Code behavior analysis method for steel rolling process control system

Abstract

The invention discloses a code behavior analysis method for a steel rolling process control system. The code behavior analysis method comprises the following steps: determining an instruction set architecture used by a program in the steel rolling process control system; performing instruction identification and binary processing, dividing a program into basic blocks, and establishing a mapping relation from the basic blocks to functions; analyzing parameter information transmitted to the sub-function by the parent function, and analyzing parameter and variable information of the sub-function through a stack top and stack bottom pointer to obtain a data transmission path in a function calling process; taking the input function as a start point of taint analysis, taking the output function as an end point of taint analysis, performing bidirectional taint analysis on the program, and constructing a program execution chain; performing code semantic analysis on the program, analyzing the typical field of the message, and constructing a weak supervised learning mode combining unsupervised learning and supervised learning to obtain a field identification and classification result. According to the method, program behaviors can be comprehensively mastered, and solid technical support is provided for system debugging, function verification, safety evaluation and potential vulnerability detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of automatic process control of rolling steel, and in particular to a code behavior analysis method for a rolling steel process control system. BACKGROUND

[0002] With the continuous improvement of the automation and intelligence level of the steel industry, the rolling steel process control system plays an increasingly important role in the production process. The rolling steel process control system is usually composed of multiple layers of software modules, including a field acquisition layer, a control decision layer, and an upper monitoring layer. The system has complex internal code logic, frequent data interaction, and high real-time requirements, and the stability and performance of its software directly determine the safety and quality of the rolling process.

[0003] However, existing rolling steel control software is complex, and when faced with system operation abnormalities, logic disorders, or performance bottlenecks, engineers often need to troubleshoot problems by manually tracking logs and reading source code line by line, which not only is inefficient and time-consuming, causing significant economic losses, but also easily misses hidden logical defects. SUMMARY

[0004] The technical problem to be solved by the present application is to address the problems of complex code logic, difficult behavior tracking, high maintenance cost, and difficult safety verification in existing rolling steel process control systems. The present application provides a code behavior analysis method for a rolling steel process control system, which dynamically monitors and models the behavior of executable code during the operation of the rolling steel process control system. The present application realizes panoramic restoration and analysis of the system control logic, communication mechanism, and execution path.

[0005] The technical solution adopted by the present application to solve its technical problem is: The present application provides a code behavior analysis method for a rolling steel process control system, which includes the following steps: Step 1: Preliminary analysis of the program in the rolling steel process control system to determine the instruction set architecture used; Step 2: According to the instruction set architecture, perform instruction recognition and binary processing on the program, analyze the instruction type and address in the program, divide the program into basic blocks according to the entry address and exit address of each basic block, and identify the function entry basic block and function exit basic block according to the call relationship between the instruction type and the basic blocks, and establish the mapping relationship between the basic blocks and the functions; Step 3: Analyze the call relationship between functions to obtain parent functions and child functions, analyze the parameter information passed from the parent function to the child function, and analyze the pointer information of the child function to obtain the data transmission path in the function call process; Step 4, the input and output functions are determined according to functions including a TCP communication function, a memory read and write function, and a file read and write function, the input function is taken as a starting point of the taint analysis, the output function is taken as an end point of the taint analysis, bidirectional taint analysis is carried out on the program, so that the pollution relationship between function variables and mathematical expressions are obtained; Step 5, the program execution chain is constructed in the bidirectional taint analysis, the data flow relationship from the receiving start point of the received message to the sending end point of the sent message is located, and the variable dependency relationship therebetween is located; Step 6, after the bidirectional taint analysis is completed, code semantic analysis is carried out on the program, and typical fields of the message are analyzed, so that a weak supervision learning mode combining unsupervised learning and supervised learning is constructed, and a result of field recognition classification is obtained.

[0006] Further, the binary processing method in the step 2 of the application comprises: According to an instruction set architecture, the byte stream of the program is uniformly formatted, the binary file of the program is read and converted into instructions of the instruction set and saved into the memory.

[0007] Further, the method for dividing the basic block in the step 2 of the application comprises: All instructions in the program are traversed, the type of each instruction and the address of the instruction in the program are analyzed, and an instruction sequence is formed; whether the instruction is an entrance or an exit address of the basic block is determined according to the type of the instruction; based on the characteristics of the basic block and the continuity of the code, invalid instructions are removed, each basic block has only one entrance and one exit, the entrance and exit addresses of all basic blocks are identified, and the program is divided into multiple basic blocks according to the addresses.

[0008] Further, the method for establishing the mapping relationship between the basic block and the function in the step 2 of the application comprises: The instructions of each basic block are traversed, the function entrance address is judged through the type of the instruction, and the basic block containing the function entrance address is marked as a function entrance basic block; the position of the function exit basic block is judged according to the calling relationship between the basic blocks and the type of the basic block, so that the mapping between the basic block and the function is completed; each function is composed of an entrance basic block and at least one exit basic block.

[0009] Further, the method of the step 3 of the application comprises: The calling relationship and the parameter transmission between the functions are analyzed, the parameters and the local variables of the functions are obtained through the simulation memory technology and the specific instructions; for each parent function, the stack pushing instruction before the function calling is identified, and the parameter information transmitted to the child function is determined; for each child function, the top pointer and the bottom pointer of the stack are extracted, the parameter area of the child function is determined according to the two pointers, and the data transmission path between the functions is constructed.

[0010] Further, the method of step 4 of the present application comprises: After the data transfer path reconstruction is completed, the program input and output functions are obtained, the input function is taken as the starting point of the taint analysis, the output function is taken as the end point of the taint analysis, the program is subjected to bidirectional taint analysis, the position of the function variable is determined through the address range between the stack top pointer and the stack bottom pointer, and the variable is accessed by means of the stack bottom pointer minus the offset; the data transfer path is subjected to taint analysis in units of functions, the function variable pollution relationship graph is established, and the mathematical relationship of the variable transfer within the function and between the functions is recorded.

[0011] Further, the method of step 5 of the present application comprises: The received message is set as a forward taint source, the forward taint propagation is performed along the code execution sequence, so as to track the data flow and extract the program execution path; in the forward taint analysis, the instruction execution sequence of the program forms a program execution chain, each node of the program execution chain corresponds to an instruction, and the complete memory state after the execution of the instruction is recorded, the memory state includes the values of the registers and the memory addresses, and a taint mark set; the program execution chain further includes a field program execution chain, which is divided on the basis of the program execution chain, and is taken as a unit of the message field, the instructions involved by the field are extracted to form the field program execution chain, and the chain stores the field path; On the same path, the sending message is taken as a reverse taint source, the program execution chain is combined, and the data source is traced back to the generation starting point of the sending message and the processing end point of the receiving message, and the variable dependency relationship therebetween is obtained.

[0012] Further, the method of step 6 of the present application for code semantic analysis comprises: Through the library function call, the behaviors existing in the program are identified, the data information provided in the program is obtained through the analysis of the function parameter values, including network semantics, file semantics and time semantics; The message typical field analysis includes: The protocol identifier field is located in the starting part of the message, the first three fields of a plurality of messages are compared, if the field at a position has the same value in all messages, it is determined that the field is the protocol identifier field; The end symbol field is located at the end of the message, the end fields of a plurality of messages are compared, if the value thereof remains consistent in all messages, it is identified as the end symbol field; Length field, divided into two categories: the first category represents the length of the entire message, or the length of all data after the field; the second category represents the length of the variable field; the first length field is identified by sequence comparison method, and the specific mode is as follows: if the value of a field is equal to the length of the entire message, or equal to the total length of all fields after the field, and the relationship is met in multiple messages, then the field is determined as the first length field; Check code field, for simple check mode, the check value of all bytes before the field is calculated, and it is verified whether it matches the target field; if multiple messages meet the relationship, it is determined as the check code field; for complex check mode, combined with the pollution analysis result, if a field meets the following conditions in multiple messages: it is generated after all previous byte assignments are completed, and its value is contaminated by all previous bytes, it is identified as the check code field.

[0013] Further, the weak supervision learning mode in the step 6 of the method comprises: Field feature vector extraction: the field program execution chain is extracted, expanded and null string operation is performed, and then a vector generation method is adopted; for each field program execution path of the binary code message input, a vector with a size of 128*100 is generated; 12 features of the field program execution chain are extracted, a 1*12 row vector is generated, and the row vector is spliced with the 128*100 vector to obtain a 128*112 field feature vector; the 12 features include: starting position, field length, whether it is a pointer, whether it is a conditional variable, whether it is an array, input and output function, mathematical function, string function, file function, memory allocation function, date and time function and network function; Unsupervised clustering stage: according to the extracted field feature vector, an unsupervised clustering algorithm is adopted to group the field feature vectors, similar fields in semantics or structure are classified into the same category, and a category label is automatically assigned to each field as a training basis for subsequent supervised learning; the clustering algorithm includes a K-Means algorithm; Supervised training stage: the field category label obtained in the unsupervised clustering stage is used to guide the model to perform supervised training, and finally the performance index of the model on the field classification task is evaluated; the model includes a Transformer model.

[0014] The application provides a code behavior analysis system for a rolling process control system, comprising: A memory for storing an executable computer program; A processor for executing the executable computer program stored in the memory to implement the code behavior analysis method for the rolling process control system.

[0015] The application has the following beneficial effects: The method of the present application realizes accurate understanding of the behavior of the rolling process control system program through the complete process from instruction set recognition, binary processing, basic block and function division, data transfer reconstruction, and deep learning semantic analysis. Each stage is closely linked, binary processing ensures the accuracy of basic block and function division, function parameter analysis and taint analysis reconstruct the program execution path and variable flow, multi-aspect semantic extraction makes the semantic information more rich, and the deep learning model provides semantic understanding of the program logic and behavior. Through the method of the present application, the program behavior can be comprehensively mastered, which provides solid technical support for system debugging, function verification, safety evaluation and potential vulnerability detection. BRIEF DESCRIPTION OF DRAWINGS

[0016] The present application will be further described below in conjunction with the accompanying drawings and embodiments, wherein: Figure 1 is a method flowchart of an embodiment of the present application; Figure 2 is a bidirectional taint analysis flowchart of an embodiment of the present application; Figure 3 is a flowchart of converting a field program execution chain into a vector of an embodiment of the present application. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0018] Embodiment 1 The core idea of the code behavior analysis method for the rolling process control system of the embodiment of the present application is: without accessing the source code, using binary analysis and behavior recognition technology, extracting the instruction flow, data flow and communication flow information of the program runtime, and constructing a multi-level "behavior semantic model". The model maps the bottom layer machine instructions to the upper layer control semantics through an algorithm, and then automatically generates a control logic atlas, realizing the structured analysis of the rolling process control system. As shown in the figure, Figure 1 The steps of the method of the embodiment of the present application are as follows: 1. First, the target program in the rolling process control system is analyzed to determine the instruction set architecture used.

[0019] The system can recognize common processor instruction sets, including x86, ARM, MIPS and other instruction sets such as RL78. Through analysis of the instruction set, the method can obtain the length, operation type and operand information of each instruction, laying a foundation for subsequent binary processing and control flow analysis.

[0020] The identification of the instruction set architecture can not only guide the instruction parsing process, but also determine the semantic meaning of specific instructions in program execution, such as conditional jump, function call or data operation, thereby providing accurate basis for the division of basic blocks.

[0021] 2、After the instruction set architecture is identified, the method uniformly formats the byte stream of the program, reads the binary file of the program and converts it into instructions corresponding to the instruction set into the memory.

[0022] The system traverses all instructions in the program, analyzes the type of each instruction and its address in the program, and forms an instruction sequence. Through the judgment of the type of the instruction, the method can determine whether the instruction is the entrance or exit address of the basic block. Specifically, based on the characteristics of the basic block and the continuity of the code, invalid instructions such as NOP are removed, each basic block has only one entrance and one exit, the system identifies the entrance and exit addresses of all basic blocks, and divides the program into multiple basic blocks according to these addresses.

[0023] After completing the division of the basic block, the method further analyzes the calling relationship between the basic blocks and the internal instruction sequence. The system traverses the instructions of each basic block, judges the function entrance address through the type of the instruction, and marks the basic block containing the function entrance address as the function entrance basic block. Subsequently, the system determines the position of the function exit basic block according to the calling relationship between the basic blocks and the type of the basic block, thereby completing the mapping of the basic block to the function. Each function is composed of an entrance basic block and at least one exit basic block, ensuring that the function boundary is clear and the logic is complete, providing a basis for data flow analysis and parameter area reconstruction.

[0024] 3、After the function division is completed, the system further analyzes the calling relationship between functions and parameter passing, and obtains the parameters and local variables of the function through simulation memory technology combined with specific instructions. For each parent function, the method traverses its instruction sequence, identifies the stack pushing instruction before the function call, and determines the parameter information passed to the child function. For each child function, the system extracts its stack top pointer and stack bottom pointer, determines the parameter area of the child function according to the two pointers, and constructs the data transmission path between functions. Through this method, the system can completely capture the flow of data in the function call process, forming the basis of data flow transmission.

[0025] 4、After the data transmission path reconstruction is completed, the method captures the input and output functions of the program, takes the received input as the starting point of the taint analysis, and takes the output as the end point of the taint analysis, performs bidirectional taint analysis on the program to obtain the pollution relationship between function variables and mathematical expressions.

[0026] The system first determines the location of the function variable through the address range between the top pointer and the bottom pointer of the stack, and accesses the variable by reducing the offset from the bottom pointer. Subsequently, the system performs a data transfer path pollution analysis in units of functions, establishes a function variable pollution relationship graph, and records the mathematical relationship of the variable transfer within and between functions. This process not only reveals the variable dependence, but also provides a basis for potential vulnerability detection, helping to identify potential security risks or logical abnormalities in function calls.

[0027] 5. Perform bidirectional pollution analysis, which begins with the target executable program. As shown in FIG. 1, a flowchart of bidirectional pollution analysis is shown. Figure 2

[0028] First, the actually received message is taken as a forward pollution source, and forward pollution propagation is performed along the code execution order to track the data flow and extract the program execution path. In forward pollution analysis, a large number of real messages need to be collected as a sample set, and other address variables in the memory are polluted by the execution of the program, because the received message is an actual value, the control flow jump can be calculated, and then the program execution chain of the current message is obtained, avoiding the path explosion problem. The sending message is taken as the end point of the analysis, and then it can be analyzed how the fields of the received message pollute the sending message and other address variables, and then the protocol word is divided.

[0029] In the preferred embodiment of the present application, a field program execution chain is also constructed on the basis of the program execution chain. Specifically, on the basis of the program execution chain, it is further divided into units of message fields, and according to the results of the pollution analysis, the instructions involved in the fields are extracted, and these instructions form the field program execution chain, which stores the field path. The paths taken by different fields are definitely different, and the paths taken by the same field under different inputs are probably different. For different binary implementation methods, the paths taken by the same field under the same input are also different.

[0030] In forward pollution analysis, the instruction execution sequence of the program forms a program execution chain. Each node of the chain corresponds to an instruction and records the complete memory state after execution of the instruction. The memory state includes the values of registers and memory addresses, a set of pollution marks, and other information.

[0031] Subsequently, on the same path, the sending message is taken as a reverse pollution source, and the program execution chain constructed by the forward pollution analysis is combined to trace back to its data source. Since it is a real message, reverse pollution analysis can be performed along the program execution chain, and the source of the sending message can be obtained (because it comes not only from the received message, but also from other address variables in the memory). This method finally accurately locates the processing end point of the received message and the generation starting point of the sending message, and clarifies the variable dependence relationship therebetween.

[0032] ​6. After the completion of the taint analysis, the method proceeds to code semantic analysis.

[0033] A. By library function call, it can be identified which behaviors exist in the program, and by analyzing the function parameter value, it can obtain the data information provided in the program. Including network semantics, file semantics, time semantics, etc.

[0034] B. Analysis of typical fields in the message: (1) Protocol identifier field The protocol identifier is usually located at the beginning of the message. This method sets the identification threshold to the first three fields, and by comparing the first three fields of multiple messages, if the field at a certain position has the same value in all messages, it is determined that the field is the protocol identifier field.

[0035] (2) End symbol field The end symbol field is located at the end of the message. By comparing the end fields of multiple messages, if the value remains the same in all messages, it is identified as the end symbol field.

[0036] (3) Length field The length field can be divided into two categories: the first type indicates the length of the entire message, or the length of all data after the field; the second type indicates the length of the variable field. The first type of length field can be identified by the sequence comparison method, and the specific method is: if the value of a certain field is equal to the length of the entire message, or equal to the total length of all fields after the field, and it satisfies this relationship in multiple messages, then it is determined that the field is the first type of length field.

[0037] (4) Check code field For simple check methods (such as parity check, cumulative sum check, CRC check, etc.), the check value of all bytes before the field can be calculated and verified to match the target field. If multiple messages satisfy this relationship, it is determined to be a check code field. For complex check methods, the results of taint analysis can be used for identification: if a field is generated after all previous bytes are assigned, and its value is contaminated by all previous bytes, and this feature is present in multiple messages, it is identified as a check code field.

[0038] C. Weak supervision learning paradigm is used, the core idea of which is to use limited supervised information to guide the model to complete a specific analysis task. Unlike the learning method that relies on full-quantity labeled data, this method uses a combination of unsupervised learning and supervised learning in the training process, hence the name "weak supervision". The learning process mainly includes the following two stages: Unsupervised clustering stage: This stage uses unsupervised clustering algorithms to group field features, and classifies fields with similar semantics or structures into the same category, and automatically assigns a category label to each field as a training basis for subsequent supervised learning; Supervised training phase: In this phase, the model is guided to perform supervised training using the field category labels obtained in the previous phase, and finally the accuracy and other performance indicators of the model on the field classification task are evaluated.

[0039] In another specific embodiment of the present application, the field program execution chain is extracted and expanded to 128 lines, and if it is not full, it is filled with empty strings, and then a word2vec-based vector generation method is used. For each field of the input message in the binary code, the program execution path generates a vector with a size of 128x100 and a vector with a size of 12x1. That is, it is converted into a 128x100 matrix, 12 features of the execution chain are extracted, including the starting position, field length, etc., and a 1x12 row vector is generated. The 12 features include: starting position, field length, whether it is a pointer, whether it is a conditional variable, whether it is an array, input / output function, mathematical function, string function, file function, memory allocation function, date and time function, network function. As shown in the flowchart of the field program execution chain converted into a vector. Figure 3

[0040] Then expand the row vector to generate a 128x12 matrix, concatenate the matrix with the obtained 128x100 vector to obtain a unified 128x112-dimensional field feature vector, and operate on each message field. On this basis, first, the K-Means algorithm is used to cluster and label the field vectors, and finally the supervised training and verification are performed using the neural network model based on the Transformer, so as to realize the automatic recognition of the field semantic function and divide the semantics with the same behavior.

[0041] Example 2: Analyzing the speed control protocol and logic of the main drive of the rolling mill Background and purpose: On a certain hot continuous rolling production line, the speed control of the main drive motor is the key to ensure the rolling rhythm and the thickness of the strip. Since the protocol document provided by the original process control system supplier is incomplete, when integrating with a third-party system (such as a new diagnostic system) or optimizing the control logic, the problem of opaque protocol and unclear data point meaning is faced. The present embodiment aims to analyze the binary executable program responsible for the speed control of the main drive of the rolling mill, automatically identify the communication protocol format between it and the subordinate drive, and restore the calculation and transmission logic of the key speed setting value.

[0042] Implementation process: Instruction set identification and binary processing: ​System loads binary file, through the analysis of file header magic number and instruction characteristics, identify the program as ARM Cortex-M architecture-based embedded software. Accordingly, the system uses the corresponding ARM instruction decoder, binary stream into the instruction sequence can be analyzed.

[0043] Basic block division and function recognition: Method traverses the instruction sequence, identifies all conditional branches (such as BNE), unconditional jump (such as B) and function return (such as BX LR) instructions, and divides the code into 258 basic blocks.

[0044] Further analysis found that these basic blocks composed of such as: SpeedCalculate, CommSendPacket, CommReceivePacket and other 43 core functions.

[0045] Data flow and parameter transmission analysis: System focuses on the analysis of SpeedCalculate function. Through the simulation of stack operation, it is determined that the function receives 2 parameters (entry parameter 1: current speed feedback value; entry parameter 2: target speed setting value), and returns 1 calculation result (calculated speed output value). Analyze its internal call relationship, found that the function will call PID_Regulate function for PID operation.

[0046] Bidirectional pollution analysis and execution chain construction: Forward pollution analysis: take the speed setting instruction packet received from the network socket recv function as the source of pollution. After the analysis function, the pollution data is transmitted to the parameter 2 of the SpeedCalculate function. The system builds a complete execution chain, clearly shows the complete data flow from packet reception, analysis, to the core control algorithm.

[0047] Reverse pollution analysis: take the send function call to the driver as the starting point, and the data load as the target for reverse source tracing. Analysis found that the data is generated by the calculation result of the SpeedCalculate function after formatting. Through bidirectional analysis, the causal relationship chain of "set instruction packet -> SpeedCalculate function -> output control packet" is accurately established.

[0048] Code semantic analysis and protocol field recognition: Library function recognition: identify recv, send, hton, ntohl and other network byte sequence conversion functions, confirm the network communication behavior of the program.

[0049] Automatic identification of message fields: Protocol Identifier: By comparing multiple input and output messages, it was found that the first two bytes of all messages are fixed as 0xAA5A, which is identified as the protocol identifier field.

[0050] Length field: The values ​​of the 3rd and 4th bytes of the message are always equal to the length of the entire message minus 4 (the identifier and the length field itself), and are identified as the length field.

[0051] Checksum field: The last byte of the message. Through taint analysis, it was found that its value is obtained by summing and inverting all the preceding bytes, and it is identified as the checksum field.

[0052] Key data location: By combining taint analysis, the speed setpoint (a 4-byte floating-point number starting from the 6th byte offset of the input message) and the actual speed output value (a 4-byte floating-point number starting from the 6th byte offset of the output message) were accurately located in the message.

[0053] Beneficial effects: This embodiment successfully reverse-engineered the protocol and restored the logic of the black-box control program. Engineers can obtain the precise message format of the speed control command, the specific location of the setpoint in the message, and the input-output relationship of the core control algorithm function without needing the source code. This provides a direct basis for system integration, performance debugging, and logic verification, greatly reducing reliance on original manufacturer technical documentation.

[0054] Example 3: Identifying potential defects in the control logic of the roll cooling water valve Background and Purpose: In the cold rolling process, the opening control of the roll cooling water valves is crucial to the strip shape quality. Maintenance personnel discovered occasional minor fluctuations in the strip shape control of a certain stand, suspecting a defect in the control logic, but traditional log checks were insufficient to pinpoint the problem. This embodiment applies the described method to perform deep behavioral analysis of the water valve control program, aiming to discover potentially abnormal data paths or unverified parameter transmissions within the control logic.

[0055] Implementation process: The steps from "Instruction Set Identification and Binary Processing" to "Data Flow and Parameter Transfer Analysis" are the same as in Example 1: Instruction set identification (x86), basic block / function partitioning, and data flow analysis are completed. The key function WaterValveControl is identified, which reads the current temperature from shared memory and calculates the output water valve opening.

[0056] Two-way taint analysis (focusing on security and robustness): Use the temperature value obtained from a shared memory read function (such as ReadThermalSensor) as the taint source to initiate positive taint analysis.

[0057] When stain data is passed inside the WaterValveControl function, the system finds a branch path in which the temperature value is not checked for validity range before being used in calculations (for example, theoretically the temperature value should not exceed 1000°C).

[0058] By reverse taint analysis, tracing back from the function call that writes the water valve opening, it was confirmed that this unverified data path ultimately affects the output opening value.

[0059] Code semantic parsing and weakly supervised learning: Library function identification: The file operation functions fopen and fprintf were identified. It was found that they attempt to log errors in the exception handling branch, but the file path pointer may be null.

[0060] Weakly supervised learning identifies anomalous patterns: Vector generation: Generate 128×112 dimensional feature vectors based on the execution chain of all variables and calculation paths involved in temperature processing within the WaterValveControl function.

[0061] Unsupervised clustering: K-Means was used to cluster a large number of normal and simulated abnormal running trajectories. The results showed that most trajectories clustered in a few core clusters, but a few trajectories (corresponding to unverified data paths) formed a distinct outlier cluster.

[0062] Supervised training and identification: The Transformer model was trained using clustering results as weak labels. The model successfully learned that "lack of boundary checks" and "using potentially invalid inputs" are salient features of anomalous paths. When analyzing real-world data, the model automatically flagged these suspicious paths.

[0063] Beneficial effects: This embodiment goes beyond simple protocol parsing, achieving in-depth analysis of potential defects within the control logic. The method not only reconstructs the normal data flow, but more importantly, through a combination of taint analysis and weakly supervised learning, it automatically identifies an abnormal control path lacking input validation. This provides engineers with precise troubleshooting directions, indicating potential risks of control anomalies caused by sensor malfunctions or communication interference. Thus, it enables proactive safety verification and stability assurance for the steel rolling process control system, demonstrating the significant value of this invention in enhancing system robustness.

[0064] In summary, this invention provides a code behavior analysis method for steel rolling process control systems, primarily applied to the software layer of automated steel rolling process control systems. Starting from the perspective of binary code, this method analyzes, models, and reconstructs the behavioral characteristics of executable programs to establish a behavioral graph of the steel rolling control logic. This enables automatic identification, reconstruction, and security analysis of the system's internal control algorithms, communication protocols, and call chains. The main objective of this invention is to achieve accurate code behavior analysis for complex industrial process control systems without requiring source code, thereby assisting developers and maintenance personnel in understanding system logic, detecting vulnerabilities, verifying control stability, and providing data support for subsequent control algorithm optimization, security protection, and system migration. This method is not only applicable to traditional hot and cold rolling process control systems but can also be extended to other process control industrial software systems, serving as a crucial technological foundation for realizing the visualization, security, and intelligence of industrial software. Regarding versatility, this invention employs a universal binary analysis framework and protocol self-identification mechanism, compatible with control programs from different architectures, languages, and vendors. By automatically identifying instruction streams and communication messages, it achieves unified analysis across multiple systems and versions, possessing strong versatility and adaptability. In terms of innovation, this invention breaks through the limitations of traditional static decompilation, combining binary behavior modeling with protocol reverse analysis. It can restore the complete control logic by relying solely on runtime instruction flow and communication characteristics, achieving efficient mapping from black-box code to behavioral semantics. This avoids dependence on source code and symbolic information, and significantly improves the efficiency of code analysis and security verification of industrial process control systems.

[0065] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0066] It should be understood that those skilled in the art can make improvements or modifications based on the above description, and all such improvements and modifications should fall within the protection scope of the appended claims.

Claims

1. A code behavior parsing method for a steel rolling process control system, characterized in that, The method includes the following steps: Step 1: Conduct a preliminary analysis of the program in the steel rolling process control system to determine the instruction set architecture it uses; Step 2: Based on the instruction set architecture, perform instruction identification and binary processing on the program, analyze the instruction type and its address in the program, divide the program into basic blocks according to the entry and exit addresses of each identified basic block, and identify the function entry basic block and function exit basic block according to the instruction type and the calling relationship between basic blocks, and establish the mapping relationship from basic blocks to functions. Step 3: Analyze the call relationship between functions to obtain the parent function and child function. Analyze the parameter information passed from the parent function to the child function, and analyze the pointer information of the child function to obtain the data transfer path in the function call process. Step 4: Determine the input and output functions based on the functions including TCP communication functions, memory read / write functions, and file read / write functions. Use the input function as the starting point for taint analysis and the output function as the ending point for taint analysis. Perform bidirectional taint analysis on the program to obtain the taint relationships and mathematical expressions between function variables. Step 5: Construct the program execution chain in bidirectional taint analysis to locate the data flow relationship from the start point of receiving a received message to the end point of sending a sent message, as well as the variable dependencies between them; Step 6: After completing the bidirectional taint analysis, perform code semantic parsing on the program and analyze typical fields of the message. Construct a weakly supervised learning method that combines unsupervised learning and supervised learning to obtain the results of field recognition and classification.

2. The code behavior parsing method for steel rolling process control systems according to claim 1, characterized in that, The binary processing method in step 2 includes: Based on the instruction set architecture, the program's byte stream is uniformly formatted, the program's binary file is read and converted into instructions of the instruction set and stored in memory.

3. The code behavior parsing method for steel rolling process control systems according to claim 1, characterized in that, The method for dividing the basic blocks in step 2 includes: Iterate through all instructions in the program, analyze the type of each instruction and its address in the program to form an instruction sequence; determine whether an instruction is the entry or exit address of a basic block based on its type; based on the characteristics of basic blocks and the continuity of code, remove invalid instructions, each basic block has only one entry and one exit, identify the entry and exit addresses of all basic blocks, and divide the program into multiple basic blocks based on these addresses.

4. The code behavior parsing method for steel rolling process control systems according to claim 3, characterized in that, The method for establishing the mapping relationship from basic blocks to functions in step 2 includes: The instructions of each basic block are traversed, the function entry address is determined by the instruction type, and the basic block containing the function entry address is marked as the function entry basic block; the location of the function exit basic block is determined according to the calling relationship between basic blocks and the basic block type, thus completing the mapping from basic block to function; each function consists of one entry basic block and at least one exit basic block.

5. The code behavior parsing method for steel rolling process control systems according to claim 1, characterized in that, The method in step 3 includes: The function call relationships and parameter passing are analyzed. By simulating memory and combining specific instructions, the parameters and local variables of the functions are obtained. For each parent function, its instruction sequence is traversed to identify the push instruction before the function call and determine the parameter information passed to the child function. For each child function, its stack top pointer and stack bottom pointer are extracted, and the parameter area of ​​the child function is determined based on the two pointers to construct the data transfer path between functions.

6. The code behavior parsing method for steel rolling process control systems according to claim 1, characterized in that, The method in step 4 includes: After the data transfer path is reconstructed, the program's input and output functions are obtained. The input function is used as the starting point for taint analysis, and the output function is used as the ending point for taint analysis. Bidirectional taint analysis is performed on the program. The location of function variables is determined by the address range between the stack top pointer and the stack bottom pointer, and variables are accessed by subtracting the offset from the stack bottom pointer. The taint analysis is performed on the data transfer path on a function-by-function basis, a function variable taint graph is established, and the mathematical relationships of variables passed within and between functions are recorded.

7. The code behavior parsing method for steel rolling process control systems according to claim 1, characterized in that, The method in step 5 includes: The received message is designated as a positive taint source, and positive taint propagation is performed along the code execution order to trace the data flow and extract the program execution path. In positive taint analysis, the program's instruction execution sequence forms a program execution chain. Each node in the program execution chain corresponds to an instruction and records the complete memory state after the instruction is executed. The memory state includes the values ​​of registers and memory addresses, and the set of taint marks. The program execution chain also includes a field program execution chain, which is divided based on the program execution chain. The instructions involved in the field are extracted to form a field program execution chain, and this chain stores the field path. On the same path, using the sent message as the reverse taint source, combined with the program execution chain, we trace back to its data source, locate the processing endpoint of the received message and the generation starting point of the sent message, and obtain the variable dependencies between them.

8. The code behavior parsing method for a steel rolling process control system according to claim 7, characterized in that, The methods for performing code semantic parsing in step 6 include: By calling library functions, we can identify the behaviors in the program and obtain the data information provided by the program, including network semantics, file semantics, and time semantics, by analyzing the function parameter values. Analysis of typical message fields, including: The protocol identifier field is located at the beginning of the message. By comparing the first three fields of multiple messages, if a field at a certain position has the same value in all messages, then that field is determined to be the protocol identifier field. The terminator field is located at the end of the message. It is identified as the terminator field if its value is consistent across all messages when comparing the terminator fields of multiple messages. The length field is divided into two categories: the first category represents the length of the entire message, or the length of all data after this field; the second category represents the length of a variable field. The first category of length fields is identified by a sequence comparison method. Specifically, if the value of a field is equal to the length of the entire message, or equal to the total length of all fields after this field, and this relationship is satisfied in multiple messages, then the field is determined to be a first category of length field. For simple verification methods, the checksum field is determined by calculating the checksum value of all bytes preceding it and verifying whether it matches the target field. If multiple messages satisfy this relationship, it is identified as a checksum field. For complex verification methods, it is identified by combining the results of taint analysis. If a field satisfies the following conditions in multiple messages: it is generated only after all bytes preceding it have been assigned a value, and its value is tainted by all bytes preceding it, it is identified as a checksum field.

9. The code behavior parsing method for a steel rolling process control system according to claim 8, characterized in that, The weakly supervised learning methods in step 6 include: Field feature vector extraction: The field program execution chain is extracted, expanded, and padded with empty strings, and then a vector generation method is used. For each field program execution path in the binary code input, a vector of size 128×100 is generated. Twelve features of each field program execution chain are extracted to generate a 1×12 row vector, which is concatenated with the 128×100 vector to obtain a 128×112 field feature vector. The 12 features include: starting position, field length, whether it is a pointer, whether it is a condition variable, whether it is an array, input / output function, mathematical function, string function, file function, memory allocation function, date and time function, and network function. Unsupervised clustering stage: Based on the extracted field feature vectors, an unsupervised clustering algorithm is used to group the field feature vectors, classifying fields with similar semantics or structure into the same category, and automatically assigning a category label to each field as the training basis for subsequent supervised learning; the clustering algorithm includes the K-Means algorithm; Supervised training phase: The field category labels obtained in the unsupervised clustering phase are used to guide the model in supervised training, and the model's performance metrics on the field classification task are finally evaluated; the model includes the Transformer model.

10. A code behavior parsing system for steel rolling process control systems, characterized in that, include: Memory, used to store executable computer programs; A processor, when executing an executable computer program stored in memory, implements the code behavior parsing method for a steel rolling process control system as described in any one of claims 1 to 9.

Images