initialize the experience replay pool. This is used to store the experiences gained by the agent as it explores the environment. A discount factor is set. This is used to balance the effects of short-term and long-term rewards.

[0175] (2) Constructing the state space: Based on the aforementioned modeling method, the state space required by the security detection system is defined, that is, constructed according to the system environment and the current alarm status. .

[0176] (3) Perform actions and interact with the environment: First, in the current state Based on this, motion is generated through an actor network. ,action This includes the adjustments the agent will make to the difference weights and thresholds. This indicates an adjustment to the weights; This indicates an adjustment to the alarm threshold.

[0177]

[0178]

[0179] Execute action Subsequently, the agent adjusts the system's difference weights and thresholds. Simultaneously, based on the new weights and thresholds, an alarm is triggered, and a new state is generated. and rewards .

[0180]

[0181] (4) Experience storage: storing current experience Stored in the experience replay pool This is to allow for batch updates during subsequent training.

[0182] (5) Updating the critic network and actor network: The role of the critic network is to estimate the state-action pair. Value, i.e., given the current state Actions chosen by the agent Then, predict all possible cumulative rewards in the future. The commentator network is achieved by minimizing... The error in the value estimation is used to update its parameters.

[0183] Recursively define the critic network Value function . Is it an intelligent agent in time? Instant rewards derived from the environment; It is a discount factor used to balance short-term and long-term rewards; The target commentator network in the next moment Estimates of future rewards; Is the target actor network in Actions generated at any given moment. Value functions represent the state Start executing the action Then, predict all possible cumulative rewards in the future. The commentator network will minimize... The error in the value estimation is used to update its own parameters.

[0184]

[0185] To minimize Value estimation and target value The difference between them is used to define the loss function of the commentator network as follows:

[0186] in, This refers to the size of the mini-batch data sampled from the experience replay pool. This is done to minimize the loss function. This section uses gradient descent to update the parameters of the critic network. The updated formula is as follows. Wherein... It is the learning rate, which represents the step size for parameter updates. The loss function is related to the commentator network parameters. The gradient of the loss function can be calculated using the following formula.

[0187]

[0188]

[0189] By continuously optimizing the parameters of the critic network The Critics Network The value estimate is closer to the actual cumulative reward, thus providing more accurate feedback for the actor network's strategy.

[0190] The goal of the actor network is to adjust according to the current state. Generate the optimal action This action can maximize the evaluation of the online critics. Value. The actor network maximizes the value of the critic network. The value is used to update its parameters.

[0191] To maximize the critic network We use gradient ascent to update the parameters of the actor network. The updated formula is shown below, where... It is the learning rate of the actor network, representing the step size for parameter updates. The gradient of the policy is represented as shown in equation (3-24). Wherein, It is a network of critics The gradient of the value relative to the action; It is the actor's network-generated motion. Relative to its parameters The gradient.

[0192]

[0193]

[0194] By updating the critic network and actor network, the model will enable... The value estimate is closer to the actual cumulative reward, and ultimately enables the actor network to learn better strategies, thereby selecting the optimal action in each state and maximizing the system's cumulative reward.

[0195] In another embodiment of the present invention, please refer to Figure 3 This invention provides a power near-field network communication protocol security detection system, which can be used to implement the aforementioned power near-field network communication protocol security detection method. Specifically, the system includes: The information extraction module is used to construct a set of state transition rules and generate a standard finite state machine based on the extracted power near-field network communication protocol state set, event set, and action set. The state path sequence set generation module is used to generate a state path sequence set based on the protocol standard finite state machine. The state change path acquisition module is used to acquire the state change path in real time based on the protocol state of the sent and received messages during the actual protocol interaction process. The comparison output module is used to compare the differences between the set of state path sequences and the state change paths and score them, and issue security alarms based on the scores.

[0196] The module division in this embodiment of the invention is illustrative and represents only one logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional modules in the various embodiments of the invention can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0197] In another embodiment of the present invention, a computer device is provided, comprising a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions from the computer storage medium to achieve a corresponding method flow or corresponding function. The processor described in this embodiment of the present invention can be used in the operation of a power near-field network communication protocol security detection method.

[0198] In another embodiment of the present invention, a storage medium is provided, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, the storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the power near-field network communication protocol security detection method in the above embodiments.

[0199] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0200] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0201] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0202] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0203] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for security detection of power near-field network communication protocols, characterized in that, include: Based on the extracted state set, event set, and action set of the power near-field network communication protocol, a set of state transition rules is constructed to generate a standard finite state machine for the protocol. A set of state path sequences is generated based on the protocol standard finite state machine. Based on the message records sent and received during the actual protocol interaction process, the protocol status is recorded, and the status change path is obtained in real time. The system compares and scores the differences between the set of state path sequences and the state change paths, and issues security alerts based on the scores.

2. The method for security detection of power near-field network communication protocols according to claim 1, characterized in that, The extracted power near-field network communication protocol state set, event set, and action set include: The protocol flow, message categories, events, and behavioral information of the power near-field network communication protocol are extracted and summarized into states, events, actions, event triggering conditions, and event impact categories, resulting in a list of core concepts. Based on the list of core concepts The protocol states are summarized in the text, extracting the initial state, all intermediate states, and all final states of the power near-field network communication protocol, and defining them as the protocol state set. This includes the protocol initial state set. Protocol intermediate state set and the set of terminated states Based on the list of core concepts The process involves summarizing events, their triggering conditions, and their impact to extract an event set. Define a set of actions based on the actions necessary for an event to occur. ; in, It is the first in the agreement One event, It is the first step executed in the protocol when the event occurs. One action.

3. The method for security detection of power near-field network communication protocols according to claim 2, characterized in that, The construction of the state transition rule set, generating the protocol standard finite state machine, includes: Based on the obtained protocol state set event collection Action set Construct a set of state transition rules using the following algorithm: Iterate through each state in the protocol state set For each state Iterate through each event in the protocol event set. Identify the triggering conditions and impacts of an event in a given state from the list of core concepts; determine the new state to which the event transitions based on the identified impacts. and possible actions ; Construct state transition variables ; Add the state transition variables to the state transition rule set; Based on protocol state set event collection Action set The set of state transition rules constructs a standard finite state machine for the protocol: A state machine contains a set of states. event collection Action set State transition rule set, protocol initial state Protocol suspension status set Each state in a state machine is represented as a point, and a state transition is represented as an edge, which is equivalent to a directed graph. ; in, For the set of state transition rules: 。 4. The method for security detection of power near-field network communication protocols according to claim 1, characterized in that, The generation of a set of state path sequences based on the protocol standard finite state machine includes: From the initial state of the protocol Initially, a breadth-first search algorithm is used to generate a set of state path sequences based on the initial state coverage. ; Using a depth-first search algorithm, the initial state is... Perform transitions and generate a state path sequence based on the transition coverage. ; The state path sequence generation algorithm with path enhancement is used to generate all possible transition paths, resulting in a state path sequence with coverage enhancement. ; The set of state path sequences based on the initial state coverage State path sequence based on transition coverage State path sequence with enhanced coverage By comparing and merging state path sequences with the same prefix, removing redundant path sequences and unreachable paths, the final set of high-coverage state path sequences is output.

5. A method for security detection of power near-field network communication protocols according to claim 4, characterized in that, The steps of the path-enhanced state path sequence generation algorithm used are as follows: Traverse each node ,calculate , including indegree s and outdegree s These represent the in-degree and out-degree of a node, respectively. If it is an asymmetric directed graph: for node pairs ,in and and At the node and Add a directed redundant edge between them, such that ; Find using Dijkstra's algorithm Zhong Cong arrive The shortest path; When the in-degree of all nodes equals their out-degree, for each ,have This yields a symmetric directed graph; Assumption Represents the current node, defined For state The core set of events; From the initial state To begin, solve for the Euler circuit. Add an Euler circuit and set... ,choose ,and Not in an Euler circuit, and will Add an Euler circuit; if The output edge points to ,Will join in renew Repeat the above steps until all edges are in an Eulerian circuit; After obtaining the complete Eulerian circuit, the events in the Eulerian circuit are extracted in a first-in-first-out order. Redundant events are replaced with the shortest path obtained by Dijkstra's algorithm. The final set of events is the set of state path sequences.

6. The method for security detection of power near-field network communication protocols according to claim 3, characterized in that, The method of recording the protocol status of messages sent and received during the actual protocol interaction process and obtaining the status change path in real time includes: Network packet capture software was used to capture power near-field network communication traffic. A protocol parser was used to parse the captured packets into understandable structured data and extract key fields: source address, destination address, protocol type, and data payload. Based on the obtained protocol state set event collection Action set The captured messages are formalized; specifically: (1) For messages sent to the client, update the current status and events according to the message content; (2) For messages sent to the server, based on the message content, Perform a state transition to obtain a path based on the original state. Starting from, the state after the change As the endpoint, the event Directed edges that provide edge information; Continuously record the state change path of the protocol to obtain the state change path of the actual protocol interaction.

7. A method for security detection of power near-field network communication protocols according to claim 1, characterized in that, The comparison and scoring of the state path sequence set and state change path, and the issuance of security alerts based on the scores, include: To address the differences between the actual state change paths and the set of state path sequences, the following differences are defined: State Differences: When the state in the actual path does not match the state in the protocol's standard state machine, the differences are recorded, including the following situations: State offset: The actual path enters a state that is not in the standard protocol state machine; State jump: Some states in the protocol's standard state machine are skipped in the actual path; State duplication: A state is unnecessarily repeated in the actual path; State transition discrepancy: When the state change path in the actual path is inconsistent with the state transition in the set of state path sequences, the discrepancy is recorded, including: Illegal transition: A state transition that does not exist in the set of state path sequences occurred in the actual path; Missing transition: A state transition that should have occurred in the set of state path sequences did not occur in the actual path; Base score is set based on the severity of the difference: State offset: State jump: The state repeats: Illegal transfer: Missing transfer: ; Traverse the state transition path of the actual protocol interaction, for each edge The two connected state nodes are compared with the standard path transition sequence set and the standard finite state machine of the protocol. Each time a difference is found, the score is accumulated. in, A threshold is set for the total number of differences that occur during the comparison process. ,when Issue security alerts in a timely manner; Based on consistency feature neural networks and deep deterministic policy gradient reinforcement learning, the difference score is calculated. Adjustments will be made by updating the critic network and the actor network; the reinforcement learning model will then... The value estimate is closer to the actual cumulative reward, ultimately enabling the actor network to learn better strategies, select the optimal action in each state, maximize the system's cumulative reward, and obtain the optimal difference score. ; In the current state Based on this, motion is generated through an actor network. ,action This includes the agent's adjustments to the difference weights and thresholds; among which, This indicates an adjustment to the weights; This indicates an adjustment to the alarm threshold; Execute action Subsequently, the agent adjusts the system's difference weights and thresholds, and generates a new state after issuing an alarm based on the new weights and thresholds. and rewards ; 。 8. A security detection system for power near-field network communication protocols, characterized in that, include: The information extraction module is used to construct a set of state transition rules and generate a standard finite state machine based on the extracted power near-field network communication protocol state set, event set, and action set. The state path sequence set generation module is used to generate a state path sequence set based on the protocol standard finite state machine. The state change path acquisition module is used to acquire the state change path in real time based on the protocol state of the sent and received messages during the actual protocol interaction process. The comparison output module is used to compare the differences between the set of state path sequences and the state change paths and score them, and issue security alarms based on the scores.

9. A power near-field network communication protocol security detection system according to claim 8, characterized in that, In the information extraction module, the extracted power near-field network communication protocol state set, event set, and action set include: The protocol flow, message categories, events, and behavioral information of the power near-field network communication protocol are extracted and summarized into states, events, actions, event triggering conditions, and event impact categories, resulting in a list of core concepts. Based on the list of core concepts The protocol states are summarized in the text, extracting the initial state, all intermediate states, and all final states of the power near-field network communication protocol, and defining them as the protocol state set. This includes the protocol initial state set. Protocol intermediate state set and the set of terminated states Based on the list of core concepts The process involves summarizing events, their triggering conditions, and their impact to extract an event set. Define a set of actions based on the actions necessary for an event to occur. ; in, It is the first in the agreement One event, It is the first step executed in the protocol when the event occurs. One action.

10. A power near-field network communication protocol security detection system according to claim 9, characterized in that, In the information extraction module, the step of constructing a set of state transition rules and generating a protocol standard finite state machine includes: Based on the obtained protocol state set event collection Action set Construct a set of state transition rules using the following algorithm: Iterate through each state in the protocol state set For each state Iterate through each event in the protocol event set. Identify the triggering conditions and impacts of an event in a given state from the list of core concepts; determine the new state to which the event transitions based on the identified impacts. and possible actions ; Construct state transition variables ; Add the state transition variables to the state transition rule set; Based on protocol state set event collection Action set The set of state transition rules constructs a standard finite state machine for the protocol: A state machine contains a set of states. event collection Action set State transition rule set, protocol initial state Protocol suspension status set Each state in a state machine is represented as a point, and a state transition is represented as an edge, which is equivalent to a directed graph. ; in, For the set of state transition rules: 。 11. A power near-field network communication protocol security detection system according to claim 8, characterized in that, In the state path sequence set generation module, the generation of the state path sequence set based on the protocol standard finite state machine includes: From the initial state of the protocol Initially, a breadth-first search algorithm is used to generate a set of state path sequences based on the initial state coverage. ; Using a depth-first search algorithm, the initial state is... Perform transitions and generate a state path sequence based on the transition coverage. ; The state path sequence generation algorithm with path enhancement is used to generate all possible transition paths, resulting in a state path sequence with coverage enhancement. ; The set of state path sequences based on the initial state coverage State path sequence based on transition coverage State path sequence with enhanced coverage By comparing and merging state path sequences with the same prefix, removing redundant path sequences and unreachable paths, the final set of high-coverage state path sequences is output.

12. A power near-field network communication protocol security detection system according to claim 11, characterized in that, The steps of the path-enhanced state path sequence generation algorithm used are as follows: Traverse each node ,calculate , including indegree s and outdegree s These represent the in-degree and out-degree of a node, respectively. If it is an asymmetric directed graph: for node pairs ,in and and At the node and Add a directed redundant edge between them, such that ; Find using Dijkstra's algorithm Zhong Cong arrive The shortest path; Repeat the above steps until the in-degree of all nodes equals their out-degree. ,have This yields a symmetric directed graph; Assumption Represents the current node, defined For state The core set of events; From the initial state To begin, solve for the Euler circuit. Add an Euler circuit and set... ,choose ,and Not in an Euler circuit, and will Add an Euler circuit; if The output edge points to ,Will join in renew Repeat the above steps until all edges are in an Eulerian circuit; After obtaining the complete Eulerian circuit, the events in the Eulerian circuit are extracted in a first-in-first-out order. Redundant events are replaced with the shortest path obtained by Dijkstra's algorithm. The final set of events is the set of state path sequences.

13. A power near-field network communication protocol security detection system according to claim 10, characterized in that, In the state change path acquisition module, the step of acquiring the state change path in real time based on the protocol state of the sent and received messages during the actual protocol interaction process includes: Network packet capture software was used to capture power near-field network communication traffic. A protocol parser was used to parse the captured packets into understandable structured data and extract key fields: source address, destination address, protocol type, and data payload. Based on the obtained protocol state set event collection Action set The captured messages are formalized; specifically: (1) For messages sent to the client, update the current status and events according to the message content; (2) For messages sent to the server, based on the message content, Perform a state transition to obtain a path based on the original state. Starting from, the state after the change As the endpoint, the event Directed edges that provide edge information; Continuously record the state change path of the protocol to obtain the state change path of the actual protocol interaction.

14. A power near-field network communication protocol security detection system according to claim 8, characterized in that, In the comparison output module, the differences between the set of state path sequences and the state change paths are compared and scored. Based on the scores, security alarms are issued, including: To address the differences between the actual state change paths and the set of state path sequences, the following differences are defined: State Differences: When the state in the actual path does not match the state in the protocol's standard state machine, the differences are recorded, including the following situations: State offset: The actual path enters a state that is not in the standard protocol state machine; State jump: Some states in the protocol's standard state machine are skipped in the actual path; State duplication: A state is unnecessarily repeated in the actual path; State transition discrepancy: When the state change path in the actual path is inconsistent with the state transition in the set of state path sequences, the discrepancy is recorded, including: Illegal transition: A state transition that does not exist in the set of state path sequences occurred in the actual path; Missing transition: A state transition that should have occurred in the set of state path sequences did not occur in the actual path; Base score is set based on the severity of the difference: State offset: State jump: The state repeats: Illegal transfer: Missing transfer: ; Traverse the state transition path of the actual protocol interaction, for each edge The two connected state nodes are compared with the standard path transition sequence set and the standard finite state machine of the protocol. Each time a difference is found, the score is accumulated. in, A threshold is set for the total number of differences that occur during the comparison process. ,when Issue security alerts in a timely manner; Based on consistency feature neural networks and deep deterministic policy gradient reinforcement learning, the difference score is calculated. Adjustments will be made by updating the critic network and the actor network; the reinforcement learning model will then... The value estimate is closer to the actual cumulative reward, ultimately enabling the actor network to learn better strategies, select the optimal action in each state, maximize the system's cumulative reward, and obtain the optimal difference score. ; In the current state Based on this, motion is generated through an actor network. ,action This includes the agent's adjustments to the difference weights and thresholds; among which, This indicates an adjustment to the weights; This indicates an adjustment to the alarm threshold; Execute action Subsequently, the agent adjusts the system's difference weights and thresholds, and generates a new state after issuing an alarm based on the new weights and thresholds. and rewards ; 。 15. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the security detection method for a power near-field network communication protocol as described in any one of claims 1 to 7.

16. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the security detection method for a power near-field network communication protocol as described in any one of claims 1 to 7.

Images