Configuration software execution path reduction method based on cost-sensitive principal component analysis

Abstract

The invention provides a configuration software execution path reduction method based on cost-sensitive principal component analysis, and belongs to the technical field of industrial control system safety. The problem that a traditional cost-sensitive learning method does not adapt to structural features of an industrial control configuration software execution path, and consequently control instruction transmission is delayed is solved. In order to solve the problem of control instruction transmission delay caused by the fact that a traditional cost-sensitive learning method does not adapt to structural features of an industrial control configuration software execution path, the method comprises the steps that S1, the execution path is captured; s2, executing path subtraction; s3, data standardization representation; according to the method, the reduction efficiency is high, the redundant path removal effect is remarkable, the original execution paths can be reduced to tens of thousands from hundreds of thousands through the cost-sensitive principal component analysis algorithm, the reduction rate reaches 91.8% or above, and the data storage and processing pressure is greatly reduced.

Description

Technical Field

[0001] This invention relates to a method for reducing execution paths in configuration software based on cost-sensitive principal component analysis, belonging to the field of industrial control system security technology. Background Technology

[0002] With the improvement of automation and intelligence in power industrial control systems, configuration software, as a core component of industrial control systems, is responsible for communication and control command transmission with devices such as RTUs and PLCs. Its operational security directly affects the stable operation of the power system.

[0003] To achieve anomaly detection in configuration software, it is necessary to obtain its underlying function call paths in real time. However, traditional path acquisition methods use full-path stubbing monitoring, which has two major problems: 1. Large redundancy in execution paths, leading to low data processing efficiency: Configuration software generates massive amounts of function call paths during runtime, including a large amount of duplicate and non-critical path information, consuming a large amount of storage and computing resources, seriously affecting the real-time performance of anomaly detection. 2. Full-path monitoring causes command transmission delays: Traditional stubbing technology monitors all execution paths indiscriminately, which interferes with the normal communication between the configuration software and the underlying devices, causing delays in control command transmission and affecting the stability of industrial production processes.

[0004] In existing technologies, principal component analysis (PCA) is a commonly used data dimensionality reduction method, but it can only remove redundancy from general data and does not take into account the characteristic that "the cost of misjudging abnormal paths is higher than that of misjudging normal paths" in industrial control scenarios. Although cost-sensitive learning methods can cope with the problem of data imbalance, they are not adapted to the structured characteristics of the execution paths of industrial control configuration software. Summary of the Invention

[0005] To address the problem that traditional cost-sensitive learning methods fail to adapt to the structured features of the execution path in industrial control configuration software, leading to delays in control command transmission, this invention proposes a configuration software execution path reduction method based on cost-sensitive principal component analysis.

[0006] The technical solution adopted by the present invention to solve the above problems is as follows: The present invention includes the following steps: Step 1: Use the dynamic binary instrumentation framework to capture the execution path of the industrial control configuration software and obtain the complete execution path of the binary file; Step 2: Perform secondary processing on the obtained execution path data; Step 3: Determine the cost-sensitive vector and key modules of the execution path after secondary processing using the path comparison method; Step 4: Using the improved cost-sensitive principal component analysis algorithm, combined with the cost-sensitive vector of the obtained execution path data, the key modules of the execution path are screened to obtain the final key module location information.

[0007] Furthermore, step 1 specifically includes: The DynamoRIO dynamic binary instrumentation framework is used to copy the executable code of the binary file in the industrial control configuration software to the code buffer. The code instruction is analyzed by simulating execution in units of dynamic basic blocks to obtain the control flow graph and function call graph. Based on the obtained control flow graph and function call graph, analysis code is inserted into the executable code of the binary file for instrumentation analysis to obtain feasible instrumentation location information. Dynamic binary instrumentation is then performed using the feasible instrumentation location information, and the function-level granularity of the executable code before and after dynamic binary instrumentation is recorded to obtain a complete and more comprehensive execution path of the binary file with thread IDs.

[0008] Furthermore, step 2 specifically includes: Remove duplicate content from the execution path data of the binary file in the thread, and record the n most recently appearing different path nodes in each thread. If a new path node is duplicated with the recorded content, delete that node. Based on the thread number in the execution path data of the binary file, the execution flow of each thread in the execution path data after deleting duplicate content and duplicate nodes is extracted into one, completing the secondary processing of the execution path data.

[0009] Furthermore, step 3 specifically includes: Using the function-level modules traversed by the execution path after secondary processing during the execution of the industrial control system configuration software as basic blocks, the basic path blocks obtained during normal operation and the basic path blocks obtained during abnormal operation of the industrial control system configuration software are extracted into execution path feature attributes. When the execution paths of normal and abnormal operations traverse the same basic blocks, the difference in the number of executions of the same basic block is used as the evaluation index for key modules. Based on the function name and function offset address of the basic block, the identical function basic blocks in the execution of normal and abnormal operations are identified. The difference in the number of instructions executed is used as the comparison criterion. The difference in the number of instructions executed is sorted in descending order, and basic blocks within a preset range are selected as key modules. An execution path feature vector set is constructed, and the cost sensitivity vector of the key module is calculated based on the execution path feature vector set. , ,in, n This represents the total number of key modules; The formula for calculating the cost sensitivity vector of a critical module is as follows: (1); In formula (1), For the first iThe cost of each key module For normal operation i Number of times each key module is executed. When an abnormal operation occurs i The number of times each key module is executed.

[0010] Furthermore, step 4 specifically includes: The execution path data after secondary processing is normalized, and the covariance matrix of the normalized execution path data is calculated. For each item in the covariance matrix, eigenvalue decomposition is performed to obtain eigenvectors, and the variance contribution rate corresponding to the eigenvectors is calculated. Iterate through each item in the covariance matrix, sort the variance contribution rates from largest to smallest, set a reduction threshold, obtain the cost-sensitive factor based on the cost-sensitive vector of the key module, and select the feature vector with a variance contribution rate higher than the threshold as the cost-sensitive principal component based on the set reduction threshold, combined with the corresponding key module and the cost-sensitive factor of the key module, and output it. Obtain the final key module location information based on the cost-sensitive principal component. The formula for calculating cost-sensitive principal components is: (2); In formula (2), As a cost-sensitive factor, , The contribution rate of variance For feature vectors, Principal components of data that are cost-sensitive.

[0011] The beneficial effects of this invention are: 1. The present invention has high efficiency in reducing redundant paths and significant effect in removing redundant paths. Through cost-sensitive principal component analysis algorithm, the present invention can reduce the original execution paths from hundreds of thousands to tens of thousands, with a reduction rate of over 91.8%, which greatly reduces the pressure on data storage and processing.

[0012] 2. The critical path extraction of this invention is accurate. Based on the comparison of normal / abnormal operation paths and the calculation of cost-sensitive vectors, this invention ensures that critical modules (such as function blocks dedicated to abnormal operations) are not lost, providing high-quality data support for subsequent anomaly detection.

[0013] 3. This invention adopts the DynamoRIO instrumentation framework. The startup and running time of the configuration software after instrumentation is only about 15 times that of the un-instrumented state, which is far lower than the traditional PIN instrumentation framework, thus avoiding significant delays in the transmission of control commands.

[0014] 4. This invention addresses the closed-source nature of industrial control configuration software and the proprietary nature of its communication protocols, enabling path capture and reduction without relying on source code, thus meeting the actual needs of industrial scenarios such as power industrial control systems. Attached Figure Description

[0015] Figure 1 This is a flowchart illustrating the execution path reduction method for configuration software based on cost-sensitive principal component analysis. Figure 2 The flowchart is for binary dynamic instrumentation based on DynamoRIO; Figure 3 This is a schematic diagram for extracting key modules based on execution path comparison. Detailed Implementation

[0016] Industrial control system configuration software is a user interface used within an industrial control system to enable human-machine or process interaction. The interaction primarily involves data acquisition and process monitoring, providing users with a convenient way to quickly build automated industrial control systems. This paper focuses on anomaly detection in industrial control system configuration software, specifically analyzing the control behavior paths during communication between the process network layer and the control network layer. Through a series of analyses, including capturing, analyzing, reducing, and refining the execution path of control behavior data from the configuration software to the RTU, data with characteristic information is obtained for subsequent analysis and utilization.

[0017] With the gradual development of the industrial control industry, the development forms and functions of configuration software have also been gradually enhanced. It can present process data, set thresholds and commands, control the execution process, and provide alarms and other information. The functions of configuration software are becoming increasingly similar to SCADA software, hence it is also called SCADA software or human-machine interface.

[0018] Configuration software is typically connected to a PLC or RTU. While RTUs and PLCs have similar functions, RTUs are primarily used for wireless data transmission and are usually configured in remote, harsh industrial environments. Because communication between configuration software and RTUs in industrial control systems often uses proprietary communication protocols and data formats, many anomaly detection techniques commonly used in traditional networks are not applicable to industrial control systems. Therefore, this paper focuses on anomaly detection issues during the communication process between configuration software and RTUs.

[0019] This implementation focuses on configuration software. First, it details the overall framework of the cost-sensitive principal component analysis-based execution path reduction method for configuration software proposed in this invention. It proposes capturing real-time execution path data during configuration software runtime using the dynamic binary instrumentation framework DynamoRIO when the binary file source code is unknown. Then, addressing the problem of massive and redundant execution paths, it studies execution path reduction techniques based on cost-sensitive principal component analysis. This allows for the extraction of large amounts of control behavior information into coarser-grained, high-impact execution path data, extracting key control behavior data to facilitate subsequent experiments.

[0020] like Figure 1 As shown, the steps of the configuration software execution path reduction method based on cost-sensitive principal component analysis described in this embodiment include: S1: Execution path capture; The execution path refers to the record and summary of instruction stream information and data information during the execution of a binary executable file. It completely records the content, order, and corresponding data information of the instruction stream executed by the executable file during execution. This invention uses Microsoft's Detours library for instruction path capture.

[0021] Execution paths can be categorized into instruction-level execution paths, function call-level execution paths, and system call-level execution paths based on granularity. Instruction-level granularity offers the most detailed execution path, completely recording the execution path of assembly instructions in the binary file. However, due to the sheer number and complexity of instruction-level paths, it consumes significant storage space and has a substantial impact on the execution speed of the binary file. Function call-level granularity extracts the execution path during runtime by recording functions in the compiled function library within the binary file, providing detailed recording without excessive space or speed consumption. System call-level granularity captures the execution path by recording the dynamic databases (DLLs) called within the binary file, having minimal impact on the binary file's execution speed and offering transparent flow, but its coarse granularity can lead to the loss of some critical information. This invention uses function call-level granularity to describe the execution path of configuration software, primarily for the following two reasons: first, the positive correlation between function call-level execution path acquisition and the operation of the configuration software itself is low, thus limiting its impact on the file's execution speed; second, the amount of data that needs to be recorded is within a controllable range.

[0022] Because real-time dynamic monitoring is required to obtain the execution path during the execution of configuration software, this invention uses the dynamic binary instrumentation framework DynamoRIO to write an information capture module. By inserting analysis code into the program, it runs without interfering with the normal program execution, obtaining execution path information during the dynamic execution process. Compared with other frameworks, DynamoRIO uses a different code-transformation-based detection technology, providing extremely high transparency in the detection of target binary files and preventing detection by malicious software attacking industrial control systems. The DynamoRIO framework also has lower running speed and overhead than other frameworks; the code interpretation overhead during binary file execution is only one-tenth that of other frameworks. DynamoRIO can still be used for dynamic binary instrumentation on machines with poor computing performance or in harsh physical environments. Furthermore, DynamoRIO provides a good secondary development mechanism, offering rich interfaces for writing execution path acquisition modules.

[0023] For the industrial control system configuration software used in this implementation, more detailed DynamoRIO tools were designed using interfaces provided by DynamoRIO, such as dr_module_preferred_name() to obtain the name of a function call and drwrap_get_arg() to obtain the parameter information of a function call. The overall framework of the DynamoRIO-based binary dynamic instrumentation technology is as follows: Figure 2 As shown: The main process of instrumentation is as follows: First, DynamoRIO copies the executable code of the binary file to the code buffer, analyzes the code instructions by simulating execution in units of dynamic basic blocks, and obtains the control flow graph (CFG) and function call graph. Then, it uses the obtained information to perform instrumentation analysis to determine the appropriate instrumentation location information, and then performs dynamic binary instrumentation to finally obtain the execution path data of the captured binary file.

[0024] By instrumenting the function-level granularity of the execution code during the execution process, relevant information about the function is recorded before and after the function is executed, thus obtaining a more complete and comprehensive execution path for the configuration software.

[0025] S2: Execution path reduction; The purpose of execution path reduction techniques is to remove unnecessary path information from the execution path and extract key function modules, thereby obtaining a key execution path dataset. Key modules refer to those modules that significantly impact the result during binary file execution. Because software modules have complex calling mechanisms under normal operating conditions, obtaining key modules will help improve the efficiency of security protection methods.

[0026] This invention extracts the program execution path, performs statistical analysis, and uses execution path reduction technology to remove unnecessary path information, thereby determining the location of key modules in the entire application. The process includes the following steps: S201: Execution path data processing and key behavior extraction; Because the obtained function execution paths are too long and the data volume is huge, a second processing step is required. First, the execution flow of each thread is extracted into a single path based on its thread number. Second, a large amount of redundant and repetitive content is removed from the execution flow of each thread. After these steps, the execution path is still too long. Observation of the path reveals that the program makes many consecutive calls to the same function; for example, continuous data calculations may involve multiple calls to addition, resulting in a large number of consecutive occurrences of two consecutive functions in the path.

[0027] To address this issue, this implementation method records the n most recently occurring distinct path nodes in each thread during processing. If a new path node duplicates the recorded content, that node is deleted. However, shorter paths are not always better; it is necessary to ensure that critical information is not lost during processing.

[0028] S202: Cost-sensitive vector calculation; This invention uses the function-level modules traversed by the execution path during the execution of industrial control system configuration software as basic blocks. First, it extracts the basic blocks of the path obtained during normal operation and those obtained during abnormal operation into execution path feature attributes. Then, through path comparison, it determines the execution path feature vector set. Next, it uses the difference in the number of executions of the same basic block as the basis for determining the key modules of the execution path, reorders the feature vectors, and calculates the cost-sensitive vector based on this.

[0029] The basic principle of key module extraction based on execution path comparison is as follows: Figure 3 As shown, execution paths 1 and 2 serve as a control group to screen for key modules. Path 1 is the execution path obtained when a certain key function is not operated, and path 2 is the execution path obtained when the key function is operated. The basic blocks that are not included in path 1 but are included in path 2 are the key modules of that function. As shown in the figure, the execution order of path 1 is: start → basic block 1 → basic block 3 → end, and the execution order of path 2 is: start → basic block 1 → basic block 2 → basic block 3 → end. Therefore, basic block 2 is identified as the key module of this function.

[0030] Then, comparing the remaining execution paths, when the execution paths of normal and abnormal operations traverse the same basic blocks, the difference in the number of executions of the same basic block is used as the key module evaluation index. The more instructions executed in a single module, the more critical the module is considered, thus determining the execution path feature vector set. Specifically, based on the function name and function offset address, the same function basic blocks in two executions are identified, and the difference in the number of instructions executed in the two executions is used as the comparison basis. The difference in instruction execution is sorted in descending order, and the basic blocks with the largest values ​​are selected as key modules to construct the execution path feature vector set. Assuming a cost-sensitive vector... , ,in, n This represents the total number of critical modules.

[0031] The formula for calculating the cost sensitivity vector of a critical module is as follows: (1); In formula (1), For the first i The cost of each key module For normal operation i Number of times each key module is executed. When an abnormal operation occurs i The number of times each key module is executed.

[0032] The execution path reduction technique is based on the key modules and cost-sensitive vectors in the execution path obtained in the previous section. It uses an improved cost-sensitive principal component analysis algorithm to further filter key modules and obtain the final key module location information.

[0033] The pseudocode for the configuration software execution path reduction method based on cost-sensitive principal component analysis is shown in Table 1. First, the previously obtained execution path dataset is normalized to ensure that the value range of each feature is the same. Then, its covariance matrix is ​​calculated to measure the correlation between different features. For each item in the covariance matrix, eigenvalue decomposition is performed to obtain eigenvectors, and the variance contribution rate corresponding to the eigenvectors is calculated. After traversing all items, the variance contribution rates are sorted from largest to smallest to obtain important eigenvectors. Then, according to the set threshold value, cost-sensitive principal components are selected, i.e., eigenvectors with variance contribution rates higher than the threshold. Finally, the cost-sensitive principal components are returned as output.

[0034] Table 1

[0035] S3: Normalized data representation; The final key module location information is obtained based on the cost-sensitive principal components output by S2.

[0036] Example (a) Implementing environmental preparation 1. Hardware environment: Industrial control computer (CPU: Intel Core i7-10700, memory: 32GB, storage: 1TB SSD), power industrial control configuration software (adapted for RTU device communication), RTU simulation device (model: Huawei RTU310).

[0037] 2. Software environment: Windows 10 64-bit operating system, DynamoRIO 9.0.1 dynamic binary instrumentation framework, Python 3.8 (for cost-sensitive principal component analysis algorithm implementation), and Excel (for path data statistics and comparison).

[0038] (II) Specific Implementation Steps 1. Instrumentation program development: Based on the DynamoRIO framework, instrumentation programs are written, which call the dr_module_preferred_name() interface to obtain the function name and the drwrap_get_arg() interface to obtain the function parameters, thereby realizing real-time capture of the function-level execution path.

[0039] 2. Obtaining the original path: Start the configuration software and RTU simulation device, run the instrumentation program, capture the original execution path under normal operation (such as parameter query, data acquisition) and abnormal operation (such as malicious code injection, parameter tampering) of the configuration software, and store it as a path log file.

[0040] 3. Path preprocessing: Classify path logs by thread number and delete duplicate paths; set a strategy of n=3 to record the latest 3 different path nodes in each thread, remove consecutive and repeated function call paths, and obtain the preprocessed path dataset.

[0041] 4. Cost Sensitivity Vector Calculation: Count the number of times each function basic block is called in normal / abnormal operations, calculate the cost sensitivity factor according to formula (1), and select basic blocks with a cost sensitivity factor greater than 1.0 as candidate key modules.

[0042] 5. Principal Component Analysis Optimization: Normalize the preprocessed path dataset, calculate the covariance matrix, eigenvalues, and variance contribution rate; set threshold=0.2, select principal components with a cumulative variance contribution rate of over 80%, and combine them with cost-sensitive factors for weighting to obtain the critical execution path.

[0043] 6. Validation of results: Compare the number of paths, data processing time, and anomaly detection accuracy before and after path reduction to verify the effectiveness of path reduction.

[0044] (III) Alternative Implementation Plan 1. Instrumentation framework replacement: Frida framework can be used to replace DynamoRIO, which is suitable for lightweight industrial control equipment scenarios and reduces the resource consumption of instrumentation.

[0045] 2. Threshold adjustment: Based on the path characteristics of different configuration software, the threshold parameter can be adjusted to 0.15-0.25 to balance the path reduction rate and the key information retention rate.

[0046] 3. Cost Sensitivity Factor Calculation Optimization: Function execution time weights can be introduced to assign higher cost sensitivity factor weights to basic blocks with longer execution times, thereby further improving the accuracy of critical path extraction.

[0047] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent substitutions, and improvements made to the above embodiments without departing from the scope of the present invention, based on the technical essence of the present invention and within the spirit and principles of the present invention, shall still fall within the protection scope of the present invention.

Claims

1. A method for reducing execution paths in configuration software based on cost-sensitive principal component analysis, characterized in that, include: Step 1: Use the dynamic binary instrumentation framework to capture the execution path of the industrial control configuration software and obtain the complete execution path of the binary file; Step 2: Perform secondary processing on the obtained execution path data; Step 3: Determine the cost-sensitive vector and key modules of the execution path after secondary processing using the path comparison method; Step 4: Using the improved cost-sensitive principal component analysis algorithm, combined with the cost-sensitive vector of the obtained execution path data, the key modules of the execution path are screened to obtain the final key module location information.

2. The configuration software execution path reduction method based on cost-sensitive principal component analysis according to claim 1, characterized in that, Step 1 specifically includes: The DynamoRIO dynamic binary instrumentation framework is used to copy the executable code of the binary file in the industrial control configuration software to the code buffer. The code instruction is analyzed by simulating execution in units of dynamic basic blocks to obtain the control flow graph and function call graph. Based on the obtained control flow graph and function call graph, analysis code is inserted into the executable code of the binary file for instrumentation analysis to obtain feasible instrumentation location information. Dynamic binary instrumentation is then performed using the feasible instrumentation location information, and the function-level granularity of the executable code before and after dynamic binary instrumentation is recorded to obtain a complete and more comprehensive execution path of the binary file with thread IDs.

3. The configuration software execution path reduction method based on cost-sensitive principal component analysis according to claim 1, characterized in that, Step 2 specifically includes: Remove duplicate content from the execution path data of the binary file in the thread, and record the n most recently appearing different path nodes in each thread. If a new path node is duplicated with the recorded content, delete that node. Based on the thread number in the execution path data of the binary file, the execution flow of each thread in the execution path data after deleting duplicate content and duplicate nodes is extracted into one, completing the secondary processing of the execution path data.

4. The configuration software execution path reduction method based on cost-sensitive principal component analysis according to claim 1, characterized in that, Step 3 specifically includes: Using the function-level modules traversed by the execution path after secondary processing during the execution of the industrial control system configuration software as basic blocks, the basic path blocks obtained during normal operation and the basic path blocks obtained during abnormal operation of the industrial control system configuration software are extracted into execution path feature attributes. When the execution paths of normal and abnormal operations traverse the same basic blocks, the difference in the number of executions of the same basic block is used as the evaluation index for key modules. Based on the function name and function offset address of the basic block, the identical function basic blocks in the execution of normal and abnormal operations are identified. The difference in the number of instructions executed is used as the comparison criterion. The difference in the number of instructions executed is sorted in descending order, and basic blocks within a preset range are selected as key modules. An execution path feature vector set is constructed, and the cost sensitivity vector of the key module is calculated based on the execution path feature vector set. , ,in, n This represents the total number of key modules; The formula for calculating the cost sensitivity vector of a critical module is as follows: （1）； In formula (1), For the first i The cost of each key module For normal operation i Number of times each key module is executed. When an abnormal operation occurs i The number of times each key module is executed.

5. The configuration software execution path reduction method based on cost-sensitive principal component analysis according to claim 1, characterized in that, Step 4 specifically includes: The execution path data after secondary processing is normalized, and the covariance matrix of the normalized execution path data is calculated. For each item in the covariance matrix, eigenvalue decomposition is performed to obtain eigenvectors, and the variance contribution rate corresponding to the eigenvectors is calculated. Iterate through each item in the covariance matrix, sort the variance contribution rates from largest to smallest, set a reduction threshold, obtain the cost-sensitive factor based on the cost-sensitive vector of the key module, and select the feature vector with a variance contribution rate higher than the threshold as the cost-sensitive principal component based on the set reduction threshold, combined with the corresponding key module and the cost-sensitive factor of the key module, and output it. Obtain the final key module location information based on the cost-sensitive principal component. The formula for calculating cost-sensitive principal components is: （2）； In formula (2), As a cost-sensitive factor, , The contribution rate of variance For feature vectors, Principal components of data that are cost-sensitive.

Images