Intelligent research and judgment method for safety of inspection data of electric power unmanned aerial vehicle

Abstract

The invention discloses an intelligent research and judgment method for power unmanned aerial vehicle inspection data security, and relates to the technical field of power unmanned aerial vehicle security, and the method comprises the steps: carrying out the vulnerability mining and risk identification of a power unmanned aerial vehicle system communication protocol, firmware and a mobile terminal SDK, and building a power unmanned aerial vehicle communication protocol security quantitative index model; analyzing the binary code of the electric unmanned aerial vehicle APP by using a deep learning model, extracting a time sequence feature and a semantic feature, and identifying unauthorized access, key hard coding and abnormal calling behaviors; simulating GPS spoofing, data link interference and data tampering attack scenes, and performing risk assessment by dynamically deducing an attack chain of the power unmanned aerial vehicle; identifying potential security threats through multi-modal data association analysis; and constructing a comprehensive safety situation assessment system of the electric unmanned aerial vehicle, and performing intelligent safety research and judgment and risk grading on the inspection data. According to the method, security threat intelligent study and judgment are carried out from multiple levels, and the comprehensiveness and accuracy of data anomaly detection are improved.

Description

Technical Field

[0001] This invention relates to the field of power drone safety technology, and in particular to an intelligent assessment method for the safety of power drone inspection data. Background Technology

[0002] With the continuous expansion of power systems and the increasing complexity of transmission and distribution lines, power inspection tasks are gradually shifting from manual inspection to drone inspection. Power drones, with their advantages of flexibility, wide coverage, and high operational efficiency, have become an important tool for power grid operation and maintenance and equipment testing. However, in complex electromagnetic environments, high-voltage scenarios, and under multi-task collaborative conditions, drone inspections face challenges such as unstable communication links, abnormal task execution, attitude imbalance, and energy management risks, making it difficult to guarantee the security and reliability of inspection data.

[0003] Existing drone inspection safety assessment methods mostly focus on single-level risk identification, such as flight status monitoring, mission execution anomaly detection, or link security analysis. They lack the ability to comprehensively and intelligently analyze multi-dimensional data, making it difficult to achieve global safety situation identification and risk classification management during the inspection process. In addition, traditional methods rely on static thresholds or empirical rules to process inspection data, which cannot cope with dynamic risk changes in different scenarios.

[0004] Therefore, there is an urgent need for an intelligent assessment method for power drone inspection data security that can integrate flight status data, communication link data, and mission execution data. By constructing a multi-dimensional feature model and an adaptive risk identification mechanism, intelligent analysis and hierarchical early warning of inspection data can be achieved, thereby improving the overall security and reliability of the drone inspection system. Summary of the Invention

[0005] In view of the above-mentioned problems, the present invention is proposed.

[0006] Therefore, the problem that this invention aims to solve is that traditional methods suffer from low risk identification accuracy, delayed judgment results, and a lack of adaptive capabilities, in order to achieve global safety perception and intelligent decision support in the UAV inspection process.

[0007] To solve the above-mentioned technical problems, the present invention provides the following technical solution: In a first aspect, embodiments of the present invention provide a method for intelligent assessment of the security of power drone inspection data, including: performing reverse analysis on the communication protocol and firmware of the power drone system, and using a combination of fuzz testing and symbolic execution techniques to discover and identify vulnerabilities in the communication protocol, firmware, and mobile SDK of the power drone system; The binary code of the electric power drone APP was parsed using a deep learning model to extract temporal and semantic features and identify unauthorized access, hard-coded keys, and abnormal call behavior. A power drone attack and defense verification platform was built to simulate attack scenarios such as GPS spoofing, data link interference, and data tampering. Risk assessment was conducted by dynamically simulating the attack chain of power drones. Protocol traffic, firmware logs, and sensor data were collected and integrated, and potential security threats were identified through multimodal data correlation analysis. Based on a comprehensive analysis of multi-level system security information and communication, application and data security indicators, a comprehensive security situation assessment system for power drones is constructed to conduct intelligent security assessment and risk classification of inspection data.

[0008] As a preferred embodiment of the intelligent assessment method for power drone inspection data security described in this invention, the method includes: reverse analysis of the communication protocol and firmware of the power drone system, including: intercepting and obtaining interactive messages using a man-in-the-middle approach, clustering the message data according to payload length, time series, and frequency characteristics; prioritizing bit-by-bit comparison and differential analysis of small payload clusters of the same size to infer message field boundaries, control codes, sequence numbers, and state machine transition rules; Based on message format and state machine description, a set of standard messages and structured variant messages are constructed to generate protocol test stubs.

[0009] As a preferred embodiment of the intelligent assessment method for power drone inspection data security described in this invention, the method involves: mining and identifying vulnerabilities and risks in the power drone system's communication protocol, firmware, and mobile SDK, including: A fuzz tester is used to perform mutated inputs on test stubs and real devices, collecting crash, abnormal responses and logs; symbolic execution is applied to the input data parsing and verification functions in the protocol parser and firmware to obtain path constraints, and the constraint solver generates targeted inputs; the targeted inputs generated by symbolic execution are fed back to the fuzz tester to form a hybrid fuzzing closed loop to cover deep paths; Using Ghidra in conjunction with a deep learning model, function localization was performed, and code segments related to communication parsing and key management were marked. Firmware was run in an isolated real device environment, and instrumentation was used to trace and monitor memory access, system calls, and anomalies. Symbolic execution was used to obtain triggerable inputs, and vulnerabilities were reproduced at runtime. Runtime snapshots were recorded to form reproducible proof. It decompiles mobile APKs, scans for permissions and sensitive APIs, and uses a sequence model based on deep neural networks to help identify hard-coded keys and abnormal call chains.

[0010] As a preferred embodiment of the intelligent judgment method for power drone inspection data security described in this invention, the method includes: using a deep learning model to parse the binary code of the power drone APP and extracting temporal and semantic features, including: mapping the binary instruction stream or disassembled opcode sequence into a time sequence representation, dividing it into several time windows according to the calling order or possible execution sequence; calculating statistical features for each time window and inputting them into the sequence model as a temporal feature vector; The instruction sequences, constant tables, string references, and local call relationships of subroutines are mapped to code fragment tokens; a Transformer-based pre-trained encoder is applied to the token sequences to obtain function-level semantic embeddings; an inter-function call graph is constructed, and a graph neural network is used to encode the graph structure to obtain a structured semantic representation; a hybrid network structure is used to fuse temporal features and semantic features, and the calculation formula for the fusion layer is as follows: h fused =LayerNorm(α·W t ·h time + β·W tr ·h trans + γ·W g ·h g + b); Among them, h fused To unify the representation vector, W t W tr W g Let b be the linear mapping matrix, α be the bias vector, β be the normalized fusion weights, LayerNorm be the layer normalization, and h be the weights. time h is the temporal feature vector. trans h is a semantic feature vector. g These are the feature vectors of the graph structure.

[0011] As a preferred embodiment of the intelligent analysis method for power drone inspection data security described in this invention, the method includes: identifying unauthorized access, hard-coded keys, and abnormal call behavior, including: Extract string constants, global variables, and function call sequences from the binary code or firmware of the power drone application; detect key features, including plaintext keys, hash values, encrypted key identifiers, and hard-coded credentials, using pattern matching and static analysis methods; map the identified string sequences into vector representations using a deep learning model, and analyze the similarity between the vector representations and known key templates; if the similarity exceeds a set threshold, mark it as a key hard-coding risk and output the corresponding position and risk level; construct function call graphs and API call sequence graphs, extract the time interval, call frequency, and call order temporal features of function calls, and input them into an anomaly detection model for learning; mark behaviors exceeding the threshold as abnormal calls through API call anomaly scoring; and generate anomaly behavior alarm reports by combining call context and historical behavior patterns.

[0012] As a preferred embodiment of the intelligent assessment method for power drone inspection data security described in this invention, the method involves: performing risk assessment by dynamically simulating the power drone attack chain, including: defining a single-step risk increment function r(s). t ,m t ), used to evaluate in state s t The following attack action m t Immediate risks to the system: ; in, The degree of impact caused by the action. Rate the ease of execution of the attack action. , These are the weighting coefficients; The method for calculating the ease of execution score is as follows: ; in, The resource overhead required to execute the attack. The time cost required to complete this attack action, The attack success probability is scored, with λ1, λ2, and λ3 being the weighting coefficients. An attack strategy generator is selected within the platform to attack agents with the goal of maximizing accumulated risk. By interacting with the simulation environment, the most destructive attack chains are learned, and the defense agent minimizes risk or restores sub-states through strategy optimization.

[0013] As a preferred embodiment of the intelligent assessment method for power drone inspection data security described in this invention, the method involves: collecting and fusing protocol traffic, firmware logs, and sensor data; and identifying potential security threats through multimodal data correlation analysis, including: Multidimensional feature parameters characterizing device operating status and interactive behavior are extracted from protocol traffic, firmware logs, and sensor data, and these feature parameters are integrated into a unified feature vector. The correlation between different modal data is established to form a multimodal fusion feature vector, and protocol traffic anomalies, firmware log anomalies, and sensor anomalies are correlated and mapped. Anomaly detection is performed on the multimodal fusion feature vector; by analyzing device operation sequences and communication behavior sequences, behaviors deviating from the normal pattern are identified; supervised or unsupervised learning models are used to train and predict the multimodal fusion feature vector to identify potential threat events; wherein, the multimodal fusion feature vector is a unified feature representation obtained by integrating protocol traffic features, firmware log features and sensor time series features according to a preset fusion algorithm; Output the identified potential threat events, including threat type, time of occurrence, associated devices and node information.

[0014] As a preferred embodiment of the intelligent security assessment method for power drone inspection data described in this invention, the method includes: constructing a comprehensive security situation assessment system for power drones, and performing intelligent security assessment and risk classification on the inspection data, including: Using a graph-based association method, the correlation between protocol traffic features, firmware log features, and sensor time-series features is calculated to construct a multimodal feature association network. Feature nodes are represented as data indicators, and edges represent the strength of their correlation. Community detection or cluster analysis is performed on the association network to discover potential abnormal patterns. Based on the association analysis results, highly correlated abnormal patterns are initially labeled. The identified anomalous data is classified according to the intensity and correlation of the anomalies: ; in, Score the safety risk of the i-th inspection data. Let i be the anomaly intensity index of the i-th inspection data. This represents the maximum value of the abnormal intensity. Let i be the multimodal correlation index of the i-th inspection data. denoted as the maximum value of multimodal correlation, a is the anomaly intensity weight coefficient, and b is the multimodal correlation weight coefficient.

[0015] In a second aspect, embodiments of the present invention provide a computer device, including a memory and a processor, wherein the memory stores a computer program, and the computer program instructions, when executed by the processor, implement the steps of the intelligent judgment method for power drone inspection data security as described in the first aspect of the present invention.

[0016] Thirdly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program instructions are executed by a processor, they implement the steps of the intelligent judgment method for power drone inspection data security as described in the first aspect of the present invention.

[0017] The beneficial effects of this invention are as follows: By fusing protocol traffic, firmware logs, and sensor data, this invention constructs a multimodal correlation analysis model, enabling security threat identification and intelligent judgment from multiple levels of communication, control, and perception, significantly improving the comprehensiveness and accuracy of data anomaly detection. By introducing a hierarchical algorithm based on anomaly intensity and mutual information correlation, it is possible to perform quantitative risk assessment and dynamic hierarchical response on inspection data, improving the accuracy and real-time performance of security judgment. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A flowchart of a method for intelligent assessment of data security in power plant drone inspections. Detailed Implementation

[0020] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0021] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0022] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0023] Example 1 Reference Figure 1 This is the first embodiment of the present invention, which provides a method for intelligent assessment of the security of power drone inspection data, including: S1: Reverse engineer the communication protocol and firmware of the power drone system, and use a combination of fuzz testing and symbolic execution techniques to discover and identify vulnerabilities and risks in the communication protocol, firmware, and mobile SDK of the power drone system.

[0024] Furthermore, by using man-in-the-middle interception to obtain interactive messages, the message data is clustered according to payload length, time series, and frequency characteristics; bit-by-bit comparison and differential analysis are performed on small payload clusters of the same size to infer message field boundaries, control codes, sequence numbers, and state machine transition rules; Based on message format and state machine description, a set of standard messages and structured variant messages are constructed to generate protocol test stubs.

[0025] Furthermore, a fuzz tester is used to perform mutated inputs on test stubs and real devices, collecting crash, abnormal responses and logs; symbolic execution is applied to the input data parsing and verification functions in the protocol parser and firmware to obtain path constraints, and the constraint solver generates targeted inputs; the targeted inputs generated by symbolic execution are fed back to the fuzz tester to form a hybrid fuzzing closed loop to cover deep paths; Using Ghidra in conjunction with a deep learning model, function localization was performed, and code segments related to communication parsing and key management were marked. Firmware was run in an isolated real device environment, and instrumentation was used to trace and monitor memory access, system calls, and anomalies. Symbolic execution was used to obtain triggerable inputs, and vulnerabilities were reproduced at runtime. Runtime snapshots were recorded to form reproducible proof. It decompiles mobile APKs, scans for permissions and sensitive APIs, and uses a sequence model based on deep neural networks to help identify hard-coded keys and abnormal call chains.

[0026] It should be noted that clustering algorithms with good adaptability and low assumptions about cluster shape, such as DBSCAN or HDBSCAN, are selected to overcome the problem of unknown cluster numbers. If the data scale is large, KMeans can be used for initial screening before fine clustering. After clustering, the following are outputs for each cluster: cluster size, length distribution, average entropy, and typical message example. Clusters with the same length, shorter payload, and low intra-cluster entropy (indicating unencrypted) are prioritized for analysis (these small messages usually carry easily reversed protocol elements such as control words, sequence numbers, heartbeats, and ACKs). DBSCAN's eps can be set according to the byte distribution similarity scale, and the message binary is aligned byte by byte (if a variable-length internal structure is found, it is first right / left aligned according to the maximum length and the pad is recorded). The frequency distribution p of all messages within a cluster is statistically analyzed according to byte position. b,pos (v), if the percentage of a certain byte value at position pos is greater than τ constIf the value at a given position is approximately constant, then that position is approximately constant. Values ​​at these positions can vary, indicating variable data or parameters. Several consecutive positions with low rates of change may constitute a constant field or identifier field; those with high rates of change and predictable patterns may be counters or timestamp segments. For the same session, messages are arranged chronologically, and the numerical sequence s of certain variable fields is extracted. t To test whether the sequence is linear / increasing in magnitude: calculate the difference d. t =(s t+1 -s t mod 256. If most d t If the value is close to a constant (e.g., 1), it is determined to be a counter / sequence number. If the change is strongly correlated with the time interval, the field can be considered as a timestamp or accumulator. For each candidate position c (or several bytes at the end), try to determine whether it is a check / CRC field: the methods include observing whether the check byte is deterministically mapped to other bytes in the same message group (a function of low entropy); constructing a linear model (GF(2) linear regression) for samples within the cluster to try to predict the byte; if a byte is highly correlated with the XOR or sum (mod 256) of other bytes, it may be a simple checksum. For complex CRC, try common polynomials one by one with known CRC detection algorithm libraries (if the device context allows). If a position has a fixed bit value in the up / down direction or when a specific response occurs, it may be a control code or command word. Confirm the semantics of the control code based on the message-response pair. Treat the captured sequence as a (request → response → event) pattern and construct an observed event sequence graph: the nodes are "the set of observed message patterns / field values", and the directed edges are "subsequent messages that appear in time". Merge isomorphic nodes and compress them to obtain an initial observation state graph. For each edge, statistically analyze the transition frequency and inevitability to identify possible state transition conditions (e.g., receiving command X and immediately producing response Y, or producing state change Z). If there are explicit command-response pairs, map these pairs as "action-effect" relationships; accumulating these relationships generates a protocol state machine sketch. For transitions with conditional branches (such as requiring specific field values ​​or counters to meet conditions), record the triggering condition candidates.

[0027] It should be noted that writing the concrete inputs obtained by the Angr / symbolic solver into the AFL queue or seed folder allows the fuzz tester to continue mutating from these targeted inputs.

[0028] Initiate a long-running fuzzing process using AFL++, periodically (or based on trigger conditions) obtaining "crashes / interesting cases of uncovered paths" from AFL. Perform symbolic execution on these samples using Angr, attempting to solve the uncovered branches (if Angr succeeds, generate concrete input). Push the concrete input back into the AFL seed and continue fuzzing to detect surrounding mutations.

[0029] S2: Use a deep learning model to parse the binary code of the power drone APP, extract temporal and semantic features, and identify unauthorized access, hard-coded keys, and abnormal call behavior.

[0030] Furthermore, the binary instruction stream or the disassembled opcode sequence is mapped to a time series representation, and divided into several time windows according to the calling order or possible execution sequence; statistical features are calculated for each time window and used as time series feature vectors input into the sequence model; The instruction sequences, constant tables, string references, and local call relationships of subroutines are mapped to code fragment tokens; a Transformer-based pre-trained encoder is applied to the token sequences to obtain function-level semantic embeddings; an inter-function call graph is constructed, and a graph neural network is used to encode the graph structure to obtain a structured semantic representation; a hybrid network structure is used to fuse temporal features and semantic features, and the calculation formula for the fusion layer is as follows: h fused =LayerNorm(α·W t ·h time + β·W tr ·h trans + γ·W g ·h g + b); Among them, h fused To unify the representation vector, W t W tr W g Let b be the linear mapping matrix, α be the bias vector, β be the normalized fusion weights, LayerNorm be the layer normalization, and h be the weights. time h is the temporal feature vector. trans h is a semantic feature vector. g These are the feature vectors of the graph structure.

[0031] Furthermore, string constants, global variables, and function call sequences are extracted from the binary code or firmware of the power drone APP; key features, including plaintext keys, hash values, encrypted key identifiers, and hard-coded credentials, are detected using pattern matching and static analysis methods; the identified string sequences are mapped to vector representations using a deep learning model, and the similarity between the vector representations and known key templates is analyzed; if the similarity exceeds a set threshold, it is marked as a key hard-coding risk, and the corresponding position and risk level are output; a function call graph and API call sequence graph are constructed, and the time sequence features of function call time intervals, call frequency, and call order are extracted and input into an anomaly detection model for learning; through the anomaly scoring of API calls, behaviors exceeding the threshold are marked as abnormal calls; and anomaly behavior alarm reports are generated by combining the call context and historical behavior patterns.

[0032] It should be noted that mapping binary instruction streams or disassembled opcode sequences to time-series representations and dividing them into several time windows according to function call order or possible execution sequences preserves the dynamic execution characteristics of instructions, enabling subsequent feature calculations to capture potential abnormal execution paths. For example, calculating the opcode distribution entropy, system call frequency, and jump density for each window can form a high-dimensional temporal feature vector, effectively enhancing sensitivity to deep logic defects and abnormal control flows. Mapping function instruction sequences, constant tables, string references, and local call relationships to token sequences and generating function-level semantic embeddings through a Transformer pre-trained encoder introduces deep semantic understanding capabilities on top of traditional static feature analysis. This method can not only capture function-level semantic information but also identify potential vulnerabilities in modules such as complex protocol parsing and key management, providing rich semantic clues for subsequent security assessments. By constructing inter-function call graphs and using graph neural network encoding, the call relationships and dependencies between functions can be encoded into a structured representation. Compared to simple instruction or semantic analysis, this method can reveal the propagation paths of security vulnerabilities across functions, such as key leakage paths or abnormal state propagation chains, providing structured information support for global security analysis. It weights and fuses temporal features, functional semantics, and structural semantics, and then unifies the fusion by normalizing the fusion weights α=0.4, β=0.35, γ=0.25 and layer normalization to form a final unified representation vector. This fusion strategy fully utilizes the advantages of different modal features. The fused vector is input into a multilayer perceptron (MLP) classifier for risk classification and combined with fuzz testing and symbolic execution to form a closed-loop security analysis process. Through this hybrid fuzzing closed loop, not only can potential vulnerabilities in deep paths be discovered, but vulnerabilities can also be quickly reproduced based on function-level semantics and structural features, achieving interpretable security assessment.

[0033] S3: Construct a power drone attack and defense verification platform to simulate GPS spoofing, data link interference and data tampering attack scenarios, and conduct risk assessment by dynamically simulating the power drone attack chain.

[0034] Furthermore, define the single-step risk increment function r(s) t ,m t ), used to evaluate in state s t The following attack action m t Immediate risks to the system: ; in, The degree of impact caused by the action. Rate the ease of execution of the attack action. , These are the weighting coefficients; The method for calculating the ease of execution score is as follows: ; in, The resource overhead required to execute the attack. The time cost required to complete this attack action, The attack success probability is scored, with λ1, λ2, and λ3 being the weighting coefficients. An attack strategy generator is selected within the platform to attack agents with the goal of maximizing accumulated risk. By interacting with the simulation environment, the most destructive attack chains are learned, and the defense agent minimizes risk or restores sub-states through strategy optimization.

[0035] It should be noted that a fixed weight, w, is used. I =0.70,w E =0.30. First, gather information or cause disruption with low-impact actions of high impact (e.g., sniffing / light injection), then achieve damage with medium-to-high impact actions (e.g., replay, GPS spoofing); this sequence is preferentially learned under discounted payoff. The agent's policy can be logged to record action sequences, state trajectories, and corresponding r-value outputs for interpretability analysis. To make the scoring more consistent with the characteristics of system security assessment, λ1=0.4, used to measure the importance of resource overhead; λ2=0.3, used to measure the impact of time cost factors; λ3=0.3, used to measure the importance of the probability of attack success.

[0036] An online anomaly detector based on multimodal fusion (other modules of this invention) is deployed to provide early warnings for high-r action sequences. Upon detecting suspicious preparatory actions, the sequence number / session is randomized, the link is switched, or a strong authentication mechanism is triggered to disrupt the continuity of the attack chain. In the event of a high-impact event, a task rollback is initiated or a rapid return to a safe point is achieved, and log reporting is triggered. Defense success rate (frequency of reducing accumulated risk below a threshold), detection latency (seconds), false alarm rate, and false withdrawal rate are all considered. This embodiment is only executed in isolated simulations or authorized test environments; it is prohibited for use in unauthorized attacks on real devices. To improve real-world applicability, the simulation environment should be calibrated with real measurement data as much as possible (link model, interference model, device response latency, etc.), and domain randomization should be used to enhance the robustness of the strategy. After training, the strategy needs to be analyzed for interpretability (action contribution, key state influence), and the results should be fed back to the device developer for improvement.

[0037] S4: Collects and integrates protocol traffic, firmware logs, and sensor data, and identifies potential security threats through multimodal data correlation analysis.

[0038] Furthermore, multi-dimensional feature parameters characterizing device operating status and interactive behavior are extracted from protocol traffic, firmware logs, and sensor data, and these feature parameters are integrated into a unified feature vector; the correlation between different modal data is established to form a multi-modal fusion feature vector, and protocol traffic anomalies, firmware log anomalies, and sensor anomalies are correlated and mapped. Anomaly detection is performed on the multimodal fusion feature vector; by analyzing device operation sequences and communication behavior sequences, behaviors deviating from the normal pattern are identified; supervised or unsupervised learning models are used to train and predict the multimodal fusion feature vector to identify potential threat events; wherein, the multimodal fusion feature vector is a unified feature representation obtained by integrating protocol traffic features, firmware log features and sensor time series features according to a preset fusion algorithm; Output the identified potential threat events, including threat type, time of occurrence, associated devices and node information.

[0039] It should be noted that the device operation sequence and communication behavior deviation identification are as follows: Extract discrete operation sequences (e.g., takeoff→goto→inspect→report→land) and message behavior sequences (command type streams); use sequence similarity (edit distance, DTW) or sequence classification models (seq2vec+softmax) to determine if they deviate from the normal template. If the sequence matching degree is <0, it is marked as abnormal behavior. For communication behavior, if unauthorized command codes or sequence number wrapping occur, or repeated sequences exceed the threshold (>5 times / minute), it is judged as suspicious communication behavior.

[0040] If there are annotations (historical attacks / abnormal events), train XGBoost / LightGBM on x t Multi-class classification is performed using cross-entropy loss and 5-fold cross-validation; the evaluation metrics are Precision / Recall / F1. When annotations are lacking, self-supervised and unsupervised (AE / IForest) approaches are prioritized, training the model using normal operating data and using anomaly scores as the detection threshold. Semantic mutations are applied to the protocol payload, and noise is injected into the sensor data to improve model robustness.

[0041] S5: Based on a comprehensive analysis of multi-level system security information and communication, application and data security indicators, construct a comprehensive security situation assessment system for power drones, and conduct intelligent security assessment and risk classification of inspection data.

[0042] Furthermore, using a graph-based association method, the correlation between protocol traffic features, firmware log features, and sensor time-series features is calculated to construct a multimodal feature association network. Feature nodes are represented as data indicators, and edges represent the strength of their correlation. Community detection or cluster analysis is performed on the association network to discover potential abnormal patterns. Based on the association analysis results, highly correlated abnormal patterns are initially labeled. The identified anomalous data is classified according to the intensity and correlation of the anomalies: ; in, Score the safety risk of the i-th inspection data. Let i be the anomaly intensity index of the i-th inspection data. This represents the maximum value of the abnormal intensity. Let i be the multimodal correlation index of the i-th inspection data. denoted as the maximum value of multimodal correlation, a is the anomaly intensity weight coefficient, and b is the multimodal correlation weight coefficient.

[0043] It should be noted that a=0.60 and b=0.40 are set for the following reasons: the intensity of anomalies (single-point deviation) directly reflects immediate anomaly signals, while multimodal correlation reflects the propagation / linkage risk and credibility of anomalies. By default, the intensity of anomalies is given a slightly higher weight, which can improve the sensitivity to single-point high-severity events.

[0044] Threshold and risk grading strategy (example): First calculate all Estimate the distribution on the validation set, or use an empirical threshold: High risk: ≥0.70; Medium risk: 0.40≤ <0.70; Low risk: <0.40; Threshold calibration is performed based on operational and maintenance capacity and historical true positive rates.

[0045] Suppose an inspection record i has: =0.72, =0.95; calculated from the graph. =0.45, =0.9. Then, after normalization: / =0.7579, / =0.5. Using a=0.6, b=0.4, =0.6547; classified as medium risk (close to the high risk threshold), requiring further manual confirmation or triggering a medium-level response (such as encrypted session verification, short-term replay detection). For For risks ≥0.85 (extremely high risk), automatically trigger a disconnection / switch to a security mode and initiate manual intervention; for medium risk (0.4-0.85), first trigger deep sampling (increase the sampling rate and enable additional logs), and push the event to the operation and maintenance work order; for low risk, record and monitor its frequency changes over a long period of time (if the frequency of a certain type of low-risk event surges, it will be upgraded to a higher level).

[0046] In summary, this invention constructs a multimodal correlation analysis model by integrating protocol traffic, firmware logs, and sensor data. This model enables security threat identification and intelligent assessment from multiple levels, including communication, control, and perception, significantly improving the comprehensiveness and accuracy of data anomaly detection. By introducing a hierarchical algorithm based on anomaly intensity and mutual information correlation, it is possible to perform quantitative risk assessment and dynamic hierarchical response on inspection data, thereby improving the accuracy and real-time performance of security assessment.

[0047] This embodiment also provides a computer device applicable to the intelligent assessment method for power drone inspection data security, including a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to realize the intelligent assessment method for power drone inspection data security as proposed in the above embodiment.

[0048] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0049] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, it implements the intelligent judgment method for power drone inspection data security as proposed in the above embodiment.

[0050] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for intelligently assessing the security of power plant drone inspection data, characterized in that, include: Reverse engineering was performed on the communication protocol and firmware of the power drone system. A combination of fuzz testing and symbolic execution techniques was used to discover and identify vulnerabilities in the communication protocol, firmware, and mobile SDK of the power drone system. The binary code of the electric power drone APP was parsed using a deep learning model to extract temporal and semantic features and identify unauthorized access, hard-coded keys, and abnormal call behavior. A power drone attack and defense verification platform was built to simulate attack scenarios such as GPS spoofing, data link interference and data tampering, and risk assessment was carried out by dynamically simulating the power drone attack chain. Collect and fuse protocol traffic, firmware logs, and sensor data; identify potential security threats through multimodal data correlation analysis. Based on a comprehensive analysis of multi-level system security information and communication, application and data security indicators, a comprehensive security situation assessment system for power drones is constructed to conduct intelligent security assessment and risk classification of inspection data.

2. The intelligent assessment method for power drone inspection data security as described in claim 1, characterized in that, The reverse analysis of the communication protocol and firmware of the power drone system includes: intercepting and obtaining interactive messages using a man-in-the-middle approach, and performing cluster analysis on the message data according to payload length, time series, and frequency characteristics; prioritizing bit-by-bit comparison and differential analysis on small payload clusters of the same size to infer message field boundaries, control codes, sequence numbers, and state machine transition rules; Based on message format and state machine description, a set of standard messages and structured variant messages are constructed to generate protocol test stubs.

3. The intelligent assessment method for power drone inspection data security as described in claim 1, characterized in that: The aforementioned vulnerability discovery and risk identification for the communication protocol, firmware, and mobile SDK of the power drone system includes: A fuzz tester is used to perform mutated inputs on test stubs and real devices, collecting crash, abnormal responses and logs; symbolic execution is applied to the input data parsing and verification functions in the protocol parser and firmware to obtain path constraints, and the constraint solver generates targeted inputs; the targeted inputs generated by symbolic execution are fed back to the fuzz tester to form a hybrid fuzzing closed loop to cover deep paths; Using Ghidra in conjunction with a deep learning model, function localization was performed, and code segments related to communication parsing and key management were marked. Firmware was run in an isolated real device environment, and instrumentation was used to trace and monitor memory access, system calls, and anomalies. Symbolic execution was used to obtain triggerable inputs, and vulnerabilities were reproduced at runtime. Runtime snapshots were recorded to form reproducible proof. It decompiles mobile APKs, scans for permissions and sensitive APIs, and uses a sequence model based on deep neural networks to help identify hard-coded keys and abnormal call chains.

4. The intelligent assessment method for power drone inspection data security as described in claim 1, characterized in that: The process of using a deep learning model to parse the binary code of a power drone APP and extract temporal and semantic features includes: mapping the binary instruction stream or disassembled opcode sequence into a time series representation, dividing it into several time windows according to the calling order or possible execution sequence; calculating statistical features for each time window and inputting them as temporal feature vectors into the sequence model. The instruction sequences, constant tables, string references, and local call relationships of subroutines are mapped to code fragment tokens; a Transformer-based pre-trained encoder is applied to the token sequences to obtain function-level semantic embeddings; an inter-function call graph is constructed, and a graph neural network is used to encode the graph structure to obtain a structured semantic representation; a hybrid network structure is used to fuse temporal features and semantic features, and the calculation formula for the fusion layer is as follows: h fused =LayerNorm(α·W t ·h time + β·W tr ·h trans + γ·W g ·h g + b); Among them, h fused To unify the representation vector, W t W tr W g Let b be the linear mapping matrix, α be the bias vector, β be the normalized fusion weights, LayerNorm be the layer normalization, and h be the weights. time h is the temporal feature vector. trans h is a semantic feature vector. g These are the feature vectors of the graph structure.

5. The intelligent assessment method for power drone inspection data security as described in claim 1, characterized in that, The identification of unauthorized access, hard-coded keys, and abnormal call behavior includes: Extract string constants, global variables, and function call sequences from the binary code or firmware of the power drone application; detect key features, including plaintext keys, hash values, encrypted key identifiers, and hard-coded credentials, using pattern matching and static analysis methods; map the identified string sequences into vector representations using a deep learning model, and analyze the similarity between the vector representations and known key templates; if the similarity exceeds a set threshold, mark it as a key hard-coding risk and output the corresponding position and risk level; construct function call graphs and API call sequence graphs, extract the time interval, call frequency, and call order temporal features of function calls, and input them into an anomaly detection model for learning; mark behaviors exceeding the threshold as abnormal calls through API call anomaly scoring; and generate anomaly behavior alarm reports by combining call context and historical behavior patterns.

6. The intelligent assessment method for power drone inspection data security as described in claim 1, characterized in that: The risk assessment through dynamic simulation of power drone attack chains includes: defining a single-step risk increment function r(s) t ,m t ), used to evaluate in state s t The following attack action m t Immediate risks to the system: ; in, The degree of impact caused by the action. Rate the ease of execution of the attack action. , These are the weighting coefficients; The method for calculating the ease of execution score is as follows: ; in, The resource overhead required to execute the attack. The time cost required to complete this attack action, The attack success probability is scored, with λ1, λ2, and λ3 being the weighting coefficients. An attack strategy generator is selected within the platform to attack agents with the goal of maximizing accumulated risk. By interacting with the simulation environment, the most destructive attack chains are learned, and the defense agent minimizes risk or restores sub-states through strategy optimization.

7. The intelligent assessment method for power drone inspection data security as described in claim 1, characterized in that: The collection and fusion of protocol traffic, firmware logs, and sensor data, through multimodal data correlation analysis, identifies potential security threats, including: Multidimensional feature parameters characterizing device operating status and interactive behavior are extracted from protocol traffic, firmware logs, and sensor data, and these feature parameters are integrated into a unified feature vector. The correlation between different modal data is established to form a multimodal fusion feature vector, and protocol traffic anomalies, firmware log anomalies, and sensor anomalies are correlated and mapped. Anomaly detection is performed on the multimodal fusion feature vector; by analyzing device operation sequences and communication behavior sequences, behaviors deviating from the normal pattern are identified; supervised or unsupervised learning models are used to train and predict the multimodal fusion feature vector to identify potential threat events; wherein, the multimodal fusion feature vector is a unified feature representation obtained by integrating protocol traffic features, firmware log features and sensor time series features according to a preset fusion algorithm; Output the identified potential threat events, including threat type, time of occurrence, associated devices and node information.

8. The intelligent assessment method for power drone inspection data security as described in claim 1, characterized in that: The aforementioned construction of a comprehensive safety situation assessment system for power industry drones involves intelligent safety analysis and risk classification of inspection data, including: Using a graph-based association method, the correlation between protocol traffic features, firmware log features, and sensor time-series features is calculated to construct a multimodal feature association network. Feature nodes are represented as data indicators, and edges represent the strength of their correlation. Community detection or cluster analysis is performed on the association network to discover potential abnormal patterns. Based on the association analysis results, highly correlated abnormal patterns are initially labeled. The identified anomalous data is classified according to the intensity and correlation of the anomalies: ; in, Score the safety risk of the i-th inspection data. Let i be the anomaly intensity index of the i-th inspection data. This represents the maximum value of the abnormal intensity. Let i be the multimodal correlation index of the i-th inspection data. denoted as the maximum value of multimodal correlation, a is the anomaly intensity weight coefficient, and b is the multimodal correlation weight coefficient.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the intelligent judgment method for power drone inspection data security as described in any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the intelligent judgment method for power drone inspection data security as described in any one of claims 1 to 8.

Images