Lightweight trigger mechanism-based instant threat early warning and active traceability deterrence method and system in power system network

Abstract

The invention discloses an instant threat early warning and active traceability deterrence method and system based on a lightweight trigger mechanism in a power system network, and relates to the field of power system network security. According to the method, a light load trip line is preset at a key node, a suspicious attack log is generated in combination with a hidden Markov model, and multi-channel instant early warning is triggered; extracting multi-dimensional fingerprints of a browser, hardware and a special network weapon to construct a warehouse, and generating three types of flight fragments of deep acquisition, remote control and vulnerability repair for precise delivery; and performing confusion packing processing on the control software, and realizing active traceability deterrence in a matching / non-matching mode. According to the invention, threat identification accuracy and response speed are improved, an active defense closed loop is formed, and the method is suitable for security protection of a power system network.

Description

Technical Field

[0001] This invention relates to the field of power system network security, and in particular to a method and system for real-time threat warning and proactive source tracing deterrence based on a lightweight triggering mechanism in power system networks. Background Technology

[0002] The current cybersecurity environment is complex and volatile, with attack methods constantly evolving. Traditional defense mechanisms are lagging behind and passive in dealing with covert and advanced threats. Due to their high degree of digitization and interconnectivity, power system networks have become important targets for cyberattacks, facing various risks such as ransomware, phishing attacks, supply chain vulnerability exploitation, and advanced persistent threats (APTs).

[0003] Existing cybersecurity systems have significant limitations in threat perception, real-time early warning, and attack attribution. Regarding early warning mechanisms, traditional intrusion detection systems rely on signatures or simple behavioral analysis, which easily generates a large number of false positives and false negatives, especially when handling encrypted traffic. Furthermore, they do not incorporate analysis of normal user behavior patterns, resulting in a lack of personalized and accurate alerts, leading to "alert fatigue" and impacting response efficiency.

[0004] In terms of attribution investigation and evidence collection, existing threat fingerprint extraction methods are limited in scope and struggle to address the cross-platform nature of physical devices. Furthermore, fingerprints are susceptible to changes over time, making attribution investigation difficult. Additionally, current technologies struggle to correlate attack fingerprints across different stages and lack intelligent correlation capabilities with open-source attack fingerprints. Attribution investigations are often reactive, relying on post-attack log analysis, making early intervention in attacks challenging.

[0005] These shortcomings often leave defenders in a passive position of information asymmetry and cost disadvantage when facing complex attacks, necessitating a systematic approach that can shift from passive response to proactive deterrence. Summary of the Invention

[0006] In view of this, embodiments of the present invention provide a method and system for real-time threat early warning and proactive source tracing deterrence based on a lightweight triggering mechanism in power system networks, which at least partially solves the problems existing in the prior art.

[0007] In a first aspect, embodiments of the present invention provide a method for real-time threat early warning and proactive source tracing deterrence based on a lightweight triggering mechanism in a power system network, comprising the following steps:

[0008] Step S1: Pre-set access tripwires at key nodes of the power system network, monitor and capture abnormal behaviors that deviate from normal paths, permissions, or preset security policies in real time, and combine the Hidden Markov Model to model the normal behavior of users and system entities to generate suspicious attack logs.

[0009] Step S2: Based on the suspicious attack logs generated in Step S1, once the threat level is confirmed, initiate real-time alerts for users through various channels.

[0010] Step S3: Based on the access data associated with the abnormal behavior captured in Step S1, extract browser fingerprints, operating system and hardware fingerprints, and special network weapon fingerprints to build a threat fingerprint repository.

[0011] Step S4: Based on the warning results of Step S2 and the fingerprint repository information of Step S3, generate at least three types of flight segments, and then combine them with the analysis and tracing results of suspicious attack behaviors to accurately deliver them to the target location and deploy them.

[0012] Step S5: Obfuscate and pack the code of the control software supporting steps S1 to S4, and combine it with the fingerprint repository information from step S3 to achieve proactive source tracing, evidence collection and deterrence in both cooperative and non-cooperative modes.

[0013] According to a specific implementation of an embodiment of the present invention, in step S1, the abnormal behavior includes abnormal login attempts, unauthorized file access, abnormal network connections, and privilege escalation; the captured abnormal behavior data is initially filtered, standardized, and structured, and the generated suspicious attack log includes timestamps, source / destination information, behavior type, and key metadata of the resources involved; the hidden Markov model constructs a behavior baseline by learning normal state sequences and their transition probabilities, and when the deviation between real-time behavior data and normal behavior patterns exceeds a preset threshold, it is identified as abnormal and recorded in the suspicious attack log.

[0014] According to a specific implementation of an embodiment of the present invention, in step S2, the diversified channels include email, SMS service, and in-application pop-ups; the alarm information of the real-time warning includes the event itself, the abnormal behavior context based on Hidden Markov Model analysis, preliminary judgment results, suggested response measures, and related threat intelligence links, and the alarm process is a high-priority response.

[0015] According to a specific implementation of an embodiment of the present invention, in step S3, the browser fingerprint includes user browser configuration, plugin list, font information, screen resolution, Canvas fingerprint, WebGL fingerprint, WebRTC information, and HTTP header information; the operating system and hardware fingerprint includes operating system version, installed patch information, running service list, installed software list, hard disk serial number, MAC address, and CPU serial number, and the data types can be expanded to cope with cross-platform characteristics; the special network weapon fingerprint includes specific malware family characteristics, command and control (C2) communication protocol characteristics, attack toolchain, vulnerability exploitation methods, and includes attack characteristics targeting power system-specific protocols (IEC61850, DNP3).

[0016] According to a specific implementation of an embodiment of the present invention, in step S3, the threat fingerprint repository supports massive data storage, fast retrieval, multi-dimensional matching and real-time updates. The stored fingerprint information includes fingerprint type, extraction time, associated events, and trust metadata. Application layer traffic is captured passively and its inherent structural features are extracted. Protocol parsing, classification and difference recognition are performed in combination with formal grammar to achieve automated fingerprint generation.

[0017] According to a specific implementation of an embodiment of the present invention, in step S4, the at least three types of flight segments include: deep fingerprint information acquisition type, used to collect deep fingerprint information in an environment controlled by the attacker; remote control type, used to covertly reverse control of the attacker's environment; and important resource protection and vulnerability repair type, used to realize reverse tracking, trapping or misleading of attack behavior, and dynamic application security repair; and the flight segments are lightweight and highly covert, and can be dynamically applied at runtime without restarting the system or services.

[0018] According to a specific implementation of an embodiment of the present invention, in step S4, the precise delivery and deployment refers to: based on the analysis and tracing results of suspicious attack behavior, identifying the attacker's entry point, penetration path or C2 server, and using the identified vulnerabilities, social engineering or other covert channels for delivery, the deployment process has high concealment, persistence and anti-analysis capabilities.

[0019] According to a specific implementation of an embodiment of the present invention, in step S5, the code obfuscation is implemented from the perspective of data flow and control flow: data flow obfuscation includes sensitive data encryption and storage, data structure layout change, and variable splitting; control flow obfuscation includes loop type conversion, loop and recursion conversion, intermediate variable simplification, redundant or dead code insertion, indirect jump usage, and code block order adjustment; it also includes changing function names, variable names, class names, and strings to meaningless random values ​​or obfuscated characters, and encrypting sensitive strings.

[0020] According to a specific implementation of an embodiment of the present invention, in step S5, the packing process refers to encrypting and compressing the control software to form a "shell" to wrap the original code, decrypting and decompressing it at runtime and loading it into memory for execution, combining multi-layer packing, anti-debugging, anti-virtual machine, and self-modifying code technologies; in the cooperative mode, deep fingerprinting, covert reverse remote control, and key evidence collection are performed through flight segments; in the non-cooperative mode, attacker access is terminated and an alarm is issued.

[0021] Secondly, embodiments of the present invention provide a system for real-time threat early warning and proactive source tracing deterrence based on a lightweight triggering mechanism in a power system network, comprising:

[0022] The suspicious attack log generation and early warning module is used to pre-set access tripping barriers at key nodes of the power system network, monitor and capture abnormal behavior in real time, generate suspicious attack logs by combining hidden Markov models, and initiate immediate early warnings through various channels based on these logs.

[0023] The Advanced Threat Fingerprint Extraction and Repository module is used to extract browser fingerprints, operating system and hardware fingerprints, and special cyber weapon fingerprints from access data associated with abnormal behavior, and to build a threat fingerprint repository.

[0024] The flight segment generation and delivery module is used to generate at least three types of flight segments based on early warning results and fingerprint repository information, and combine the analysis and tracing results of suspicious attack behaviors to accurately deliver and deploy them to the target location.

[0025] The control software protection module is used to obfuscate and pack the control software.

[0026] The proactive source tracing and deterrence module is used to combine threat fingerprint database information to achieve proactive source tracing, evidence collection, and deterrence in both cooperative and non-cooperative modes.

[0027] The present invention has the following beneficial effects:

[0028] Improve the accuracy and timeliness of threat identification: By combining a lightweight triggering mechanism (lightweight tripwire) with a hidden Markov model, abnormal behavior is accurately captured and suspicious attack logs are generated, which significantly reduces the false alarm rate and meets the real-time requirements of the power system, solving the problems of lagging and high false alarm rate of traditional early warning mechanisms.

[0029] Strengthening attribution capabilities and deterrence: Extraction and repository construction of multi-dimensional threat fingerprints (browsers, hardware, special cyber weapons), supporting cross-platform and multi-stage attribution, combined with proactive countermeasures in cooperative / non-cooperative modes, significantly improving the success rate of attack attribution, increasing attacker costs and risks, and forming an effective deterrent.

[0030] Building a proactive defense closed loop: From generating suspicious attack logs and providing real-time early warnings, to accurately delivering flight segments and protecting control software, and then to proactive source tracing and deterrence, all links work together to achieve a paradigm shift from passive response to proactive defense, thereby enhancing the overall resilience of the power system network.

[0031] Adapting to the specific needs of power systems: Attack signature identification is designed for power system-specific protocols (such as IEC 61850 and DNP3), and flight segments support dynamic deployment of critical equipment without interrupting services, meeting the high availability and resource-constrained characteristics of power systems and solving the problem of insufficient compatibility of general security technologies.

[0032] Ensuring the system's own security: Through code obfuscation and packing, it effectively resists reverse analysis and tampering by attackers, ensuring the stable operation of the defense system and preventing security protection from failing due to its own breach. Attached Figure Description

[0033] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 This is a schematic diagram of a method for real-time threat early warning and proactive source tracing deterrence based on a lightweight triggering mechanism in a power system network, provided by an embodiment of the present invention.

[0035] Figure 2 This is a schematic diagram of another method for real-time threat early warning and proactive source tracing deterrence based on a lightweight triggering mechanism in a power system network, provided by an embodiment of the present invention.

[0036] Figure 3 This is a schematic diagram of the system structure for real-time threat early warning and proactive source tracing deterrence in a power system network based on a lightweight triggering mechanism, as provided in an embodiment of the present invention. Detailed Implementation

[0037] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0038] See Figure 1 and Figure 2 This invention provides a method for real-time threat early warning and proactive source tracing deterrence based on a lightweight triggering mechanism in power system networks, comprising the following steps:

[0039] Step S1: Pre-set access tripwires at key nodes of the power system network, monitor and capture abnormal behaviors that deviate from normal paths, permissions, or preset security policies in real time, and combine the Hidden Markov Model to model the normal behavior of users and system entities to generate suspicious attack logs.

[0040] Step S2: Based on the suspicious attack logs generated in Step S1, once the threat level is confirmed, initiate real-time alerts for users through various channels.

[0041] Step S3: Based on the access data associated with the abnormal behavior captured in Step S1, extract browser fingerprints, operating system and hardware fingerprints, and special network weapon fingerprints to build a threat fingerprint repository.

[0042] Step S4: Based on the warning results of Step S2 and the fingerprint repository information of Step S3, generate at least three types of flight segments, and then combine them with the analysis and tracing results of suspicious attack behaviors to accurately deliver them to the target location and deploy them.

[0043] Step S5: Obfuscate and pack the code of the control software supporting steps S1 to S4, and combine it with the fingerprint repository information from step S3 to achieve proactive source tracing, evidence collection and deterrence in both cooperative and non-cooperative modes.

[0044] This invention provides a method and system for real-time threat early warning and proactive source tracing deterrence in power system networks based on a lightweight triggering mechanism. (See also...) Figure 2 Its main functions and mechanisms include:

[0045] 1) Suspicious attack log generation and real-time early warning mechanism

[0046] This module is dedicated to achieving real-time and accurate detection of network threats and providing sufficiently supportive alert information.

[0047] Suspicious attack log generation:

[0048] By pre-setting access tripwires at key nodes in the power system network (such as SCADA systems, DCS systems, servers, gateways, and user terminals), the system monitors and captures abnormal behaviors that deviate from normal paths, permissions, or preset security policies in real time. These behaviors include, but are not limited to, abnormal login attempts, unauthorized file access, abnormal network connections, and privilege escalation. The captured abnormal behavior data is initially filtered, standardized, and structured to form a suspicious attack log for further analysis. The log should include key metadata such as timestamps, source / destination information, behavior type, and resources involved.

[0049] To improve the accuracy of identification and reduce the false alarm rate, this invention introduces a Hidden Markov Model (HMM) to learn and model the normal behavior of users and system entities (such as devices, applications, and services) over a long period. By learning normal state sequences and their transition probabilities, HMMs can construct a fine-grained behavioral baseline, capturing the temporal nature and inherent correlations of behavior. When real-time behavioral data is input into the established HMM model, the system calculates its matching degree or deviation from normal behavioral patterns. If the deviation exceeds a preset threshold, it is identified as an anomaly and recorded in the suspicious attack log, thus providing more supportive alert information. This behavior pattern-based anomaly detection method enables the system to discover unknown threats and variant attacks, significantly reducing the false alarm rate.

[0050] Real-time early warning mechanism:

[0051] Once the HMM detects a suspicious attack log and confirms its threat level, the system immediately triggers a user-facing security alert process. The alert system is designed for high-priority response, ensuring rapid information delivery. Alert methods are diverse and efficient, covering different receiving scenarios and user preferences. Common alert channels include email (suitable for conveying detailed information, but may be delayed due to spam filtering), Short Message Service (SMS) (high immediacy and delivery rate, suitable for emergencies), and in-application pop-ups (which can present alerts directly in the user's interface, reducing response time). Alert strategies should comprehensively consider the urgency of the alert, the amount of information, user preferences, and the receiving scenario.

[0052] Alert information should include not only the event itself, but also the context of the anomalous behavior based on HMM analysis, preliminary assessment results, suggested response measures, and links to relevant threat intelligence to improve the accuracy, understandability, and user decision-making basis of alerts. This detailed alert content aims to provide users with sufficient supporting information to help them quickly understand threats and take effective action.

[0053] 2) Multidimensional extraction of advanced threat fingerprints and construction of a threat fingerprint repository

[0054] This module focuses on building threat fingerprints that are highly concealed, unique, and persistent, providing core data for remote and legitimate forensic investigation.

[0055] Multidimensional fingerprint extraction:

[0056] This invention proposes a multidimensional fingerprint extraction method, covering the following aspects:

[0057] Browser fingerprinting: Extracts user browser configuration, plugin list, font information, screen resolution, Canvas fingerprint, WebGL fingerprint, WebRTC information, HTTP header information, etc. By combining these non-traditional identifiers, a highly unique browser fingerprint is formed.

[0058] Operating System and Hardware Fingerprinting: This involves extracting the operating system version, installed patch information, running service list, installed software list, and key hardware information such as hard drive serial number, MAC address, and CPU serial number. To address the cross-platform nature of physical devices, this patent selects representative combinations of hardware information and designs an architecture with expandable data types to adapt to future hardware diversity. In power system networks, this particularly includes the extraction of hardware identifiers specific to Industrial Control Systems (ICS) and Operational Technology (OT) equipment.

[0059] Specialized Cyber ​​Weapon Fingerprints: In-depth analysis of specific malware families, command and control (C2) communication protocol characteristics, attack toolchains, and vulnerability exploitation methods used in Advanced Persistent Threats (APTs) creates unique and difficult-to-forge specialized cyber weapon fingerprints. This includes attack characteristics targeting power system-specific protocols (such as IEC 61850 and DNP3).

[0060] To improve the efficiency and coverage of fingerprint extraction, this invention draws on advanced network fingerprinting technology, passively capturing application layer traffic and extracting its inherent structural features. It then combines formal grammars (such as Augmented Backus-NaurForm, ABNF) for protocol parsing, classification, and difference identification to achieve automated fingerprint generation. This method overcomes the labor-intensive problem of traditional manual signature matching, significantly improving the efficiency and accuracy of fingerprint extraction.

[0061] Threat fingerprint repository construction:

[0062] Establish a highly concealed, unique, and persistent threat fingerprint repository to store and manage all extracted multi-dimensional advanced threat fingerprints. The repository design should support massive data storage, rapid retrieval, multi-dimensional matching, and real-time updates. The fingerprint information in the repository should include metadata such as fingerprint type, extraction time, associated events, and trust level, providing comprehensive and reliable data support for subsequent attribution and deterrence.

[0063] 3) Generation and precise delivery of multiple flight segments

[0064] This module aims to proactively counter attacks and gather intelligence, promptly fix vulnerabilities, and reverse the information asymmetry between offense and defense.

[0065] Flight footage generation:

[0066] Based on the threat level of the attack and critical security requirements, this invention constructs no fewer than three types of on-the-fly segments. These binary segments are designed to be lightweight, highly stealthy, and possess specific functions, enabling dynamic application at runtime without requiring a system or service restart.

[0067] Deep fingerprinting-type fly-by fragments: Their core technology relies on advanced threat fingerprinting methods to further collect deeper, more valuable fingerprint information within attacker-controlled systems or network environments, such as the attacker's real IP address, toolchain, and operational habits. These binary fragments can be dynamically injected into infected processes or network traffic to capture real-time data.

[0068] Remotely controlled flight fragments: Their core technology relies on a remote control Trojan technique focused on attack, used to covertly reverse-engineer the attacker's environment, obtain more intelligence, and even perform limited countermeasures, such as file retrieval, screen capture, and process list acquisition. These binary fragments can dynamically modify the target system's behavior to achieve remote command execution.

[0069] Critical resource protection and vulnerability remediation-focused flight segments: These segments are bound to critical assets or sensitive data and trigger when these assets are threatened or accessed. They reverse-track, trap, or mislead attack behavior, thereby protecting critical resources and revealing attacker intent. Simultaneously, these patches can dynamically apply security fixes to identified vulnerabilities without service interruption, such as preventing exploitation through memory modifications or function hooks. This is particularly important for critical OT systems in power system networks that require high availability.

[0070] Precise delivery and deployment:

[0071] Based on the analysis and attribution of suspicious attack behaviors, the system identifies the attacker's entry point, penetration path, or C2 server. Utilizing identified vulnerabilities, social engineering, or other covert channels, it precisely delivers immediate patches to attacker-controlled systems or network environments, or to attacked power system equipment. The deployment process is highly covert, persistent, and resistant to analysis, making it difficult for attackers to detect and remove, ensuring the continued effectiveness of the immediate patches. This proactive deployment strategy enables the system to better survive and function in complex and adversarial network environments, and to promptly mitigate the risks of discovered vulnerabilities.

[0072] 4) Control software obfuscation and packing processing

[0073] This module aims to effectively protect the core security control software of this invention, preventing it from being discovered, reverse-engineered, and tampered with by attackers, thereby ensuring the robustness of the entire defense system.

[0074] Code obfuscation:

[0075] To conceal the intent of the control software and increase the difficulty for attackers to reverse engineer it, obfuscation of the control software is proposed. The obfuscation method will be implemented from both data flow and control flow perspectives:

[0076] Data flow obfuscation: Changing how data is stored and processed in a program, such as encrypting sensitive data, changing the data structure layout, splitting variables, etc.

[0077] Control flow obfuscation: Rewriting parts of the code logic, such as rewriting a for loop into a while loop, rewriting a loop into recursion, simplifying intermediate variables, inserting redundant or dead code, using indirect jumps, changing the order of code blocks, etc., makes the program execution path difficult to trace.

[0078] Name obfuscation: Changing function names, variable names, class names, and strings to meaningless random values ​​or obfuscated characters to obfuscate the control flow and data flow in the control software, greatly reducing code readability.

[0079] String encryption: Encrypt sensitive strings in the code and decrypt them only at runtime to prevent static analysis tools from directly extracting key information.

[0080] Shelling process:

[0081] To further increase the difficulty for attackers to reverse engineer the control software, a packer is proposed. First, the control software is encrypted and compressed, forming a "shell" that encapsulates the original code. The packed software is then decrypted and decompressed at runtime, loading the original code into memory for execution. This effectively evades static analysis and increases the difficulty of dynamic analysis. This can be combined with advanced packer techniques such as multi-layer packing, anti-debugging, anti-virtual machine, and self-modifying code to further increase the difficulty of reverse engineering, making it even harder to detect and analyze.

[0082] 5) Continuous and stable proactive traceability and evidence collection technology

[0083] To eliminate the impact of fingerprint changes on attribution tracing, the system needs to collect attack fingerprint information captured at different time stages of flight segments. A correlation analysis model for multi-stage attribution forensics information is established based on time series data. Fingerprint information at each stage is correlated and compared to identify the attacker's activity trajectory and identity evolution at different stages. Advanced multi-stage fingerprint matching authentication and intelligent correlation algorithms are employed to ensure the accuracy and completeness of attribution tracing, effectively tracking attackers even if they attempt to change their fingerprint characteristics.

[0084] The source tracing and deterrence phase aims to effectively track and gather evidence against the source of an attack by collecting the attacker's fingerprint information and behavioral patterns. Its core deterrence mechanism can be summarized into the following two modes:

[0085] Source tracing and evidence collection in a collaborative mode:

[0086] The system initiates simulated real-world authentication against potential attackers who trigger the alert, requiring them to install a "tracking application" when attempting to access or further penetrate the power system network. If the attacker chooses to cooperate by installing these flight clips, the system will be able to:

[0087] Deep fingerprinting: Designed to collect deeper and more valuable fingerprint information in attacker-controlled systems or network environments, such as the attacker's real IP address, toolchain, and operating habits.

[0088] Covert reverse remote control: Some flight segments have remote control capabilities, enabling covert reverse control of the attacker's environment to obtain more intelligence and even carry out limited countermeasures.

[0089] Key Evidence Collection: The fingerprint information and behavioral data collected through the fly patch will serve as key evidence, greatly facilitating subsequent source tracing and evidence collection work, and helping to identify the attacker's identity, analyze attack paths and methods.

[0090] Deterrence and termination of access in non-cooperative mode:

[0091] If the attacker does not cooperate in installing these flight fragments, the system will terminate their access to the power system network and issue a warning. This coercive mechanism is designed to create a strong deterrent, forcing attackers to reassess the costs and risks of their attack.

[0092] Increased attack costs: Attackers must face the risk of being tracked if they want to continue their attacks, or abandon their current attacks, which increases the complexity and cost of their attacks.

[0093] Preventing Attack Attempts: Faced with this "either be tracked or inaccessible" choice, many attackers may choose to terminate their attack, thereby achieving a deterrent effect.

[0094] Achieving effective defense: Even if the attacker does not cooperate, the system can prevent further malicious activities by terminating access, thus achieving effective defense in non-cooperative mode.

[0095] Key technical steps and technical effects

[0096] 1) Suspicious attack log generation

[0097] The generation of suspicious attack logs is a crucial step in implementing an instant alert mechanism. This process focuses on the accurate identification and recording of abnormal behavior at pre-defined access checkpoints, aiming to capture potential intrusion attempts in real time and provide cybersecurity personnel with immediate alerts for rapid response and threat mitigation. Log entries typically contain, but are not limited to, the following key elements, which together constitute an accurate description of the access event:

[0098] Attempted login time: Accurately recording the timestamp of the event helps to locate the attack window and provides a basis for subsequent time series analysis.

[0099] Instance ID: Identifies the accessed tripped instance, facilitating quick location of affected resources and enabling targeted protective measures.

[0100] Attacker IP: Records the source IP address that initiated the abnormal access request, providing clues for tracing the source of the attack and implementing countermeasures.

[0101] Instance host IP: Indicates the physical or virtual host IP address where the target resource is located, which helps to understand the attack path and potential vulnerability points in the network architecture.

[0102] 2) User-facing security alerts

[0103] Upon detecting a suspicious attack, the instant alert mechanism quickly initiates a user-facing security alert process, ensuring that the alert information generated in step 1) is promptly delivered to relevant personnel. Alert methods need to be diverse and efficient to cover different receiving scenarios and user preferences. Common alert channels include email, SMS, and in-app pop-ups, each with its advantages and limitations. For example, email is suitable for conveying detailed information but may be delayed due to spam filtering; SMS offers high immediacy and delivery rates, making it suitable for emergencies; while in-app pop-ups can directly present alerts within the user's interface, reducing response time. Therefore, when designing alert strategies, various factors should be considered comprehensively, such as the urgency of the alert, the recipient's geographical location and device type, and the organization's communication policies, to ensure effective dissemination and timely response to alert information.

[0104] Meanwhile, to provide users with sufficiently supportive alert information, this patent additionally introduces a Hidden Markov Model (HMM) to model normal user behavior and uses anomaly detection to identify patterns that deviate from normal behavior. Assume an HMM model is H, with state transition probability matrix A, observation probability matrix B, and initial state probability vector π. For an observation sequence O, a forward algorithm can be used to calculate the probability P(O|H) that the sequence belongs to the model.

[0105]

[0106] in, At any moment In state The probability, From state Transition to state The probability, It is in state The following observations The probability of.

[0107] Threat context data is provided for use in step 4) to construct flight segments and subsequent steps.

[0108] 3) Advanced Threat Fingerprint Extraction Methods

[0109] For remote, legitimate forensic investigation, this project implements a multi-dimensional advanced threat fingerprint extraction algorithm based on software and hardware characteristics. This algorithm generates highly concealed, unique, and persistent advanced threat fingerprints, focusing on collecting browser fingerprints, operating system and hardware fingerprints, and fingerprints of special cyber weapons. A unique, high-value threat fingerprint repository is also constructed. Furthermore, the project optimizes threat fingerprint extraction technology to enhance its concealment and uniqueness, utilizing technologies including, but not limited to, cryptography, data mining, and blockchain.

[0110] Taking hardware fingerprint extraction as an example, to address the cross-platform nature of physical devices, representative hardware information is selected to generate fingerprint information, mainly including three parts: hard drive serial number, MAC address, and CPU serial number. The hard drive serial number is a unique serial number set by the manufacturer at the time of manufacture, typically 10 or 12 digits. The MAC address (Media Access Control Address) is a 48-bit number used to uniquely identify the network card. The CPU serial number is a unique, unmodifiable 96-bit number within the processor. The data types required to extract the visitor's fingerprint are expandable; here, only three common types of hardware information are used to illustrate the fingerprint generation process. To represent the hard drive's serial number, use To represent the MAC address, use This represents the CPU's serial number. These three parts are then used together in a hash function. Parameters:

[0111]

[0112] Among them, the function This indicates that the hard drive serial number will be extended to 112 bits, using a function. Output As a fingerprint of the service visitor.

[0113] Fingerprint collection is completed by the flight segment constructed in step 4). The fingerprint information will be correlated and analyzed with the fingerprint database to ultimately achieve multi-stage fingerprint association, supporting step 5) to achieve adhesion-based traceability and evidence collection.

[0114] 4) Flight segment construction, delivery, and deployment methods

[0115] This technology generates multiple types of flight segments for the purposes of reverse tracking of attack behaviors, covert reverse remote control, and binding of critical devices. It enables precise delivery and deployment of flight segments in cyberattack reconnaissance environments. Based on the different threat levels of attack behaviors and critical security needs, it constructs no fewer than three types of flight segments to serve deep fingerprint information collection, remote control, and protection of critical resources. Furthermore, it implements a method for delivering and deploying flight segments triggered by suspicious attack behaviors. Through real-time response, it rapidly forms spillover countermeasures against attacking adversaries, shifting the reconnaissance and detection position to the left.

[0116] Among them, the flight segment serving deep fingerprint information collection relies on advanced threat fingerprint extraction methods as its core technology; the flight segment serving remote control relies on a remote control Trojan technology that focuses on attacks; and the flight segment serving important resource protection, based on white device authentication, realizes the integration of the first two types of technologies. For example, fingerprint collection is used to verify the security status of the device, while the remote control Trojan is used to prevent white devices from becoming victim hosts without their knowledge.

[0117] To address the implementation of remote control Trojan technology, a control software based on a browser plugin is proposed, which has the following three characteristics:

[0118] Expandable functionality: This control software runs on a browser and has capabilities such as remote communication, stealing attacker data, and downloading resources;

[0119] Environment adaptability: The control software should be compatible with mainstream operating systems such as Windows and Linux, and mainstream browsers such as Firefox, IE, and Chrome;

[0120] The software should be able to conceal its presence: it should possess a certain degree of firewall penetration and antivirus software evasion capability. Simultaneously, it should have log erasure capabilities to ensure sufficient persistence time with the attacker.

[0121] 5) Proactive source tracing and evidence collection

[0122] Source tracing deterrence aims to effectively track and gather evidence against the source of an attack by collecting the attacker's fingerprint information and behavioral patterns (step 3). The system employs a fragment-flying technology to build a dedicated code repository, integrating a series of special codes to collect attacker information (step 4). Combined with an intelligent fragment-flying delivery strategy, the system can dynamically adjust its response based on the attacker's behavior. This process not only helps collect crucial evidence of the attack source in cooperative mode but also serves as a deterrent to prevent future attack attempts, achieving effective defense in non-cooperative mode.

[0123] According to a specific implementation of an embodiment of the present invention, in step S1, the abnormal behavior includes abnormal login attempts, unauthorized file access, abnormal network connections, and privilege escalation; the captured abnormal behavior data is initially filtered, standardized, and structured, and the generated suspicious attack log includes timestamps, source / destination information, behavior type, and key metadata of the resources involved; the hidden Markov model constructs a behavior baseline by learning normal state sequences and their transition probabilities, and when the deviation between real-time behavior data and normal behavior patterns exceeds a preset threshold, it is identified as abnormal and recorded in the suspicious attack log.

[0124] According to a specific implementation of an embodiment of the present invention, in step S2, the diversified channels include email, SMS service, and in-application pop-ups; the alarm information of the real-time warning includes the event itself, the abnormal behavior context based on Hidden Markov Model analysis, preliminary judgment results, suggested response measures, and related threat intelligence links, and the alarm process is a high-priority response.

[0125] According to a specific implementation of an embodiment of the present invention, in step S3, the browser fingerprint includes user browser configuration, plugin list, font information, screen resolution, Canvas fingerprint, WebGL fingerprint, WebRTC information, and HTTP header information; the operating system and hardware fingerprint includes operating system version, installed patch information, running service list, installed software list, hard disk serial number, MAC address, and CPU serial number, and the data types can be expanded to cope with cross-platform characteristics; the special network weapon fingerprint includes specific malware family characteristics, command and control (C2) communication protocol characteristics, attack toolchain, vulnerability exploitation methods, and includes attack characteristics targeting power system-specific protocols (IEC61850, DNP3).

[0126] According to a specific implementation of an embodiment of the present invention, in step S3, the threat fingerprint repository supports massive data storage, fast retrieval, multi-dimensional matching and real-time updates. The stored fingerprint information includes fingerprint type, extraction time, associated events, and trust metadata. Application layer traffic is captured passively and its inherent structural features are extracted. Protocol parsing, classification and difference recognition are performed in combination with formal grammar to achieve automated fingerprint generation.

[0127] According to a specific implementation of an embodiment of the present invention, in step S4, the at least three types of flight segments include: deep fingerprint information acquisition type, used to collect deep fingerprint information in an environment controlled by the attacker; remote control type, used to covertly reverse control of the attacker's environment; and important resource protection and vulnerability repair type, used to realize reverse tracking, trapping or misleading of attack behavior, and dynamic application security repair; and the flight segments are lightweight and highly covert, and can be dynamically applied at runtime without restarting the system or services.

[0128] According to a specific implementation of an embodiment of the present invention, in step S4, the precise delivery and deployment refers to: based on the analysis and tracing results of suspicious attack behavior, identifying the attacker's entry point, penetration path or C2 server, and using the identified vulnerabilities, social engineering or other covert channels for delivery, the deployment process has high concealment, persistence and anti-analysis capabilities.

[0129] According to a specific implementation of an embodiment of the present invention, in step S5, the code obfuscation is implemented from the perspective of data flow and control flow: data flow obfuscation includes sensitive data encryption and storage, data structure layout change, and variable splitting; control flow obfuscation includes loop type conversion, loop and recursion conversion, intermediate variable simplification, redundant or dead code insertion, indirect jump usage, and code block order adjustment; it also includes changing function names, variable names, class names, and strings to meaningless random values ​​or obfuscated characters, and encrypting sensitive strings.

[0130] According to a specific implementation of an embodiment of the present invention, in step S5, the packing process refers to encrypting and compressing the control software to form a "shell" to wrap the original code, decrypting and decompressing it at runtime and loading it into memory for execution, combining multi-layer packing, anti-debugging, anti-virtual machine, and self-modifying code technologies; in the cooperative mode, deep fingerprinting, covert reverse remote control, and key evidence collection are performed through flight segments; in the non-cooperative mode, attacker access is terminated and an alarm is issued.

[0131] For the method described above, see [link to relevant documentation]. Figure 3 The present invention also provides a system for real-time threat early warning and proactive source tracing deterrence based on a lightweight triggering mechanism in power system networks, comprising:

[0132] The suspicious attack log generation and early warning module is used to pre-set access tripping barriers at key nodes of the power system network, monitor and capture abnormal behavior in real time, generate suspicious attack logs by combining hidden Markov models, and initiate immediate early warnings through various channels based on these logs.

[0133] The Advanced Threat Fingerprint Extraction and Repository module is used to extract browser fingerprints, operating system and hardware fingerprints, and special cyber weapon fingerprints from access data associated with abnormal behavior, and to build a threat fingerprint repository.

[0134] The flight segment generation and delivery module is used to generate at least three types of flight segments based on early warning results and fingerprint repository information, and combine the analysis and tracing results of suspicious attack behaviors to accurately deliver and deploy them to the target location.

[0135] The control software protection module is used to obfuscate and pack the control software.

[0136] The proactive source tracing and deterrence module is used to combine threat fingerprint database information to achieve proactive source tracing, evidence collection, and deterrence in both cooperative and non-cooperative modes.

[0137] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for real-time threat early warning and proactive source tracing deterrence based on a lightweight triggering mechanism in power system networks, characterized in that, Includes the following steps: Step S1: Pre-set access tripwires at key nodes of the power system network, monitor and capture abnormal behaviors that deviate from normal paths, permissions, or preset security policies in real time, and combine the Hidden Markov Model to model the normal behavior of users and system entities to generate suspicious attack logs. Step S2: Based on the suspicious attack logs generated in Step S1, once the threat level is confirmed, initiate real-time alerts for users through various channels. Step S3: Based on the access data associated with the abnormal behavior captured in Step S1, extract browser fingerprints, operating system and hardware fingerprints, and special network weapon fingerprints to build a threat fingerprint repository. Step S4: Based on the warning results of Step S2 and the fingerprint repository information of Step S3, generate at least three types of flight segments, and then combine them with the analysis and tracing results of suspicious attack behaviors to accurately deliver them to the target location and deploy them. Step S5: Obfuscate and pack the code of the control software supporting steps S1 to S4, and combine it with the fingerprint repository information from step S3 to achieve proactive source tracing, evidence collection and deterrence in both cooperative and non-cooperative modes.

2. The method according to claim 1, characterized in that, In step S1, the abnormal behaviors include abnormal login attempts, unauthorized file access, abnormal network connections, and privilege escalation. The captured abnormal behavior data is initially filtered, standardized, and structured. The generated suspicious attack log includes timestamps, source / destination information, behavior type, and key metadata of the resources involved. The hidden Markov model constructs a behavior baseline by learning normal state sequences and their transition probabilities. When the deviation between real-time behavior data and normal behavior patterns exceeds a preset threshold, it is identified as abnormal and recorded in the suspicious attack log.

3. The method according to claim 1, characterized in that, In step S2, the diverse channels include email, SMS, and in-application pop-ups; the alert information of the real-time warning includes the event itself, the abnormal behavior context based on Hidden Markov Model analysis, preliminary judgment results, suggested response measures, and related threat intelligence links, and the alert process is a high-priority response.

4. The method according to claim 3, characterized in that, In step S3, the browser fingerprint includes user browser configuration, plugin list, font information, screen resolution, Canvas fingerprint, WebGL fingerprint, WebRTC information, and HTTP header information; the operating system and hardware fingerprint includes operating system version, installed patch information, running service list, installed software list, hard disk serial number, MAC address, and CPU serial number, and the data types can be expanded to cope with cross-platform characteristics; the special network weapon fingerprint includes specific malware family characteristics, command and control (C2) communication protocol characteristics, attack toolchain, vulnerability exploitation methods, and includes attack characteristics targeting power system-specific protocols (IEC61850, DNP3).

5. The method according to claim 4, characterized in that, In step S3, the threat fingerprint repository supports massive data storage, fast retrieval, multi-dimensional matching, and real-time updates. The stored fingerprint information includes fingerprint type, extraction time, associated events, and trust metadata. It passively captures application-layer traffic and extracts its inherent structural features. Combining formal grammars with protocol parsing, classification, and difference identification enables automated fingerprint generation.

6. The method according to claim 4, characterized in that, In step S4, the at least three types of flight segments include: deep fingerprint information acquisition type, used to collect deep fingerprint information in an environment controlled by the attacker; remote control type, used to covertly reverse control of the attacker's environment; and important resource protection and vulnerability repair type, used to achieve reverse tracking, trapping or misleading of attack behavior, and dynamic application security repair; and the flight segments are lightweight and highly covert, and can be dynamically applied at runtime without restarting the system or services.

7. The method according to claim 1, characterized in that, In step S4, the precise delivery and deployment refers to: based on the analysis and tracing results of suspicious attack behavior, identifying the attacker's entry point, penetration path or C2 server, and using the identified vulnerabilities, social engineering or other covert channels to deliver the attack. The deployment process has high concealment, persistence and anti-analysis capabilities.

8. The method according to claim 1, characterized in that, In step S5, the code obfuscation is implemented from the perspectives of data flow and control flow: data flow obfuscation includes encrypting and storing sensitive data, changing the data structure layout, and splitting variables; control flow obfuscation includes loop type conversion, loop and recursion conversion, simplification of intermediate variables, insertion of redundant or dead code, use of indirect jumps, and adjustment of code block order; it also includes changing function names, variable names, class names, and strings to meaningless random values ​​or obfuscated characters, and encrypting sensitive strings.

9. The method according to claim 8, characterized in that, In step S5, the packing process refers to encrypting and compressing the control software to form a "shell" that wraps the original code. At runtime, the code is decrypted, decompressed, and loaded into memory for execution, combining multi-layer packing, anti-debugging, anti-virtual machine, and self-modifying code technologies. In the cooperative mode, deep fingerprinting, covert reverse remote control, and key evidence collection are performed through flight segments. In the non-cooperative mode, attacker access is terminated and an alarm is issued.

10. A system for real-time threat early warning and proactive source tracing deterrence based on a lightweight triggering mechanism in a power system network, characterized in that, include: The suspicious attack log generation and early warning module is used to pre-set access tripping barriers at key nodes of the power system network, monitor and capture abnormal behavior in real time, generate suspicious attack logs by combining hidden Markov models, and initiate immediate early warnings through various channels based on these logs. The Advanced Threat Fingerprint Extraction and Repository module is used to extract browser fingerprints, operating system and hardware fingerprints, and special cyber weapon fingerprints from access data associated with abnormal behavior, and to build a threat fingerprint repository. The flight segment generation and delivery module is used to generate at least three types of flight segments based on early warning results and fingerprint repository information, and combine the analysis and tracing results of suspicious attack behaviors to accurately deliver and deploy them to the target location. The control software protection module is used to obfuscate and pack the control software. The proactive source tracing and deterrence module is used to combine threat fingerprint database information to achieve proactive source tracing, evidence collection, and deterrence in both cooperative and non-cooperative modes.

Images