An artificial intelligence-based power industrial control system malware identification analysis method

Abstract

The application relates to the technical field of malware identification analysis, and discloses a power industrial control system malware identification analysis method based on artificial intelligence, which comprises the following steps: collecting static running sample data and dynamic running sample data of software in a power working condition system in a software test environment and performing feature extraction; performing feature fusion on static feature sequences and dynamic feature sequences by using a physical information neural network based on an improved feature dimension reduction strategy; and classifying the fusion features of the software by using a local mean neighbor classification model of a fusion heuristic algorithm to obtain the software categories corresponding to the fusion features. The application realizes self-adaptive fusion of features by combining the improved feature dimension reduction and the physical information neural network, realizes higher classification accuracy and robustness under the support of optimal subset and neighbor number selection by combining the local mean neighbor classification method of the heuristic algorithm, and thus effectively improves the identification performance of the power industrial control system malware.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of malware identification, and in particular to an artificial intelligence-based power industrial control system malware identification analysis method. BACKGROUND

[0002] With the rapid development of information technology, the power industry has gradually transformed towards automation, informatization and digitization, and the core infrastructure of the power industry, the power industrial control system, has also developed greatly in this process. The power industrial control system is mainly used in power production, transmission, distribution, control and dispatching, etc., to ensure the safe, stable and efficient operation of the power system. However, the intelligentization and networking of the power industrial control system also exposes it to the risk of various network attacks, especially in the aspect of malware attacks. Traditional power industrial control systems are often composed of specialized hardware and operating systems, with a closed and relatively fixed internal environment, resulting in relatively weak defense capabilities. With the deepening of networking and automation, many power industrial control systems have been connected with external Internet or other information systems, making them vulnerable to malware attacks from the network.

[0003] Malware poses a serious threat to power industrial control systems, as it can disrupt the normal operation of the system, steal sensitive information or tamper with control instructions, leading to power equipment failure, power interruption, and even large-scale power accidents. Malware attacks have also posed a great threat to industrial control systems around the world. Therefore, identifying and defending against malware in power industrial control systems has become an important issue in the current field of power information security.

[0004] Current research attempts to introduce machine learning to improve the accuracy of malware identification. For example, patent

[0005] CN107742079B proposes a malware identification method and system, which runs the application to be identified in a sandbox, records the enabling of a plurality of pre-selected specific underlying functions during the running of the application to be identified, to generate a sample vector corresponding to the behavior chain of the application to be identified, obtains a malware identification model, and uses machine learning to identify and classify the sample vector to obtain the identification result of the application to be identified, thereby timely and accurately determining whether it is malware, and achieving efficient judgment of malware. However, this method mainly relies on running the application in a sandbox and recording the calling of specific underlying functions, only forming limited behavior chain features, which are difficult to fully reflect the behavior characteristics of malware in system calls, protocol interactions, etc., resulting in missing feature information. SUMMARY

[0006] In view of this, the present application provides an artificial intelligence-based power industrial control system malware identification analysis method, aiming at the problems of difficulty in unified modeling of multi-source heterogeneous data, feature redundancy leading to classification precision decline, and insufficient adaptability of traditional classification methods to complex industrial control features in power industrial control system malware identification, through software test environment deployment and multi-modal sample collection, comprehensive feature coverage of power industrial control software in static and dynamic dimensions is realized, feature missing caused by single perspective is avoided, instruction call graph, control logic features, protocol interaction logs, memory access behaviors are serialized and numerical modeling, the expression ability of industrial control field features is significantly improved, an improved feature dimension reduction strategy and physical information neural network fusion are introduced, while ensuring the complementarity of multi-source features, the interference of redundant and noise features on classification is suppressed, the discriminability and generalization of feature representation are improved, and then a local mean neighbor classification method combined with a fusion heuristic algorithm is used, while solving the problems of fuzzy boundary between industrial control software categories and large intra-class difference, high-precision identification of malware categories is realized.

[0007] To achieve the above-mentioned purpose, the present application provides an artificial intelligence-based power industrial control system malware identification analysis method, comprising the following steps:

[0008] S1: Deploying a software test environment, collecting static running sample data and dynamic running sample data of software in the power industrial control system under the software test environment;

[0009] S2: Extracting static features from the static running sample data to obtain the static feature sequence of the software, and extracting dynamic features from the dynamic running sample data to obtain the dynamic feature sequence of the software;

[0010] S3: Using a physical information neural network based on an improved feature dimension reduction strategy to fuse the static feature sequence and the dynamic feature sequence to obtain the fusion features of the software;

[0011] S4: Using a local mean neighbor classification model of a fusion heuristic algorithm to classify the fusion features of the software to obtain the software category corresponding to the fusion features, and identifying the power industrial control system malware based on the software category.

[0012] As a further improved method of the present application:

[0013] Further, collecting static running sample data and dynamic running sample data of software in the power industrial control system under the software test environment comprises:

[0014] The software in the power industrial control system is composed of original PLC firmware, HMI application installation package and SCADA software;

[0015] The static running sample data collection process of the software is:

[0016] The software is unpacked, the HMI application installation package and the executable file of the SCADA software in the software are extracted, and the hash value of the file name of the executable file is calculated. The executable file is deduplicated based on the hash value to obtain the deduplicated executable file;

[0017] The deduplicated executable file is disassembled to obtain the instruction sequence of the executable file;

[0018] The original PLC firmware in the software is decoded to generate a PLC control logic node sequence of the software, wherein the PLC control logic node sequence is composed of PLC control logic nodes;

[0019] Extract the visible string in the instruction sequence of the executable file as the string text sequence of the software;

[0020] The instruction sequence of the executable file, the PLC control logic node sequence, and the string text sequence are taken as the static running sample data of the software;

[0021] The dynamic running sample data collection process of the software is:

[0022] The software test environment generates a software running instance, monitors the running process of the software, and captures the system call log in the software running process, wherein the system call log includes the call type, the call parameter, and the call timestamp;

[0023] Capture the function call sequence in the executable file of the HMI application installation package and the SCADA software in the software running process;

[0024] Capture the memory access log of the register in the original PLC firmware in the software running process;

[0025] Capture the protocol interaction log of the industrial protocol and the network protocol in the software running process;

[0026] The system call log, the function call sequence, the memory access log, and the protocol interaction log are taken as the dynamic running sample data of the software.

[0027] Further, static feature extraction is performed on the static running sample data to obtain a static feature sequence of the software, including:

[0028] Extract the static running sample data of the software;

[0029] Convert the instruction sequence of the executable file into an instruction call graph, wherein the instruction call graph is in the form of a directed graph structure;

[0030] The instruction call graph is converted into an instruction call graph adjacency matrix. In the instruction call graph adjacency matrix, if there is a pointing relationship between instructions, the corresponding position element is 1; otherwise, the corresponding position element is 0.

[0031] The PLC control logic node sequence is converted into a PLC logic call graph, which is a directed graph structure.

[0032] The PLC logic call diagram is converted into a PLC logic call diagram adjacency matrix. In the PLC logic call diagram adjacency matrix, if there is a pointing relationship between PLC control logic nodes, the corresponding position element is 1; otherwise, the corresponding position element is 0.

[0033] The visible strings in the string text sequence are converted into binary form to obtain binary bit strings, and then the binary bit strings are converted into bytecode sequences, where the bytecode sequence consists of multiple bytecodes, each storing 8 bits of binary code;

[0034] Each bytecode is mapped to a range of 0-255 as a pixel value to obtain the bytecode image of the string text sequence;

[0035] The software instruction call graph adjacency matrix, PLC logic call graph adjacency matrix, and bytecode image are used as static features to form a static feature sequence.

[0036] Furthermore, dynamic feature extraction is performed on the dynamically running sample data to obtain the dynamic feature sequence of the software, including:

[0037] Extract dynamic runtime sample data of the software and convert the function call sequence into a function call graph, where the function call graph is in the form of a directed graph.

[0038] The function call graph is converted into a function call graph adjacency matrix. In the function call graph adjacency matrix, if there is a pointing relationship between functions, the corresponding position element is 1; otherwise, the corresponding position element is 0.

[0039] Extract memory access logs and calculate the software's memory characteristics, including the frequency distribution of memory addresses, the read-write ratio, and the average access size. The frequency distribution of memory addresses is the access frequency of different memory addresses, the read-write ratio is the ratio between the number of read operations and the number of write operations in the memory access log, and the average access size is the average number of bytes accessed in memory.

[0040] Extract the protocol interaction logs and calculate the protocol characteristics of the software, including the frequency distribution of register addresses, register read / write ratio, and average response latency.

[0041] extracting system call logs, and calculating system features of the software, wherein the system features include frequency distribution of different call types, mean of system call time interval, variance of system call time interval, and transition matrix of call types;

[0042] The function call graph adjacency matrix, the memory feature, the protocol feature, and the system feature are taken as dynamic features of the software, and form a dynamic feature sequence of the software.

[0043] Further, the physical information neural network based on the improved feature dimension reduction strategy comprises an input layer, a graph dimension reduction layer, a feature dimension reduction layer with fusion entropy attention, a convolution layer, a hidden layer, a physical information probability classification layer, and a fusion layer, and comprises the following:

[0044] obtaining a training data set, wherein the training data set is composed of M training data subsets of software categories, each training data subset includes multiple groups of training data, and each group of training data includes a static feature sequence, a dynamic feature sequence, and a real software category;

[0045] The input layer is used for receiving and standardizing the static feature sequence and the dynamic feature sequence;

[0046] The graph dimension reduction layer, the feature dimension reduction layer with fusion entropy attention, and the convolution layer sequentially perform dimension reduction processing on the standardized matrix, the non-matrix, and the bytecode image respectively, to obtain corresponding reduced features;

[0047] The graph dimension reduction layer is used for performing graph convolution and dimension reduction processing on the standardized matrix to obtain a graph dimension reduction vector, wherein the standardized matrix includes a standardized instruction call graph adjacency matrix, a PLC logic call graph adjacency matrix, and a transition matrix of call types;

[0048] The feature dimension reduction layer with fusion entropy attention is used for calculating the feature entropy attention weight of the standardized non-matrix, weighting the standardized non-matrix, and reducing the proportion of unimportant features;

[0049] The convolution layer is used for performing down-sampling convolution processing on the bytecode image to obtain a reduced feature map of the bytecode image;

[0050] The hidden layer is used for performing nonlinear mapping on the reduced features to obtain nonlinear features, wherein the hidden layer includes a fully connected layer, an activation function, and a batch normalization layer, and the nonlinear mapping is performed based on the fully connected layer, the activation function, and the batch normalization layer;

[0051] The physical information probability classification layer adopts a Parzen window function and a Bayesian probability to generate a probability distribution of the nonlinear features in different software categories;

[0052] The fusion layer is used for splicing the nonlinear features and the probability distribution as the fusion features F of the software.

[0053] Further, the physical information neural network based on the improved feature dimension reduction strategy is used for feature fusion of the static feature sequence and the dynamic feature sequence, including:

[0054] The graph dimension reduction layer performs the graph convolution and dimension reduction processing on the normalized matrix, and the process is as follows:

[0055] The normalized matrix is normalized to obtain a normalized result, and the normalization operation is as follows: , wherein represents a unit matrix, C represents the normalized matrix, represents the normalized result of C;

[0056] The normalized result is generated.

[0057] Based on the normalized result and the degree matrix D, the graph convolution processing is performed to obtain a graph convolution feature map H:

[0058] ;

[0059] ;

[0060] wherein A represents an intermediate parameter, represents a ReLU function, represents a function, all of which are trainable graph convolution weight matrices;

[0061] The graph convolution feature map H is averaged for all rows to obtain a graph dimension reduction vector corresponding to the normalized matrix;

[0062] The feature entropy attention weight calculation process of the feature entropy attention based feature dimension reduction layer is as follows:

[0063] The normalized non-matrix is obtained, the deviation between the normalized non-matrix and the associated standard feature is calculated, and the deviation is mapped to an adaptive weighting coefficient :

[0064] ;

[0065] ;

[0066] wherein, denotes an exponential function with a natural constant as base, denotes a scaling parameter is a transposed parameter denotes a power parameter

[0067] based on the adaptive weighting coefficient a normalized non-matrix feature entropy attention weight:

[0068] ;

[0069] ;

[0070] wherein, denotes a normalized non-matrix feature entropy attention weight, denotes a normalized non-matrix feature entropy, denotes a normalized non-matrix set, denotes any normalized non-matrix in the normalized non-matrix set , denotes an adaptive weighting coefficient of j, denotes an attention control coefficient denotes an attention smoothing term;

[0071] The fusion layer is used for splicing the non-linear features and the probability distribution as the fusion feature F of the software.

[0072] Further, a local mean nearest neighbor classification model adopting a fusion heuristic algorithm is used to classify the fusion feature of the software to obtain the software category corresponding to the fusion feature, including:

[0073] The local mean nearest neighbor classification model includes a subset determination module based on a heuristic algorithm, a nearest neighbor estimation module and a software category prediction module.

[0074] The subset determination module based on the heuristic algorithm determines the optimal training data subset set in which the fusion feature F of the software is located and the number K of nearest neighbors by using the heuristic algorithm, and the optimal training data subset set is composed of S optimal training data subsets determined by the heuristic algorithm.

[0075] The nearest neighbor estimation module is used to calculate the distance between the fusion feature of the software and the fusion feature of any training data in the optimal training data subset, and extract the fusion features of the K nearest training data from the optimal training data subset to calculate the local centroid mean vector of the optimal training data subset.

[0076] The software category prediction module is configured to calculate distances between the fusion feature F of the software and the local centroid mean vectors of each optimal training data subset, and select a software category corresponding to a local centroid mean vector with the smallest distance as a software category corresponding to the fusion feature F.

[0077] Further, a heuristic algorithm is used to determine the optimal training data subset set and the number K of neighbors in which the fusion feature F of the software is located, including:

[0078] The heuristic algorithm is an improved sparrow search algorithm;

[0079] A B group of sparrow positions are initialized, each sparrow position including a number of S training data subsets and a number of neighbors;

[0080] A fitness function taking the sparrow position as input is constructed:

[0081] ;

[0082] wherein loc represents the sparrow position, is the fitness function, represents a fitness function value of the sparrow position, represents a fusion feature mean value of any training data in the z-th training data subset in the sparrow position loc, and F represents the fusion feature of the software, represents a distance between the fusion feature mean value and F, is the number of neighbors in the sparrow position loc;

[0083] The sparrow positions are sorted in ascending order of the fitness function values, and the first 20% of the sparrow positions are selected as found positions, the last 20% of the sparrow positions are selected as alert positions, and the other sparrow positions are selected as following positions. Based on the improved adaptive mutation factor, the sparrow positions are iterated until the number of iterations reaches a preset maximum iteration number (e.g., 50), the iteration is terminated, and the sparrow position with the minimum current fitness function is output. Based on the output sparrow position, the optimal training data subset set and the number K of neighbors in which the fusion feature F is located are selected;

[0084] The improved adaptive mutation factor is:

[0085] ;

[0086] wherein represents the adaptive mutation factor of the sparrow position at the q-th iteration, represents a t-distribution, represents a proportion factor, represents a critical iteration value.

[0087] Compared with the prior art, the application provides an artificial intelligence-based malicious software identification analysis method for a power industrial control system, which has the following beneficial effects:

[0088] First, the application takes the instruction sequence of the executable file, the PLC control logic node sequence and the string text sequence as static running sample data, which can comprehensively reflect the structural features and logical features of the power industrial control system software at the code level, facilitating the identification of malicious implanted instructions, abnormal logic or fake identification information; meanwhile, the application takes the system call log, the function call sequence, the memory access log and the protocol interaction log as dynamic running sample data, which can then depict the behavior mode of the software in the execution process and capture abnormal system calls, illegal memory operations and abnormal communication behaviors. Through the combination of static and dynamic running sample data, the application can realize all-around feature extraction from code to behavior, improve the accuracy and robustness of malicious software identification and ensure the safety of the power industrial control system.

[0089] Meanwhile, the application combines the improved feature dimension reduction strategy with the physical information neural network, adaptively fuses the features processed by the graph convolution and the degree matrix, can significantly enhance the distinguishing ability of feature expression, wherein the adaptive weighting mechanism and the bias mapping function are introduced, so that the features are more sensitive to key patterns, while suppressing noise or irrelevant information, improving the identification accuracy of abnormal behaviors or malicious software. In addition, the method fully retains the structural information and semantic information of the features in the standardization processing and convolution feature extraction process, improves the synergistic effect of the feature dimension reduction layer and the nonlinear mapping, and realizes efficient, robust and interpretable abnormal feature identification. BRIEF DESCRIPTION OF DRAWINGS

[0090] Figure 1 A flowchart of an artificial intelligence-based malicious software identification analysis method for a power industrial control system is provided for an embodiment of the application.

[0091] Figure 2 A graph showing the change of classification accuracy with training rounds is provided for an embodiment of the application, Figure 3 A graph showing the change of Recall with training rounds is provided for an embodiment of the application, Figure 4 A graph showing the change of F1-score with training rounds is provided for an embodiment of the application.

[0092] The implementation of the application, functional features and advantages will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0093] It should be understood that the specific embodiments described herein are only used to explain the application and do not limit the application.

[0094] The embodiment of the application provides a power industrial control system malicious software identification analysis method based on artificial intelligence. The execution subject of the power industrial control system malicious software identification analysis method based on artificial intelligence includes but is not limited to at least one of the electronic devices capable of being configured to execute the method provided by the embodiment of the application, such as a server, a terminal and the like. In other words, the power industrial control system malicious software identification analysis method based on artificial intelligence can be executed by software or hardware installed in a terminal device or a server device, and the software can be a blockchain platform. The server includes but is not limited to a single server, a server cluster, a cloud server or a cloud server cluster and the like.

[0095] Referring to Figure 1 Embodiment 1 of the application is:

[0096] S1: Deploy a software test environment, and collect static running sample data and dynamic running sample data of software in a power industrial control system under the software test environment.

[0097] The static running sample data and the dynamic running sample data of the software in the power industrial control system are collected under the software test environment, including:

[0098] The software test environment includes an isolated network, a virtual machine and an industrial control device simulator, wherein the isolated network is isolated from an actual power grid and a production system, and includes industrial protocol simulation software (used for simulating Modbus / TCP, DNP3, IEC60870-5-104 and the like) and a test special-purpose network;

[0099] The virtual machine includes an operating system, a monitoring tool and an analysis tool, the operating system is configured according to the requirement of the software to be tested (Windows or Linux embedded system), the monitoring tool is used for collecting the static running sample data and the dynamic running sample data of the software, the monitoring tool includes a static running data monitoring tool (such as binwalk, Ghidra, plcscan and the like), a system call software (such as Procmon, auditd and the like), an API / function call software (such as Frida, DynamoRIO and the like), a memory monitoring software (such as Volatility, LiME and the like) and a network monitoring software (such as Wireshark and the like), and the analysis tool is used for extracting features from the static running sample data and the dynamic running features to obtain a static feature sequence and a dynamic feature sequence of the software to be tested;

[0100] The industrial control device simulator is used for simulating the real industrial control device behavior in the power industrial control system, and the industrial control device simulator comprises a PLC simulator and a sensor simulation device, wherein the PLC simulator is used for simulating the PLC hardware and the running environment, so that the target PLC program of the software to be tested can be executed in the virtual machine, and the sensor simulation device is used for simulating the acquisition and transmission of sensor data, switches and the capture of behavior events and fault events.

[0101] Specifically, the isolated network and the virtual machine ensure that the malicious software execution does not affect the actual power grid and production equipment, ensure the safety of the experiment, the virtual machine and the industrial control device simulator can accurately reproduce the running behavior of the software to be tested, so that the dynamic characteristics such as system call, API call, memory access and protocol interaction can be completely collected, and the original test sample data can be converted into a feature sequence by using a monitoring tool and an analysis tool, supporting AI model training and detection, so that the malicious behavior analysis is repeatable and verifiable, providing a reliable basis for high-precision malicious software identification and behavior modeling.

[0102] The software in the power industrial control system is composed of original PLC firmware, HMI application installation package and SCADA software, wherein the original PLC firmware includes control logic, register operation and I / O processing program, which is used for realizing the bottom layer industrial control function, the HMI application installation package contains interface layout, data binding and operation instruction, and communicates with the original PLC firmware through network or bus, and the SCADA software realizes monitoring strategy, alarm processing, data recording and control command distribution.

[0103] The static running sample data collection process of the software is as follows:

[0104] The software is unpacked, the executable files of the HMI application installation package and the SCADA software in the software are extracted, and the hash value of the file name of the executable file is calculated, the executable file is de-duplicated based on the hash value, and the de-duplicated executable file is obtained; optionally, the unpacking tool is binwalk;

[0105] The de-duplicated executable file is disassembled to obtain the instruction sequence of the executable file; optionally, the disassembling tool is Ghidra;

[0106] The original PLC firmware in the software is decoded to generate the PLC control logic node sequence of the software, wherein the PLC control logic node sequence is composed of PLC control logic nodes; optionally, the PLC logic program decoding tool is plcscan;

[0107] Visible strings in the instruction sequence of the executable file are extracted as the string text sequence of the software;

[0108] The executable file instruction sequence, the PLC control logic node sequence, and the string text sequence are taken as static running sample data of the software.

[0109] The dynamic running sample data acquisition process of the software is as follows:

[0110] The software test environment generates a software running instance, monitors the running process of the software, and captures a system call log in the software running process. The system call log includes a call type, a call parameter, and a call timestamp. The system call log capturing tool is a system call software.

[0111] The function call sequence in the HMI application installation package and the executable file of the SCADA software is captured in the software running process. The function call sequence capturing tool is an API / function call software.

[0112] The memory access log of a register in the original PLC firmware is captured in the software running process. The memory access log capturing tool is a memory monitoring software.

[0113] The protocol interaction log of an industrial protocol and a network protocol is captured in the software running process. The protocol interaction log capturing tool is a network monitoring software.

[0114] The system call log, the function call sequence, the memory access log, and the protocol interaction log are taken as dynamic running sample data of the software.

[0115] S2: static feature extraction is performed on the static running sample data to obtain a static feature sequence of the software, and dynamic feature extraction is performed on the dynamic running sample data to obtain a dynamic feature sequence of the software.

[0116] The static feature extraction on the static running sample data to obtain the static feature sequence of the software includes:

[0117] The static running sample data of the software is extracted.

[0118] The executable file instruction sequence is converted into an instruction call graph. The instruction call graph is in a directed graph structure form. Specifically, if instruction 1 is a predecessor instruction of instruction 2, there is an arrow from instruction 1 to instruction 2 in the instruction call graph.

[0119] The instruction call graph is converted into an instruction call graph adjacency matrix. In the instruction call graph adjacency matrix, if there is a pointing relationship between instructions, the corresponding position element is 1, otherwise the corresponding position element is 0. Specifically, if instruction 1 is a predecessor instruction or a successor instruction of instruction 2, the position element of instruction 1 and instruction 2 in the instruction call graph adjacency matrix is 1, otherwise the position element of instruction 1 and instruction 2 in the instruction call graph adjacency matrix is 0.

[0120] converting the PLC control logic node sequence into a PLC logic call graph, wherein the PLC logic call graph is in the form of a directed graph structure;

[0121] converting the PLC logic call graph into a PLC logic call graph adjacency matrix, wherein if there is a pointing relationship between the PLC control logic nodes, the corresponding position element is 1, otherwise the corresponding position element is 0;

[0122] converting the visible strings in the string text sequence into binary form to obtain a binary bit string, and converting the binary bit string into a bytecode sequence, wherein the bytecode sequence is composed of multiple bytecodes, and each bytecode stores 8-bit binary code;

[0123] mapping each bytecode to the interval range of 0-255 as a pixel value to obtain a bytecode image of the string text sequence; specifically, the 8-bit binary code is converted to the range of -128 to 127 in base 10, and -128 to 127 is mapped to 0 to 255;

[0124] taking the instruction call graph adjacency matrix of the software, the PLC logic call graph adjacency matrix, and the bytecode image as static features, and constructing a static feature sequence.

[0125] extracting dynamic features from dynamic running sample data to obtain a dynamic feature sequence of the software, including:

[0126] extracting dynamic running sample data of the software, and converting the function call sequence into a function call graph, wherein the function call graph is in the form of a directed graph structure;

[0127] converting the function call graph into a function call graph adjacency matrix, wherein if there is a pointing relationship between the functions, the corresponding position element is 1, otherwise the corresponding position element is 0;

[0128] extracting memory access logs to calculate the memory features of the software, wherein the memory features include the frequency distribution of memory addresses, the read-write ratio, and the average access size, the frequency distribution of memory addresses is the access frequency of different memory addresses, the read-write ratio is the ratio between the number of read operations and the number of write operations in the memory access logs, and the average access size is the average number of bytes of memory access;

[0129] Specifically, the frequency distribution of memory addresses is used to find abnormal memory addresses, the read-write ratio is used to identify whether there is malicious tampering of memory, and the average access size is used to identify dumping memory and data stealing behavior;

[0130] extracting protocol interaction logs, and calculating protocol features of the software, wherein the protocol features include frequency distribution of register addresses, register read-write ratio, and mean value of response delay;

[0131] Specifically, the frequency distribution of register addresses is used to identify abnormal access, the register read-write ratio is used to identify malicious tampering control logic behavior, and an increase in the mean value of response delay indicates that there may be malicious load, network attack or system anomaly;

[0132] extracting system call logs, and calculating system features of the software, wherein the system features include frequency distribution of different call types, mean value of system call time interval, variance of system call time interval, and call type transition matrix, and the call type transition matrix is calculated in the following manner:

[0133] ;

[0134] ;

[0135] wherein G represents the call type transition matrix, represents the transition value of the e-th call type to the r-th call type, and R represents the total number of call types, represents the number of calls in which the e-th call type is called first and then the r-th call type is called in the system call logs, represents the number of calls in which the e-th call type is called first and then the i-th call type is called in the system call logs;

[0136] The function call graph adjacency matrix, memory features, protocol features and system features are used as dynamic features of the software, and form a dynamic feature sequence of the software.

[0137] S3: using a physical information neural network based on an improved feature dimension reduction strategy to perform feature fusion on the static feature sequence and the dynamic feature sequence, and obtaining fusion features of the software.

[0138] The physical information neural network based on the improved feature dimension reduction strategy includes an input layer, a graph dimension reduction layer, a feature dimension reduction layer with fusion entropy attention, a convolution layer, a hidden layer, a physical information probability classification layer, and a fusion layer, and includes:

[0139] obtaining a training data set, wherein the training data set is composed of M training data subsets of software categories, each training data subset includes multiple groups of training data, each group of training data includes a static feature sequence, a dynamic feature sequence and a real software category; optionally, the software categories include PLC control logic software, HMI human-computer interaction application, SCADA monitoring software, communication software, normal business application software, logic tampering type Trojan software, data stealing Trojan software, denial of service attack program and backdoor tool software, wherein the logic tampering type Trojan software, the data stealing Trojan software, the denial of service attack program and the backdoor tool software are marked as power industrial control system malware;

[0140] The input layer is used for receiving the static feature sequence and the dynamic feature sequence and performing standardization processing; specifically, the standardization processing is z-score standardization;

[0141] The graph dimension reduction layer, the feature dimension reduction layer with fusion entropy attention and the convolutional layer sequentially perform dimension reduction processing on the standardized matrix, the non-matrix and the bytecode image respectively to obtain corresponding reduced features;

[0142] The graph dimension reduction layer is used for performing graph convolution and dimension reduction processing on the standardized matrix to obtain graph dimension reduction vectors, wherein the standardized matrix includes a standardized instruction call graph adjacency matrix, a PLC logic call graph adjacency matrix and a transition matrix of call types;

[0143] The feature dimension reduction layer with fusion entropy attention is used for calculating feature entropy attention weights of the standardized non-matrix, weighting the standardized non-matrix and reducing the proportion of unimportant features;

[0144] Specifically, the standardized non-matrix includes a frequency distribution of standardized memory addresses, a read-write ratio and an average access size, a frequency distribution of preprocessed register addresses, a register read-write ratio and a response delay mean, and a frequency distribution of different call types in preprocessed system features, a mean of system call time intervals and a variance of system call time intervals;

[0145] The convolutional layer is used for performing down-sampling convolution processing on the bytecode image to obtain a reduced feature map of the bytecode image; wherein the convolutional layer is an EfficientNet convolutional neural network structure;

[0146] The hidden layer is used for performing nonlinear mapping on the reduced features to obtain nonlinear features, wherein the hidden layer includes a fully connected layer, an activation function and a batch normalization layer, and the nonlinear mapping is based on the fully connected layer, the activation function and the batch normalization layer;

[0147] The physical information probability classification layer adopts a Parzen window function and a Bayesian probability to generate a probability distribution of the nonlinear features in different software categories.

[0148] The fusion layer is used for splicing the nonlinear features and the probability distribution as the fusion features of the software.

[0149] As an embodiment of the present application, a training loss function of the physical information neural network is constructed to maximize the probability of each set of training data output by the physical information neural network in the real software category, and the trainable parameters in the physical information neural network are trained, and the training method adopts an Adam optimizer or a gradient descent algorithm; optionally, the data source of the training data set is a CICMalDroid 2020 data set, which is a new Android malware data set publicly disclosed by the Canadian Institute for Cybersecurity, and it contains 17,341 Android samples, including the latest and complex Android samples up to 2018, and the samples in the data set span five different categories, including advertising software, bank malware, SMS malware, risk software and benign software.

[0150] It should be noted that the physical information neural network based on the improved feature dimension reduction strategy has significant advantages in structure and function compared with the traditional feedforward neural network: the physical information neural network based on the improved feature dimension reduction strategy adopts a multi-modal feature dimension reduction strategy to independently reduce and fuse the static feature sequence and the dynamic feature sequence, effectively preserving the high-order information and structural correlation of different types of features, while the traditional feedforward neural network usually directly concatenates all features for input, which is difficult to fully capture the potential relationship between multi-source heterogeneous features, and is prone to feature redundancy and noise accumulation; the physical information neural network introduces an entropy attention mechanism in the non-matrix feature processing link, which can dynamically suppress the influence of low information content features and enhance the response capability of the physical information neural network to key features, while the traditional feedforward neural network cannot distinguish the importance of features at different levels; the physical information neural network introduces a physical information probability classification layer, which uses a probabilistic neural network to perform non-parametric probability density estimation on nonlinear features and outputs results combined with Bayesian decision rules, which can provide class probability distribution information compared with the deterministic output of the traditional feedforward neural network, improve the robustness and explainability of classification, and perform more stably especially in the case of uneven sample distribution or noise. In addition, the physical information neural network processes static matrix features through graph convolution and extracts bytecode image features through EfficientNet convolution, which enhances the learning ability of complex structure relationships and local patterns, thereby improving the classification accuracy and generalization ability of the software running state as a whole.

[0151] The physical information neural network based on the improved feature dimension reduction strategy is used for feature fusion of the static feature sequence and the dynamic feature sequence, including:

[0152] The graph dimension reduction layer performs graph convolution and dimension reduction processing on the standardized matrix, and the process is as follows:

[0153] The normalized processing result is obtained by performing normalization processing on the standardized matrix, and the normalization processing operation is as follows: , wherein denotes a unit matrix, and C denotes the standardized matrix, denotes the normalized processing result of C.

[0154] The degree matrix D of the normalized processing result is generated.

[0155] The graph convolution processing is performed based on the normalized processing result and the degree matrix D, and the graph convolution feature map H is obtained:

[0156] .

[0157] .

[0158] wherein A denotes an intermediate parameter, denotes a ReLU function, denotes a function, all of which are trainable graph convolution weight matrices.

[0159] The graph dimension reduction vector corresponding to the standardized matrix is obtained by averaging all rows of the graph convolution feature map H.

[0160] The feature entropy attention weight calculation process of the feature entropy attention based feature dimension reduction layer is as follows:

[0161] The standardized non-matrix is obtained, the deviation between the standardized non-matrix and the associated standard feature is calculated, and the deviation is mapped to an adaptive weighting coefficient :

[0162] .

[0163] .

[0164] wherein denotes an exponential function with a natural constant as the base, denotes a scaling parameter, set to 0.2, denotes a transpose parameter, set to 0.4, denotes a power parameter, set to 1.2;

[0165] It should be noted that the nonlinear mapping function introducing the power transformation can adaptively adjust the response curve of the feature deviation degree, amplify the weight of important deviation features, and suppress the contribution of noise or irrelevant features, thereby improving the identification ability of the entropy attention mechanism for key features. Compared with traditional nonlinear functions, this function can dynamically adjust the scaling parameter, the transpose parameter, and the power parameter to achieve nonlinear steepness, fine capture of abnormal or key behavior features, enhance the discriminant ability of feature fusion across software or complex systems, improve the effectiveness and robustness of feature dimensionality reduction, while maintaining trainability and interpretability.

[0166] Based on the adaptive weighting coefficient , the feature entropy attention weight of the normalized non-matrix is calculated:

[0167] ;

[0168] ;

[0169] wherein denotes the feature entropy attention weight of the normalized non-matrix , denotes the feature entropy of the normalized non-matrix , denotes the set of normalized non-matrices , denotes any normalized non-matrix in the set of normalized non-matrices , denotes the adaptive weighting coefficient of j, denotes the attention control coefficient, set to 0.2, denotes the attention smoothing term. The nonlinear feature is calculated as follows:

[0170] The probability calculation process of the nonlinear feature in different software categories is as follows:

[0171] The kernel density of the nonlinear feature is estimated using the Parzen window function on the training data subset of each software category:

[0172] ​​

[0173] in, Representing nonlinear characteristics The kernel density for the m-th software category, , The dimension representing the nonlinear characteristic. This represents the m-th software category in the training data subset. Nonlinear characteristics of the training data Describing the L1 norm, This represents an exponential function with the natural constant as its base. Indicates the kernel density width, This represents the number of training data sets in the training data subset for the m-th software category;

[0174] Using Bayesian probabilistic methods to calculate nonlinear features Probabilities in different software categories:

[0175] ;

[0176] in, Let represent the prior probability of the m-th software category. Representing nonlinear characteristics The nonlinear feature represents the probability of the m-th software category. The probability distribution is as follows: ;

[0177] The fusion layer is used to stitch together nonlinear features and probability distributions as the fusion feature F of the software.

[0178] Specifically, attention smoothing terms are used to avoid weight jitter caused by minima, thereby enhancing training stability.

[0179] S4: The local mean nearest neighbor classification model using a fusion heuristic algorithm is used to classify the fusion features of the software, obtain the software category corresponding to the fusion features, and identify malicious software in the power industrial control system based on the software category.

[0180] A local mean nearest neighbor classification model based on a fusion heuristic algorithm is used to classify the fusion features of software, resulting in software categories corresponding to the fusion features, including:

[0181] The local mean nearest neighbor classification model includes a subset determination module based on a heuristic algorithm, a nearest neighbor estimation module, and a software category prediction module.

[0182] The subset determination module based on the heuristic algorithm determines the optimal training data subset set in which the fusion feature F of the software is located and the number K of nearest neighbors by using a heuristic algorithm, and the optimal training data subset set is composed of S optimal training data subsets determined by the heuristic algorithm, and S is set to 3;

[0183] The nearest neighbor estimation module is used to calculate the distance between the fusion feature F of the software and the fusion feature of any training data in the optimal training data subset, and extract the fusion features of the K training data closest to the fusion feature F from the optimal training data subset, and calculate the local centroid mean vector of the optimal training data subset;

[0184] As an embodiment of the application, the calculation formula of the local centroid mean vector in the Sth optimal training data subset is:

[0185]

[0186] Among them, represents the local centroid mean vector in the Sth optimal training data subset, represents the vth fusion feature in the Sth optimal training data subset closest to the fusion feature F extracted by the nearest neighbor estimation module,

[0187] The software category prediction module is used to calculate the distance between the fusion feature F of the software and the local centroid mean vector of each optimal training data subset, and select the software category corresponding to the local centroid mean vector with the smallest distance as the software category corresponding to the fusion feature F.

[0188] As an embodiment of the application, the calculation method of the distance between the fusion features is the inverse of the cosine similarity.

[0189] It should be noted that the subset determination module based on the heuristic algorithm can adaptively select the optimal training data subset set and the number K of nearest neighbors, effectively avoiding the calculation redundancy and noise interference caused by the large size of the global training set, thereby improving the calculation efficiency and classification accuracy of the model; In the nearest neighbor estimation process, the local centroid mean vector is calculated by using the fusion features of the K nearest neighbor samples in the optimal subset instead of relying on a single sample, which reduces the influence of abnormal points and isolated points on the classification result and enhances the robustness of the model under complex boundary conditions; The software category prediction module determines the category based on the distance between the fusion feature and the local centroid mean, which can obtain more stable and interpretable classification basis compared with the traditional KNN method which directly relies on the distance of a single point.

[0190] The heuristic algorithm is used to determine the optimal training data subset set in which the fusion feature F of the software is located and the number K of nearest neighbors, comprising:

[0191] ​​The heuristic algorithm is an improved sparrow search algorithm;

[0192] Initialize to generate B groups of sparrow positions, each group of sparrow positions including the numbers of S training data subsets and the number of neighbors;

[0193] Construct a fitness function with sparrow positions as input:

[0194] ;

[0195] Wherein, loc represents the sparrow position, is the fitness function, represents the fitness function value of the sparrow position, represents the fusion feature mean value of any training data in the zth training data subset in the sparrow position loc, and F represents the fusion feature of the software. represents the distance between the fusion feature mean value and F, is the number of neighbors in the sparrow position loc; specifically, represents the reciprocal of the cosine similarity between the fusion feature mean value and F;

[0196] Sort the sparrow positions in ascending order of fitness function values, and select the top 20% of sparrow positions as discovery positions, the last 20% of sparrow positions as alert positions, and the other sparrow positions as following positions. Based on the improved adaptive mutation factor, iterate the sparrow positions until the number of iterations reaches the preset maximum number of iterations (for example, 50), terminate the iteration, and output the sparrow position with the minimum fitness function. Based on the output sparrow position, select the optimal training data subset set and the number of neighbors K in which the fusion feature F is located.

[0197] The improved adaptive mutation factor is:

[0198] ;

[0199] Wherein, represents the adaptive mutation factor of the qth iteration of the sparrow position, represents the t-distribution, represents the proportion factor, and is set to 5, represents the critical iteration value, and is set to 10.

[0200] Specifically, in the traditional sparrow search algorithm, the update of individual position mainly depends on the guidance of global optimal solution and local information, but in complex search space, it is easy to fall into local optimum early or slow convergence late. By introducing an adaptive mutation factor into the algorithm, the search ability of the algorithm at different stages can be significantly enhanced. When the value of the adaptive mutation factor is close to zero, its role is more biased towards perturbing the current position of the individual, thereby promoting the local development of the population in the neighborhood of the optimal solution. This feature ensures that in the later iterations, the algorithm can explore the solution space in detail and avoid missing better solutions due to insufficient search accuracy. When the value of the adaptive mutation factor is far from zero, it means that a large disturbance is applied during the update of the individual position, so that the search individual can span a larger range of solution space, thereby enhancing the global exploration ability. This feature ensures that in the early iterations, the population can jump out of the local optimum with a large probability and quickly expand the search range. By dynamically adjusting the adaptive mutation factor, the algorithm can maintain diversity in the early stage to prevent premature convergence, and gradually weaken the global disturbance in the middle and late stages to focus on fine search around high-quality solutions. Overall, the adaptive mutation factor achieves a balance between global exploration and local development, not only improving the algorithm's ability to jump out of the local optimum in complex space, but also enhancing the convergence accuracy and speed in the later stage, thereby improving the stability and solving performance of the algorithm as a whole.

[0201] As an embodiment of the present application, the iteration formula of the discovery position is:

[0202] ;

[0203] wherein, represents the discovery position obtained in the qth iteration, represents the iteration result of the discovery position , represents the L2 norm, represents the sparrow position with the minimum fitness function value in the B group of sparrow positions obtained in the qth iteration, represents the iteration direction vector of the discovery position ;

[0204] The iteration formula of the following position is:

[0205]

[0206] ;

[0207] wherein, represents the following position obtained in the qth iteration, represents the q+1th iteration result of the following position , represents a random number between 0 and 1, represents the sparrow position with the maximum fitness function value in the B group sparrow positions obtained in the qth iteration, represents the preset maximum iteration number (for example, 50), represents the iteration step length of the qth iteration determined based on the simulated annealing algorithm, represents the set initial step length (for example, 0.5), represents the annealing rate, and is set to 3;

[0208] The iteration formula of the alert position is:

[0209] ;

[0210] wherein, represents the alert position obtained in the qth iteration, represents the qth iteration result of the alert position ;

[0211] Specifically, after each iteration, the sparrow positions are reordered in ascending order of the fitness function values, and the front 20% of the sparrow positions are selected as the discovery positions, the rear 20% of the sparrow positions are selected as the alert positions, and the other sparrow positions are selected as the following positions.

[0212] Referring to FIGS. 1 to 3, Figure 2 , Figure 3 and Figure 4 , an embodiment 2 of the present application is shown as follows:

[0213] As a comparative experiment of the malicious software identification and analysis method of the power industrial control system provided by an embodiment of the present application, a power industrial control system simulation platform is selected as the experimental environment, a software test environment is deployed, static running sample data and dynamic running sample data in the power working condition system are collected, and the total number of samples is 2000, including 1200 normal software samples and 800 malicious software samples. The power industrial control system simulation platform can simulate the industrial control logic interaction, network communication process and multi-dimensional running condition of the power working condition system in actual running. Based on the simulation platform, the software test environment is deployed, the software running behavior is monitored and collected under the real power working condition load, so as to ensure that the experimental results have high consistency and reference value with the real power industrial control scene.

[0214] The sample data used in the experiment is derived from a public FalDroid dataset. The FalDroid dataset is a malware detection dataset specially constructed for industrial control system and power system application scenarios, covering running samples of various industrial control system application software. Specifically, the FalDroid dataset includes normal software samples of power dispatch, PLC control logic, and common industrial control protocol analysis applications, and covers multiple types of malware samples such as viruses, trojans, worms, and backdoor programs, providing static features (bytecode, call relationship, and decompiled structure) and dynamic features (system call, memory access, and register operation) to support comprehensive analysis of multi-modal features.

[0215] In the comparative experiment, the following three methods are compared:

[0216] Method 1 (traditional KNN classification method): directly concatenate the static feature sequence and the dynamic feature sequence and input them into the KNN model, set the fixed number of neighbors K = 5, and perform software category recognition;

[0217] Method 2 (traditional feedforward neural network classification method): directly input the static feature sequence and the dynamic feature sequence into the FNN for training and classification, use the cross-entropy loss function, and iterate for 500 rounds;

[0218] Method 3 (the method of the present application);

[0219] The experiment uses accuracy (Accuracy), recall (Recall), and F1-score as evaluation indicators, and refers to the classification accuracy change graph with training rounds as shown in Figure 2 , the Recall change graph with training rounds as shown in Figure 3 , and the F1-score change graph with training rounds as shown in Figure 4 .

[0220] The comparison results show that: method 1 (traditional KNN classification method) converges slowly, the accuracy is finally stabilized at about 79%, the recall and F1-score basically stay at about 72%~73% in the late training period, and the detection rate of malicious software is relatively high; method 2 (traditional feedforward neural network classification method) is significantly improved under the same number of rounds, the accuracy finally reaches about 85.6%, the Recall and F1-score are improved by 5%~7% compared with method 1, and finally stabilize at about 81%; method 3 (the method of the present application) uses the heuristic improved local mean neighbor classifier, and has advantages in convergence speed and final accuracy, the final accuracy reaches nearly 90%, and the final Recall reaches about 87%, and the F1-score reaches 86.8%, which is significantly better than the comparison methods;

[0221] It should be appreciated that the above-described embodiments are merely illustrative, and the patent application scope is not limited by the structure.

[0222] It should be noted that the above-mentioned embodiment numbers of the present application are only for description, and do not represent the advantages and disadvantages of the embodiments. And the term "include", "contain" or any other variant thereof in this paper is intended to cover non-exclusive inclusion, so that the process, device, article or method including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or includes elements inherent to such process, device, article or method. Without more limitations, the element defined by the sentence "including a" does not exclude the existence of other identical elements in the process, device, article or method including the element.

[0223] From the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be realized by software and the necessary general hardware platform, of course, they can also be realized by hardware, but in many cases the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for making a terminal device (which can be a mobile phone, computer, server, or network device, etc.) execute the methods described in various embodiments of the present application.

[0224] The above is only the preferred embodiment of the present application, and does not limit the patent scope of the present application, and any equivalent structure or equivalent process transformation using the content of the present application specification and drawings, or direct or indirect application in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. An artificial intelligence-based power industrial control system malware identification analysis method, characterized in that, The method comprises: S1: deploying a software test environment, collecting static running sample data and dynamic running sample data of software in the power industrial control system under the software test environment; The software in the power industrial control system is composed of original PLC firmware, HMI application installation package and SCADA software; The static running sample data collection process of the software is: unpacking the software, extracting executable files of the HMI application installation package and the SCADA software in the software, and calculating the hash value of the file name of the executable file, removing the executable file based on the hash value, and obtaining the de-duplicated executable file; optionally, the unpacking tool is binwalk; performing reverse assembly processing on the de-duplicated executable file to obtain the instruction sequence of the executable file; optionally, the reverse assembly processing tool is Ghidra; decoding the PLC logic program of the original PLC firmware in the software to generate a PLC control logic node sequence of the software, wherein the PLC control logic node sequence is composed of PLC control logic nodes; optionally, the PLC logic program decoding tool is plcscan; extracting visible strings in the instruction sequence of the executable file as a string text sequence of the software; the instruction sequence of the executable file, the PLC control logic node sequence and the string text sequence are taken as the static running sample data of the software; The dynamic running sample data collection process of the software is: The software test environment generates a software running instance, monitors the running process of the software, captures system call logs in the software running process, and the system call logs include call type, call parameter and call timestamp; the system call log capture tool is system call software; capture the function call sequence in the executable file of the HMI application installation package and the SCADA software during the software running process; the function call sequence capture tool is API / function call software; capture the memory access log of the register in the original PLC firmware during the software running process; the memory access log capture tool is the memory monitoring software; capture the protocol interaction log of the industrial protocol and the network protocol during the software running process; the protocol interaction log capture tool is the network monitoring software; the system call log, the function call sequence, the memory access log and the protocol interaction log are taken as the dynamic running sample data of the software; S2: static feature extraction is performed on the static running sample data to obtain a static feature sequence of the software, and dynamic feature extraction is performed on the dynamic running sample data to obtain a dynamic feature sequence of the software; S3: using a feedforward neural network based on an improved feature dimension reduction strategy to perform feature fusion on the static feature sequence and the dynamic feature sequence to obtain a fusion feature of the software; S4: using a local mean neighbor classification method of a fusion heuristic algorithm to classify the fusion feature of the software to obtain a software category corresponding to the fusion feature, and identifying malicious software of the power industrial control system based on the software category.

2. The artificial intelligence-based malware identification analysis method for a power industrial control system according to claim 1, characterized by, The static feature extraction on the static running sample data obtains a static feature sequence of the software, including: extracting the static running sample data of the software; convert the instruction sequence of the executable file into an instruction call graph, wherein the instruction call graph is in the form of a directed graph structure; convert the instruction call graph into an instruction call graph adjacency matrix, wherein if there is a pointing relationship between instructions, the corresponding position element is 1, otherwise the corresponding position element is 0; convert the PLC control logic node sequence into a PLC logic call graph, wherein the PLC logic call graph is in the form of a directed graph structure; convert the PLC logic call graph into a PLC logic call graph adjacency matrix, wherein if there is a pointing relationship between the PLC control logic nodes, the corresponding position element is 1, otherwise the corresponding position element is 0; convert the visible strings in the string text sequence into binary form to obtain a binary bit string, and convert the binary bit string into a bytecode sequence, wherein the bytecode sequence is composed of multiple bytecodes, and each bytecode stores 8-bit binary code; map each bytecode to the interval range of 0-255 as a pixel value to obtain a bytecode image of the string text sequence; take the instruction call graph adjacency matrix of the software, the PLC logic call graph adjacency matrix, and the bytecode image as static features, and form a static feature sequence.

3. The artificial intelligence-based malicious software identification and analysis method for a power industrial control system according to claim 1, characterized by, extract dynamic features from dynamic running sample data to obtain a dynamic feature sequence of the software, including: extracting dynamic running sample data of the software, and converting the function call sequence into a function call graph, wherein the function call graph is in the form of a directed graph structure; convert the function call graph into a function call graph adjacency matrix, wherein if there is a pointing relationship between functions, the corresponding position element is 1, otherwise the corresponding position element is 0; extract the memory access log to calculate the memory features of the software, wherein the memory features include the frequency distribution of memory addresses, the read-write ratio, and the average access size, the frequency distribution of memory addresses is the access frequency of different memory addresses, the read-write ratio is the ratio between the number of read operations and the number of write operations in the memory access log, and the average access size is the average number of bytes of memory access; extract the protocol interaction log to calculate the protocol features of the software, wherein the protocol features include the frequency distribution of register addresses, the register read-write ratio, and the response delay mean; extract the system call log to calculate the system features of the software, wherein the system features include the frequency distribution of different call types, the mean of system call time intervals, the variance of system call time intervals, and the transition matrix of call types; take the function call graph adjacency matrix, the memory features, the protocol features, and the system features as the dynamic features of the software, and form a dynamic feature sequence of the software.

4. The artificial intelligence-based malicious software identification analysis method for a power industrial control system according to claim 1, characterized by, The improved feature dimension reduction strategy based feedforward neural network includes an input layer, a graph dimension reduction layer, a feature dimension reduction layer with fusion entropy attention, a convolution layer, a hidden layer, and a fusion layer, including: The input layer is used to receive and standardize the static feature sequence and the dynamic feature sequence; The graph dimension reduction layer, the feature dimension reduction layer with fusion entropy attention, and the convolution layer sequentially perform dimension reduction processing on the standardized matrix, non-matrix, and bytecode image respectively to obtain corresponding reduced features. The graph dimension reduction layer is configured to perform graph convolution and dimension reduction on the normalized matrix, and obtain a graph dimension reduction vector, wherein the normalized matrix includes a normalized instruction call graph adjacency matrix, a PLC logic call graph adjacency matrix, and a transition matrix of call types; The feature entropy attention-based feature dimension reduction layer is configured to calculate feature entropy attention weights of the normalized non-matrix, weight the normalized non-matrix, and reduce the proportion of unimportant features; The convolution layer is configured to perform down-sampling convolution on the bytecode image, and obtain a dimension reduction feature map of the bytecode image; the convolution layer is an EfficientNet convolutional neural network structure; The hidden layer is configured to perform nonlinear mapping on the dimension reduction features, and obtain nonlinear features; the hidden layer includes a fully connected layer, an activation function, and a batch normalization layer; The fusion layer is configured to splice the nonlinear features as fusion features of the software.

5. The artificial intelligence-based malicious software identification analysis method of claim 4, wherein the artificial intelligence-based malicious software identification analysis method is characterized by, The feedforward neural network based on the improved feature dimension reduction strategy is used to fuse the static feature sequence and the dynamic feature sequence, including: The graph dimension reduction layer performs graph convolution and dimension reduction on the normalized matrix, and the process is as follows: The normalized processing is performed on the standardized matrix to obtain a normalized processing result, wherein the normalized processing operation is: wherein denotes a unit matrix, C denotes the standardized matrix, denotes the normalized processing result of C; generating a normalized result a degree matrix D; Based on the normalized processing result and the degree matrix D, a graph convolution processing is performed to obtain a graph convolution feature map H: ； ； wherein A denotes an intermediate parameter, denotes a ReLU function, denotes a function, are all trainable graph convolution weight matrices; The graph dimension reduction vector corresponding to the normalized matrix is obtained by averaging all rows of the graph convolution feature map H; The feature entropy attention weight calculation process of the feature entropy attention-based feature dimension reduction layer is as follows: Obtain the non-matrix after standardization Calculate the non-matrix after standardization Related standard features Deviation between and the deviation Mapped to adaptive weighting coefficients : ； ； wherein, denotes an exponential function with base the natural constant, denotes a scaling parameter, set to 0.2, denotes a transposition parameter, set to 0.4, denotes a power parameter, set to 1.2; Adaptive weighting coefficients The normalized non-matrix Feature entropy attention weights: ； ； wherein, denotes the feature entropy attention weight of the normalized non-matrix , denotes the feature entropy of the normalized non-matrix , denotes the set of normalized non-matrices, denotes any normalized non-matrix in the set of normalized non-matrices , denotes the adaptive weighting coefficient of j, denotes the attention control coefficient, set to 0.2, denotes the attention smoothing term; The fusion layer is configured to splice the nonlinear features as fusion features F of the software.

6. The artificial intelligence-based malicious software identification analysis method of claim 5, wherein the artificial intelligence-based malicious software identification analysis method is characterized by, The local mean neighbor classification mode of the fusion heuristic algorithm is used to classify the fusion features of the software, and the software category corresponding to the fusion features is obtained, including: The training data set is obtained, wherein the training data set is composed of M training data subsets of software categories, each training data subset includes 100 groups of training data, and each group of training data includes fusion features and a software category corresponding to the fusion features; The heuristic algorithm is used to determine the optimal training data subset set and the number of neighbors K in which the fusion features F of the software are located, the optimal training data subset set is composed of S optimal training data subsets determined by the heuristic algorithm, and S is set to 3; The distance between the fusion features F of the software and the fusion features of any training data in the optimal training data subset is calculated, and the fusion features of the K nearest training data are extracted from the optimal training data subset; The distance between the extracted K training data fusion features and the fusion features F of the software is calculated, and the software category of the optimal training data subset associated with the nearest fusion feature mean is selected as the software category corresponding to the fusion features F.

7. The artificial intelligence-based malicious software identification analysis method of claim 6, wherein the artificial intelligence-based malicious software identification analysis method is characterized by, The heuristic algorithm is used to determine the optimal training data subset set and the number of neighbors K in which the fusion features F of the software are located, including: The heuristic algorithm is an improved sparrow search algorithm; B groups of sparrow positions are initialized, each group of sparrow positions includes the numbers of S training data subsets and the number of neighbors; A fitness function with sparrow positions as input is constructed: ； Where loc represents the sparrow's position. For the fitness function, The fitness function value representing the sparrow's position. The position of a sparrow is any position in the z-th training data subset of loc. The mean of the fusion features of the training data, F represents the fusion features of the software. Indicates the mean of fusion features The distance between F, This represents the number of nearest neighbors in the sparrow's position loc; The sparrow positions are sorted in ascending order of fitness function values, and the first 20% of the sparrow positions are selected as discovery positions, the last 20% of the sparrow positions are selected as alert positions, and the other sparrow positions are selected as following positions; the sparrow positions are iterated based on an improved adaptive mutation factor until the number of iterations reaches a preset maximum number of iterations, the iteration is terminated, and the sparrow position with the minimum current fitness function is output; based on the output sparrow position, an optimal training data subset set in which the fusion feature F is located and the number K of neighbors are selected; The improved adaptive mutation factor is: ； wherein, denotes the adaptive mutation factor at the qth iteration of sparrow position, denotes the t-distribution, denotes the scaling factor, set to 5, denotes the critical iteration value, set to 10.

Images