Power monitoring system vulnerability monitoring method based on dynamic instruction stream analysis

Abstract

The invention provides a power monitoring system vulnerability monitoring method based on dynamic instruction stream analysis, and belongs to the technical field of information security. The method comprises the steps that a bottom-layer instruction stream in the running period is obtained, and the bottom-layer instruction stream comprises an instruction operation code, an instruction reading register, an instruction writing register, an instruction access address and an instruction execution timestamp; according to the instruction execution timestamp, carrying out time sequence sorting on the underlying instruction stream to obtain a directed time sequence diagram; performing instruction behavior feature extraction according to the directed time sequence diagram to obtain an instruction behavior vector; performing instruction behavior modeling according to the instruction behavior vector in the safe operation state to obtain a normal behavior reference model; performing abnormal instruction detection and vulnerability identification on the currently collected instruction behavior vector according to the normal behavior reference model to obtain a vulnerability identification result; and carrying out risk grading according to the vulnerability identification result to obtain a risk grade. According to the method, the detection coverage rate and the vulnerability discovery depth of vulnerability monitoring can be improved.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a vulnerability monitoring method for power monitoring systems based on dynamic command flow analysis. Background Technology

[0002] Currently, vulnerability detection and analysis methods for power monitoring systems mainly rely on static analysis and rule-based vulnerability scanning techniques. Their structure typically includes three core components: a static code analysis module, a vulnerability feature matching module, and a report generation module.

[0003] In such systems, the detection process often relies on predefined vulnerability rule bases, scanning source code, configuration files, or binary files to discover potential problems. For example, traditional static analysis tools parse the program's control flow graph (CFG) or data flow graph (DFG) and compare it with a vulnerability signature database to identify common issues such as out-of-bounds access, uninitialized variables, and communication protocol misconfigurations.

[0004] Furthermore, some improved solutions incorporate semi-dynamic analysis mechanisms in their structure, executing partial instruction paths in virtual machines or sandbox environments to more closely approximate real-world operating scenarios. However, these systems often remain primarily driven by static analysis, lacking the ability to monitor and deeply model system runtime behavior in real time. Because the analysis focuses mainly on the code level rather than the runtime instruction flow level, it fails to capture contextual changes, system call chain interactions, and the dynamic impact of external inputs during instruction execution.

[0005] The above process is basically input code or configuration, static parsing, feature matching, and result output. This linear structure is simple, but it is limited when dealing with complex power monitoring systems. When the command flow changes drastically, the detection results often have problems such as high false alarm rate, low coverage, and difficulty in discovering deep vulnerabilities, which poses a threat to system security. Summary of the Invention

[0006] The main objective of this application is to propose a vulnerability monitoring method for power monitoring systems based on dynamic command flow analysis. This method aims to achieve a structural leap from static detection to dynamic detection, comprehensively monitor the security status of the system under real load, and improve the detection coverage and vulnerability discovery depth of vulnerability monitoring.

[0007] To achieve the above objectives, one aspect of this application proposes a vulnerability monitoring method for power monitoring systems based on dynamic command flow analysis, the method comprising the following steps: The underlying instruction stream during the operation of the power monitoring system is obtained through a piling mechanism. The underlying instruction stream includes multiple instruction units, each of which includes an instruction opcode, an instruction read register, an instruction write register, an instruction access address, and an instruction execution timestamp. The underlying instruction stream is time-sequentially sorted according to the instruction execution timestamp to obtain a directed timing graph containing instruction dependencies; Instruction behavior features are extracted based on the directed timing graph to obtain the instruction behavior vector; Based on the instruction behavior vectors of the power monitoring system under safe operating conditions, instruction behavior modeling is performed to obtain a normal behavior baseline model; Based on the normal behavior benchmark model, abnormal command detection and vulnerability identification are performed on the currently collected command behavior vector to obtain vulnerability identification results; Based on the vulnerability identification results, risk classification is performed to obtain the risk level.

[0008] In some embodiments, prior to the step of sorting the underlying instruction stream according to the instruction execution timestamp to obtain a directed timing graph containing instruction dependencies, the method further includes the following steps: The underlying instruction stream is segmented according to a preset window length to obtain several sliding window segments.

[0009] In some embodiments, the step of sequentially sorting the underlying instruction stream according to the instruction execution timestamp to obtain a directed timing graph containing instruction dependencies includes the following steps: The instruction units are sorted in ascending order according to the execution timestamps of the instructions to obtain an ordered instruction sequence; If in the ordered instruction sequence there exists an instruction unit that is executed earlier and directly triggers the instruction unit that is executed later, then a directed edge is obtained from the instruction unit executed earlier to the instruction unit executed later. Using each instruction unit as a node, instruction dependencies are established based on the directed edges to obtain a directed timing graph.

[0010] In some embodiments, the step of extracting instruction behavior features based on the directed timing graph to obtain an instruction behavior vector includes the following steps: Each instruction opcode is treated as a behavior state, and the number of transitions of the behavior state is counted based on the instruction dependency relationship of the directed timing graph to obtain the state transition probability matrix. Perform probability statistics on each instruction opcode within the sliding window segment to obtain the probability distribution of each instruction opcode. The average entropy is calculated based on the state transition probability matrix to obtain the behavioral complexity. Based on all the probability distributions and the behavioral complexity, the instruction behavior vector is obtained.

[0011] In some embodiments, the step of modeling instruction behavior based on the instruction behavior vector of the power monitoring system under safe operating conditions to obtain a normal behavior baseline model includes the following steps: The average behavior feature vector is obtained by calculating the mean of the instruction behavior vector of the power monitoring system under safe operation. The covariance matrix is ​​obtained by calculating the covariance of the instruction behavior vector of the power monitoring system under safe operating conditions. Based on the average behavioral feature vector and the covariance matrix, a normal behavior baseline model is obtained.

[0012] In some embodiments, the step of performing abnormal instruction detection and vulnerability identification on the currently collected instruction behavior vector based on the normal behavior benchmark model to obtain vulnerability identification results includes the following steps: The anomaly index is obtained by calculating Mahalanobis distance based on the currently collected command behavior vector and the normal behavior benchmark model. Anomalies are detected based on the anomaly index and the preset anomaly determination threshold. If the anomaly index is greater than the preset anomaly determination threshold, the sliding window segment containing the instruction behavior vector is determined to be an anomaly window. The target type statistics of the instruction opcodes in the abnormal window are performed to obtain the first instruction count, the second instruction count, and the third instruction count, wherein the first instruction count is the number of instructions involving memory read and write by the instruction opcode, the second instruction count is the number of instructions involving jump by the instruction opcode, and the third instruction count is the total number of instruction opcodes; The risk weight value is obtained by weighting the first number of instructions, the second number of instructions, and the third number of instructions. Vulnerability identification is performed based on the risk weight value and the preset risk threshold. If the risk weight value is greater than the preset risk threshold, the vulnerability identification result is determined to be that a vulnerability exists.

[0013] In some embodiments, the method further includes the following steps: After the power monitoring system has been running periodically, the parameters of the normal behavior benchmark model are updated based on the historical detection results of the preset detection period.

[0014] To achieve the above objectives, another aspect of this application proposes a vulnerability monitoring system for power monitoring systems based on dynamic command flow analysis, the system comprising: The first module is used to obtain the underlying instruction stream during the operation of the power monitoring system through a piling mechanism. The underlying instruction stream includes multiple instruction units, and each instruction unit includes an instruction opcode, an instruction read register, an instruction write register, an instruction access address, and an instruction execution timestamp. The second module is used to perform time-series sorting of the underlying instruction stream according to the instruction execution timestamp to obtain a directed timing graph containing instruction dependencies. The third module is used to extract instruction behavior features based on the directed timing graph to obtain instruction behavior vectors; The fourth module is used to model the command behavior based on the command behavior vector of the power monitoring system under safe operating conditions, and obtain the normal behavior benchmark model. The fifth module is used to perform abnormal instruction detection and vulnerability identification on the currently collected instruction behavior vector based on the normal behavior benchmark model, and obtain the vulnerability identification result; The sixth module is used to classify risks based on the vulnerability identification results to obtain a risk level.

[0015] To achieve the above objectives, another aspect of this application provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-described method.

[0016] To achieve the above objectives, another aspect of the embodiments of this application proposes a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0017] To achieve the above objectives, another aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0018] The embodiments of this application include at least the following beneficial effects: This application provides a vulnerability monitoring method for power monitoring systems based on dynamic instruction flow analysis. This method acquires the underlying instruction flow during the operation of the power monitoring system. The underlying instruction flow includes multiple instruction units, each including an instruction opcode, an instruction read register, an instruction write register, an instruction access address, and an instruction execution timestamp. The underlying instruction flow is then sequentially sorted according to the instruction execution timestamps to obtain a directed time-series graph containing instruction dependencies. Instruction behavior features are extracted from the directed time-series graph to obtain instruction behavior vectors. Instruction behavior is modeled based on the instruction behavior vectors of the power monitoring system under safe operating conditions to obtain a normal behavior baseline model. Abnormal instruction detection and vulnerability identification are performed on the currently acquired instruction behavior vectors based on the normal behavior baseline model to obtain vulnerability identification results. Risk is then classified based on the vulnerability identification results to obtain a risk level. This application enables a structural leap from static detection to dynamic detection, comprehensively monitoring the security status of the system under real load, and improving the detection coverage and vulnerability discovery depth of vulnerability monitoring. Attached Figure Description

[0019] Figure 1 This is a flowchart of a vulnerability monitoring method for power monitoring systems based on dynamic command flow analysis provided in an embodiment of this application; Figure 2 This is a flowchart of a vulnerability monitoring method for power monitoring systems based on dynamic command flow analysis, provided in another embodiment of this application. Figure 3 This is a schematic diagram of the structure of a power monitoring system vulnerability monitoring system based on dynamic command flow analysis provided in an embodiment of this application; Figure 4 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit it. In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those of this application; they are merely examples of systems and methods consistent with some aspects of the embodiments of this application as detailed in the appended claims.

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0022] Before providing a detailed description of the embodiments of this application, some of the nouns and terms involved in the embodiments of this application will be explained first. The nouns and terms involved in the embodiments of this application are subject to the following interpretations.

[0023] (1) Vulnerability Detection: Vulnerability detection is a technical method used to systematically identify network or system security vulnerabilities. Its core objective is to optimize security protection measures by quantitatively analyzing potential threats. Mainstream methodologies can be divided into two categories: Quantitative assessment: risk matrix is ​​constructed based on attack path probability calculation, which is suitable for critical systems; Qualitative assessment: expert scoring is conducted using the Delphi method, which is mostly used for security audits of government systems.

[0024] (2) Instrumentation mechanism: Instrumentation is a technique used for code analysis and debugging. It involves inserting specific instructions or function calls into the code of a target program to collect data during program execution.

[0025] In related technologies, static analysis typically relies solely on source code or configuration files, failing to cover instruction call chains, memory access patterns, and abnormal data flows that occur during system operation. Power monitoring systems are characterized by high real-time performance, strong concurrency, and multi-task scheduling, resulting in drastically changing instruction flows. Static analysis structures struggle to fully reflect these dynamic characteristics. While existing vulnerability detection methods for power monitoring systems can identify known security issues to some extent, they still suffer from numerous limitations and technical shortcomings, primarily manifested in insufficient detection depth, poor real-time performance, weak adaptability, and low levels of intelligence.

[0026] First, the granularity of detection is too static and superficial. Related technologies largely rely on static code analysis or rule-based vulnerability scanning, which cannot truly reflect the dynamic behavior of a system during operation. For example, a power monitoring system continuously generates new instruction streams, task scheduling, and external communications during execution, and the security vulnerabilities arising from these runtime events are often not directly reflected in the source code. Static methods can only detect errors at the syntax or configuration level, but struggle to identify potential vulnerabilities caused by changes in runtime state, instruction interaction logic, or concurrency conflicts.

[0027] Secondly, existing detection methods lack the ability to model dynamic command flows. The operation of power monitoring systems involves a large number of low-level command flows, and the dependencies between these commands are complex and time-sequential. Traditional analysis methods cannot dynamically track these command sequences, nor can they build complete behavioral models to identify abnormal command chains or suspicious operation paths, resulting in one-sided detection results and limited coverage.

[0028] Third, there is a lack of automated and intelligent analysis mechanisms. Most existing systems still rely on manually defined vulnerability signature databases for comparison, making detection effectiveness highly dependent on the completeness of the rules and human experience. When unknown attack methods or new vulnerability patterns emerge, the system often fails to identify them automatically. At the same time, the rule database is costly to maintain, updates are slow, and it is difficult to adapt to the complex and constantly evolving operating environment of power monitoring systems.

[0029] In terms of technical implementation, the difficulties in overcoming the above-mentioned defects mainly lie in the following three aspects: First, how to achieve dynamic capture and real-time analysis of instruction streams during system operation to ensure the accuracy and timeliness of detection; second, how to effectively model massive instruction data and extract behavioral features that can be used for vulnerability identification without affecting system performance; and third, how to design intelligent algorithms to enable the system to automatically identify abnormal instruction patterns and locate vulnerabilities, thereby reducing manual intervention.

[0030] Overall, the core bottleneck of the relevant technologies lies in the lack of a systematic approach that can integrate dynamic behavior analysis and automated vulnerability discovery mechanisms, making it impossible to achieve accurate and real-time identification of vulnerabilities in power monitoring systems without affecting system stability.

[0031] In view of this, this application provides a vulnerability monitoring method for power monitoring systems based on dynamic command flow analysis. This scheme has made fundamental improvements in its overall structure and core technology path. With dynamic command flow analysis as its core, it establishes a comprehensive analysis system capable of real-time monitoring, modeling, and automatic vulnerability identification. It upgrades from a static scanning structure to a dynamic behavior analysis structure, introducing innovative modules such as real-time command flow capture, dynamic modeling, and intelligent detection, achieving automatic, accurate, and sustainable discovery of vulnerabilities in power monitoring systems. This structural innovation not only broadens the depth of analysis but also significantly improves the real-time performance and intelligence level of detection.

[0032] The vulnerability monitoring method for power monitoring systems based on dynamic command flow analysis provided in this application relates to the field of information security technology. This method can be applied to terminals, servers, or software running on either terminal or server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, or vehicle terminal, but is not limited to these. The server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network. The software can be an application implementing the vulnerability monitoring method for power monitoring systems based on dynamic command flow analysis, but is not limited to the above forms.

[0033] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0034] Figure 1 This is an optional flowchart of the vulnerability monitoring method for power monitoring systems based on dynamic command flow analysis provided in this application embodiment. Figure 1 The method may include, but is not limited to, steps S101 to S106.

[0035] Step S101: Obtain the underlying instruction stream during the operation of the power monitoring system through a piling mechanism. The underlying instruction stream includes multiple instruction units, each of which includes an instruction opcode, an instruction read register, an instruction write register, an instruction access address, and an instruction execution timestamp.

[0036] Step S102: Sort the underlying instruction stream according to the instruction execution timestamp to obtain a directed timing graph containing instruction dependencies.

[0037] Step S103: Extract instruction behavior features based on the directed timing graph to obtain instruction behavior vector.

[0038] Step S104: Model the command behavior based on the command behavior vector of the power monitoring system under safe operation state to obtain the normal behavior baseline model.

[0039] Step S105: Based on the normal behavior benchmark model, perform abnormal instruction detection and vulnerability identification on the currently collected instruction behavior vector to obtain vulnerability identification results.

[0040] Step S106: Based on the vulnerability identification results, risk classification is performed to obtain the risk level.

[0041] In this embodiment, the core principle of the power monitoring system vulnerability monitoring method based on dynamic command flow analysis is to capture the underlying command flow in real time during system operation, establish command behavior vectors and calculate the degree of difference between them and the standard safe normal behavior benchmark model, so as to realize the automatic identification of potential vulnerability behaviors.

[0042] Specifically, at the data source level, unlike the three-step process of "code scanning—feature matching—result reporting" in related technologies, where the analysis object is limited to source code or configuration files, resulting in an inability to truly reflect the dynamic behavior of the system during runtime, this embodiment uses an instrumentation mechanism to capture the underlying instruction flow at runtime. This allows for direct acquisition of underlying instruction sequences and status information from the execution environment of the power monitoring system, rather than relying solely on static code. Real-time data collection is performed on the instruction execution path, memory access behavior, system call chain, and communication interactions during the actual operation of the system.

[0043] Instrumentation technology can assist in analyzing code coverage, hot code snippets, and even discovering security vulnerabilities such as memory leaks. It is a very effective auxiliary method. By capturing the underlying instruction flow through the instrumentation mechanism, a richer and more timely security data foundation can be obtained.

[0044] For example, a monitoring probe is set at the CPU execution layer in the system operating environment using an instrumentation mechanism to capture the low-level instruction stream generated by the power monitoring system process during operation. The capture module records information such as the opcode, operand, memory address, call level, and timestamp of each instruction in real time. The captured raw instruction stream is denoted as... Each instruction unit s i Defined as a quintuple: si =( op i , rd i , wr i , addr i , t i ).

[0045] in, op i Indicates the instruction opcode. rd i This represents the set of registers to be read by the instruction. wr i This represents the set of registers to which the instruction is written. addr i Indicates the address accessed by the instruction. t i Indicates the instruction execution timestamp.

[0046] The instruction opcode is a field in a computer instruction used to represent the nature and function of an operation. The opcode identifies the instruction function through binary encoding, such as arithmetic operations (ADD / SUB), logical operations (AND / XOR), data transfer (LOAD / STORE), and control flow (JUMP / CALL).

[0047] The register set for instruction reads is used to record the registers that the instruction opcode needs to read. For example, for the instruction ADD R1,R2, the values ​​of registers R1 and R2 need to be read.

[0048] The set of registers written to by the instruction is used to record the registers written after the instruction is executed. For ADD R1,R2, the purpose is to add the value of R2 to R1, so the result will be written to register R1.

[0049] The instruction access address is used to record the memory address involved in the instruction operation, and can be dynamically calculated by adding an offset to the base address register.

[0050] Instruction execution timestamps are used to record the time node when an instruction is executed, so as to analyze timing relationships.

[0051] Next, the instruction units in all instruction streams are sorted according to the instruction execution timestamps, and a directed timing graph is constructed. G =( V , E In a directed sequence graph, each edge has a start node and an end node, indicating a direction from one node to another. The direction of the edge indicates the relationship between the nodes.

[0052] Secondly, in terms of the analysis architecture, a dynamic instruction flow modeling module and an abnormal behavior detection engine were introduced. This structure utilizes dynamic analysis algorithms and behavior pattern recognition technology to model the collected instruction sequences, extract key feature parameters (such as timing dependencies, control jump patterns, call frequency distribution, etc.), and automatically determine vulnerabilities by comparing the differences between the normal behavior benchmark model and the actual behavior of the power monitoring system under safe operating conditions.

[0053] It should be noted that, unlike solutions that rely solely on vulnerability signature databases, this embodiment can identify unknown vulnerability types through a model self-learning mechanism, enabling early warning of zero-day vulnerabilities and potential attack paths.

[0054] Finally, at the system output and processing level, interpretable vulnerability reports can be generated by combining multi-dimensional data (including command context, system logs, device status parameters, etc.), and security level assessment and risk classification are supported.

[0055] In some embodiments, the method may include, but is not limited to, step S201 before step S102.

[0056] Step S201: The underlying instruction stream is segmented according to the preset window length to obtain several sliding window segments.

[0057] In this embodiment, a sliding window mechanism is used to reduce noise and redundancy. W k Segment the instruction stream: ; in, L Window length (in terms of the number of instructions).

[0058] Each window is normalized and then converted into a feature vector. x k : ; Among them, the function f (·) represents the feature mapping operator, which converts a time-series instruction fragment into a fixed-dimensional vector for subsequent modeling.

[0059] In some embodiments, step S102 may include, but is not limited to, steps S301 to S303.

[0060] Step S301: Sort the instruction units in ascending order according to the order of instruction execution timestamps to obtain an ordered instruction sequence.

[0061] Step S302: If there exists an instruction unit in the ordered instruction sequence that is executed earlier and directly triggers the instruction unit to be executed later, then a directed edge is obtained from the instruction unit executed earlier to the instruction unit to be executed later.

[0062] Step S303: Using each instruction unit as a node, establish instruction dependencies based on directed edges to obtain a directed timing graph.

[0063] In this embodiment, the instruction units in the underlying instruction stream are sorted in ascending order of instruction execution timestamps, thereby reorganizing the discrete instruction units to uncover the instruction dependencies between them. This transforms the linear time series into a graph structure. During the sorting process, instruction units with earlier execution times are located at the beginning of the sequence, and instruction units with later execution times are located at the end of the sequence, ensuring that the instruction execution timestamp of the earlier instruction unit is not later than that of the later instruction unit.

[0064] After obtaining the ordered instruction sequence, a directed edge is generated for each instruction unit based on the direct triggering relationship between them. A direct triggering relationship means that the instruction unit executed first is a necessary condition for the subsequent instruction unit to be triggered. For example, consider instruction unit A and instruction unit B. If the operation object of instruction unit B is the execution result of instruction unit A, then to execute instruction unit B, instruction unit A must first be executed. Therefore, a directed edge needs to be established between instruction unit A and instruction unit B, with the directed edge starting from the first executed instruction unit A and ending at the second executed instruction unit B.

[0065] In practice, directed sequence graphs have various instruction dependencies, including but not limited to linear dependencies, branch dependencies, convergence dependencies, and circular dependencies.

[0066] For example, a linear dependency indicates that instruction units are executed sequentially, such as instructions... s 2 Dependency Instructions s 1. Read register data, then use instructions s 3. Calculations are performed, and the dependency relationship of the instructions is as follows: s 1→ s 2→ s 3.

[0067] Branch dependency indicates that an instruction unit has multiple execution paths, for example, based on the instruction... s The result of executing step 1 determines which instruction will be executed next. s 2 or instruction s 3. The dependency relationship of the instructions is as follows: s 1→ s 2, s 1→ s 3.

[0068] Using each instruction unit as a node, and based on the instruction dependencies reflected by the directed edges, a directed sequence graph is constructed that can intuitively represent the instruction execution flow and path.

[0069] In some embodiments, step S103 may include, but is not limited to, steps S401 to S404.

[0070] Step S401: Treat each instruction opcode as a behavior state, and count the number of transitions of the behavior state based on the instruction dependency relationship of the directed timing graph to obtain the state transition probability matrix.

[0071] Step S402: Perform probability statistics on each instruction opcode within the sliding window segment to obtain the probability distribution of each instruction opcode.

[0072] Step S403: Calculate the average entropy based on the state transition probability matrix to obtain the behavioral complexity.

[0073] Step S404: Based on all probability distributions and behavioral complexity, obtain the instruction behavior vector.

[0074] In this embodiment, after dynamic instruction stream acquisition and processing are completed, probabilistic state transition modeling and behavioral feature vector extraction are performed. The core of this step is to transform the time-series instruction stream into a structured feature matrix with statistical comparability.

[0075] Specifically, the first step is to define the state space, assuming the set of possible opcodes in the system is as follows: .

[0076] Each instruction opcode op i This represents the behavioral state of a system. A state transition probability matrix is ​​constructed based on instruction dependencies. P Its definition is: ; in, This indicates that in the actual execution sequence, from state... op i Transfer to op j The number of transfers; P ij Indicates from state i to state j The transition probability; Let be the state transition matrix.

[0077] Next, instruction behavior features are extracted for each sliding window segment. Wk Extract its feature vector x k The method is as follows: Calculate the probability distribution of each instruction opcode appearing within the calculation window: ; in, Display window W k Chinese instruction type op i The number of times it appears.

[0078] At the same time, calculate the average entropy value of the state transition. H （k） As an indicator of behavioral complexity: ; The higher the entropy value, the stronger the randomness of the instruction flow, indicating higher behavioral complexity.

[0079] Finally, based on the probability distribution and behavioral complexity of all instruction opcodes, an instruction behavior vector is formed: .

[0080] vector As a window W k The high-dimensional behavioral representation can be used for subsequent anomaly detection and model training.

[0081] In some embodiments, step S104 may include, but is not limited to, steps S501 to S503.

[0082] Step S501: Calculate the mean value of the instruction behavior vector of the power monitoring system under safe operation state to obtain the average behavior feature vector.

[0083] Step S502: Calculate the covariance based on the command behavior vector of the power monitoring system under safe operating conditions to obtain the covariance matrix.

[0084] Step S503: Based on the average behavioral feature vector and covariance matrix, obtain the normal behavior baseline model.

[0085] In this embodiment, a safe operating state indicates that the command behavior of the power monitoring system conforms to the preset security policy or normal business logic, all system performance indicators are normal, and no abnormal behavior, such as malicious attacks or vulnerability exploitation, is detected. By collecting a large number of sample segments under the safe operating state, a statistical benchmark model of normal behavior is established.

[0086] Specifically, under the safe operation state of the power monitoring system, multiple valid windows are collected. Each window has a corresponding command behavior vector, which includes features in multiple dimensions. The mean of each feature dimension is calculated independently, and the average behavior feature vector corresponding to the command behavior vectors of all windows is calculated. m : .

[0087] For example, assuming that instruction behavior vectors of three windows are collected, where the occurrence frequencies of the MOV instruction opcode are 0.186, 0.175, and 0.191 respectively, then the occurrence frequency of MOV in the average behavior feature vector is 0.184.

[0088] Each element of the covariance matrix is ​​the variance and covariance among the vector elements. Variance measures the dispersion of a single random variable, while covariance typically characterizes the similarity between two random variables. Variance forms the diagonal elements, and covariance forms the off-diagonal elements. The formula for calculating the covariance matrix is: .

[0089] Finally, the calculated average behavioral feature vector and covariance matrix are combined to form a normal behavior baseline model. M 0 = ( m ∑), which is used to calculate the anomaly degree and vulnerability probability in subsequent steps.

[0090] In some embodiments, step S105 may include, but is not limited to, steps S601 to S605.

[0091] Step S601: Calculate the Mahalanobis distance based on the currently collected command behavior vector and the normal behavior benchmark model to obtain the anomaly index.

[0092] Step S602: Detect abnormal instructions based on the abnormality index and the preset abnormality judgment threshold. If the abnormality index is greater than the preset abnormality judgment threshold, determine that the sliding window segment where the instruction behavior vector is located is an abnormal window.

[0093] Step S603: Statistical analysis of the target type of the instruction opcodes in the exception window to obtain the first instruction count, the second instruction count, and the third instruction count. The first instruction count is the number of instructions involving memory read / write operations, the second instruction count is the number of instructions involving jumps, and the third instruction count is the total number of instruction opcodes.

[0094] Step S604: Calculate the risk weight value based on the first instruction count, the second instruction count, and the third instruction count.

[0095] Step S605: Vulnerability identification is performed based on the risk weight value and the preset risk threshold. If the risk weight value is greater than the preset risk threshold, the vulnerability identification result is determined to be that a vulnerability exists.

[0096] In this embodiment, the normal behavior benchmark model established in the previous stage is used. M 0 = ( m The system performs anomaly detection on the real-time collected command behavior vectors. By calculating the statistical distance between the vectors and the baseline model and combining it with a threshold detection function, it achieves automated vulnerability identification and classification.

[0097] Specifically, for the real-time data collection of the first... k A fragment of instructions, whose feature vector is: x k In this embodiment, Mahalanobis distance is used as an anomaly metric to assess the degree to which it deviates from the normal model. It is defined as follows: ; in, m The mean vector of normal behavior; ∑ -1 It is the inverse of the covariance matrix; D k An anomaly index, representing a fragment of instructions. W k The degree of abnormality.

[0098] Mahalanobis distance can simultaneously consider the covariance relationship between features, avoiding the impact of inconsistent feature scales across different dimensions, and is suitable for anomaly detection in multidimensional dynamic behavioral data.

[0099] Next, the system determines the anomaly detection threshold based on the distance distribution of normal samples during the training phase. d .

[0100] For example, suppose that on a normal sample set, the mean distance is The standard deviation is The threshold is defined as: ; in, α is the confidence coefficient, with a value range of [2,4].

[0101] Preferably, in the security monitoring environment of a power monitoring system, the recommended value is... α =3.

[0102] when D k Greater than dWhen the current window fragment is determined to be an abnormal window and the corresponding instruction stream is an abnormal sequence, the process proceeds to the next stage of vulnerability classification. The abnormality determination function is defined as follows: ; in, ( x k )=1 indicates that an anomaly was detected. ( x k A value of 0 indicates normal behavior.

[0103] Furthermore, if the instruction flow is determined to be abnormal, the vulnerability risk weight is calculated based on the type and scope of the abnormality characteristics.

[0104] Define vulnerability risk weights R k for: ; in, The first instruction number indicates the number of memory read / write instructions involved in the opcodes within the window; For the second instruction number, Indicates the number of instructions involved in the jump related to the instruction opcode; The third instruction number represents the total number of instruction opcodes; H （k） This is the window entropy value; H max The maximum entropy value observed in the training set; β 1. β 2. β 3 is the risk weighting coefficient, which satisfies... β 1+ β 2+ β 3 = 1.

[0105] Ultimately, when the risk weight exceeds the set risk threshold... R th When the instruction fragment is deemed to have a potential vulnerability, the determination rule is as follows: ; in, ψ ( x k A value of 1 indicates that the instruction stream corresponding to this window is vulnerable. ψ ( x k =0 indicates that the window has no vulnerability risk.

[0106] In some embodiments, the identified anomalies and vulnerabilities may also be quantitatively assessed and risk-classified to generate an interpretable security report, providing a basis for vulnerability remediation and protection strategies for power monitoring systems.

[0107] Specifically, by calculating the risk weight R k Combined with vulnerability influencing factors, a comprehensive risk index Γ is obtained. k It can automatically classify and output reports based on preset interval thresholds.

[0108] For windows that were detected as having vulnerabilities W k The comprehensive risk index is defined as follows: ; in, D max The maximum anomaly distance in the sample set during the training phase; I k Imax is the vulnerability impact range indicator, defined as the proportion of system resources involved by the abnormal instruction within this window; Imax is the maximum proportion of resources that can be affected (normalized constant). l 1. l 2. l 3 is the risk weighting coefficient, which satisfies... l 1+ l 2+ l 3 = 1.

[0109] The above comprehensive risk index Γ k The value ranges from [0,1], with higher values ​​indicating a more severe vulnerability risk.

[0110] The system automatically classifies risks based on the range of values ​​for the comprehensive risk index, as defined below: ; Optionally, different levels of vulnerability can be identified on the monitoring interface using different color codes and weight labels to facilitate rapid response by operations and maintenance personnel.

[0111] The system will eventually automatically generate a vulnerability report, which includes the following fields: Command Window Number k Anomaly D k Risk weight R k Comprehensive risk index Γ k Risk level L k A list of affected resources and suggested remediation strategies.

[0112] The report file is output in a structured format (JSON or XML) and written to a secure database via an internal interface.

[0113] Meanwhile, the system retains time-series logs ( t k , Γ k This is used for trend monitoring and periodic retraining to achieve long-term self-learning and dynamic protection.

[0114] In some embodiments, the method may also include, but is not limited to, step S701.

[0115] Step S701: After the power monitoring system has been running periodically, the parameters of the normal behavior benchmark model are updated based on the historical detection results of the preset detection cycle.

[0116] In this embodiment, the detection period is set to T. At the end of the period, the average behavior vector and covariance are recalculated. ; or ∈(0,1) is the learning rate; and These are the sample mean and covariance observed within the new period, respectively.

[0117] This mechanism enables adaptive updates to the model, ensuring that the detection algorithm can continuously adapt to changes in the operating environment of the power monitoring system, thereby maintaining high-precision vulnerability detection performance.

[0118] The following is a detailed description and explanation of the solutions in the embodiments of the present invention, using specific application examples: Reference Figure 2 , Figure 2 This is an optional flowchart of a power monitoring system vulnerability monitoring method based on dynamic command flow analysis provided in another embodiment of this application.

[0119] Power monitoring systems process a large number of low-level command streams during operation. These command streams are directly related to equipment control, data acquisition, and communication interaction. Due to the complexity of the system and the involvement of multiple communication protocols and external interfaces, potential security vulnerabilities can easily arise.

[0120] In this embodiment, the system intercepts the execution instruction stream sequence of the target power monitoring software through a kernel-level monitoring module. Each instruction unit represents a CPU execution operation. The system constructs a dynamic control flow graph (DCFG) based on time sequence and dependencies, and maps instruction feature parameters to a high-dimensional behavior space. Subsequently, through three stages—feature extraction, anomaly calculation, and risk assessment—vulnerability identification is performed on command flow behavior. This allows for the automatic identification of potential security vulnerabilities and system weaknesses during the software and command execution process of the power monitoring system, thereby improving the security protection capabilities and reliability of the power monitoring system.

[0121] It should be noted that by using "dynamic instruction flow" instead of user behavior logs or attack chain events, compared to related technologies that use attack chain fields such as input event field dependencies, timestamps, and hop counts, or input "time features" of user access / operation behavior, the instruction flow-level quintuple captured by CPU-layer instrumentation in this embodiment belongs to a lower-level machine instruction granularity. Instruction sequence features can be extracted based on the dynamic instruction flow to construct a higher-dimensional behavioral feature vector (opcode frequency, window entropy, jump probability, etc.), and anomaly degree is calculated based on the Mahalanobis distance between instruction features and behavioral baseline models. Compared to using path sequence similarity and anomaly path scoring with HMM + DTW + isolated forest, this method can better describe the system's operating state.

[0122] Specifically, in the dynamic instruction stream acquisition and preprocessing stage, the runtime instruction stream is captured through an instrumentation mechanism, and information such as opcodes, registers, addresses and timestamps is extracted to construct a directed timing graph of the dynamic control flow.

[0123] For example, by instrumenting the CPU layer of the main station, the instructions executed cyclically by the main controller during the operation of the monitoring system are captured in real time, obtaining approximately 50,000 instruction fragments. The collected content includes instruction opcodes, instruction addresses, register read / write information, and jump instruction target addresses, etc.

[0124] Next, in the instruction behavior modeling and feature extraction stage, a probabilistic model is established based on the instruction state transition relationship, and instruction frequency, state entropy and feature vector are extracted to form a normal behavior benchmark model.

[0125] For example, the instruction stream collected continuously for one week under normal operating conditions is divided into windows (window length 50), and the operation code statistical distribution, average branch probability, and window entropy value of each window are extracted. Finally, a normal behavior benchmark model is formed by using the covariance matrix and the mean vector.

[0126] Subsequently, in the abnormal instruction detection and vulnerability identification stage, the Mahalanobis distance is calculated to determine the anomaly degree, and the potential vulnerabilities are identified and their risk values ​​are determined by combining the risk weight and the decision function.

[0127] For example, during a certain actual scheduling instruction issuance process, a module of the system experienced periodic delays. This invention calculated that the Mahalanobis distance anomaly of this window increased to 3.8 (baseline mean 1.2), significantly higher than the threshold of 2.5, thus classifying it as an abnormal sequence. Risk weights were calculated based on the ratio of read / write instructions, the number of jump instructions, and the window entropy value within this window. If characteristics such as a concentration of jump instructions or a sudden increase in entropy were found, then vulnerability risk weights were calculated.

[0128] Finally, in the risk classification and report generation stage, a comprehensive risk index is calculated, and risk levels are automatically classified, thereby outputting a structured security report and updating model parameters.

[0129] Therefore, the core function of the vulnerability monitoring method provided in this application is to discover vulnerabilities that are difficult to identify by static detection methods by analyzing the dynamic behavior of the system during runtime. The detection method based on dynamic instruction flow analysis can monitor and model the instruction execution sequence in the real operating environment of the system, thereby identifying abnormal instruction behavior and potential attack paths.

[0130] In terms of the detection process, the embodiments of this application form a closed-loop structure of "dynamic data acquisition—behavioral modeling—anomaly detection—vulnerability localization—result feedback". This process not only has automated features, but also can continuously monitor and evaluate the security status without interfering with the normal operation of the system, achieving true online vulnerability discovery.

[0131] By dynamically monitoring and analyzing changes in the command flow of a power monitoring system during operation, automatic identification and early warning of system vulnerabilities can be achieved, providing a technical basis for subsequent vulnerability remediation, security hardening, and system protection strategies. This method not only improves the comprehensiveness and accuracy of vulnerability discovery but also significantly reduces the workload and error rate of manual detection.

[0132] In summary, compared with power monitoring system vulnerability detection methods based on static analysis or rule matching, the embodiments of this application have achieved significant breakthroughs in terms of detection accuracy, real-time performance, automation level, and intelligence level, and have the following technical advantages and effects: First, it achieves a structural leap from static detection to dynamic detection. By capturing dynamic instruction flows at the system execution layer and constructing runtime control flow graphs and behavioral feature models, it is possible to comprehensively monitor the security status of the system under real loads, fundamentally improving detection coverage and vulnerability discovery depth.

[0133] Secondly, it possesses high-precision anomaly detection capabilities. By introducing a statistical anomaly measurement method based on Mahalanobis distance, it can accurately calculate the degree to which instruction flow behavior deviates from the normal model, thereby effectively identifying hidden vulnerabilities that are difficult to detect using traditional methods, such as instruction races, illegal jumps, and concurrent access anomalies. Combined with a risk weighting function and a comprehensive risk index assessment mechanism, the system can quantitatively determine the severity of vulnerabilities, achieving refined security assessment.

[0134] Third, it possesses real-time detection and online learning capabilities. By introducing a sliding window mechanism and a periodic model update algorithm, it can continuously collect data and assess risks during system operation without interrupting the power monitoring system. This is achieved through adaptive learning rate parameters. or With the introduction of this feature, the model can automatically adjust the mean and covariance parameters as the operating environment changes, achieving self-evolution and dynamic adaptation.

[0135] Fourth, it significantly reduces human intervention and reliance on rules. Vulnerability detection heavily relies on manually written rule bases, which are costly to maintain and slow to update. The embodiments of this application, through statistical learning and behavioral modeling methods, no longer rely on manual vulnerability features, but instead use dynamic instruction data to self-construct detection models, achieving automatic vulnerability discovery and risk classification, and greatly reducing human input.

[0136] Fifth, it possesses high interpretability and engineering usability. The results output by the embodiments of this application not only include the risk level, but also provide the corresponding abnormal command segments, a list of affected resources, and remediation suggestions. The generated report is highly structured and quantitative, facilitating integration into the power safety management system and achieving seamless interoperability with existing protection platforms.

[0137] Finally, the vulnerability monitoring method for power monitoring systems based on dynamic command flow analysis provided in this application significantly improves detection accuracy, real-time response, system adaptability, and result interpretability by introducing a dynamic command flow capture mechanism, probabilistic behavior modeling algorithm, and multi-layer risk assessment system. It can significantly improve the overall security protection level and operational reliability of power monitoring systems and has broad engineering application prospects and industrial promotion value.

[0138] Reference Figure 3 This application also provides a vulnerability monitoring system for power monitoring systems based on dynamic command flow analysis, which can implement the above-mentioned method. The system includes: The first module is used to obtain the underlying instruction stream during the operation of the power monitoring system through a piling mechanism. The underlying instruction stream includes multiple instruction units, each of which includes an instruction opcode, an instruction read register, an instruction write register, an instruction access address, and an instruction execution timestamp.

[0139] The second module is used to sort the underlying instruction stream according to the instruction execution timestamp to obtain a directed timing graph containing instruction dependencies.

[0140] The third module is used to extract instruction behavior features based on the directed timing graph to obtain instruction behavior vectors.

[0141] The fourth module is used to model the command behavior based on the command behavior vector of the power monitoring system under safe operating conditions, and obtain the normal behavior baseline model.

[0142] The fifth module is used to perform abnormal instruction detection and vulnerability identification on the currently collected instruction behavior vector based on the normal behavior benchmark model, and obtain the vulnerability identification results.

[0143] The sixth module is used to classify risks based on the vulnerability identification results to obtain the risk level.

[0144] It is understood that the content of the above method embodiments is applicable to this system embodiment. The specific functions implemented in this system embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0145] This application also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-described method. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0146] It is understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0147] Reference Figure 4 , Figure 4 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes: The processor 901 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application.

[0148] The memory 902 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 902 can store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 902 and is called and executed by the processor 901 using the methods described in the embodiments of this application.

[0149] The input / output interface 903 is used to implement information input and output.

[0150] The communication interface 904 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0151] Bus 905 transmits information between various components of the device, such as processor 901, memory 902, input / output interface 903, and communication interface 904.

[0152] The processor 901, memory 902, input / output interface 903, and communication interface 904 are connected to each other within the device via bus 905.

[0153] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0154] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0155] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0156] It is understood that the content of the above method embodiments is applicable to the embodiments of this program product. The specific functions implemented by the embodiments of this program product are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0157] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0158] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0159] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0160] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0161] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0162] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0163] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0164] In the embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between systems or units may be electrical, mechanical, or other forms.

[0165] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0166] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0167] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0168] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A vulnerability monitoring method for power monitoring systems based on dynamic command flow analysis, characterized in that, The method includes the following steps: The underlying instruction stream during the operation of the power monitoring system is obtained through a piling mechanism. The underlying instruction stream includes multiple instruction units, each of which includes an instruction opcode, an instruction read register, an instruction write register, an instruction access address, and an instruction execution timestamp. The underlying instruction stream is time-sequentially sorted according to the instruction execution timestamp to obtain a directed timing graph containing instruction dependencies; Instruction behavior features are extracted based on the directed timing graph to obtain the instruction behavior vector; Based on the instruction behavior vectors of the power monitoring system under safe operating conditions, instruction behavior modeling is performed to obtain a normal behavior baseline model; Based on the normal behavior benchmark model, abnormal command detection and vulnerability identification are performed on the currently collected command behavior vector to obtain vulnerability identification results; Based on the vulnerability identification results, risk classification is performed to obtain the risk level.

2. The method according to claim 1, characterized in that, Before the step of sorting the underlying instruction stream according to the instruction execution timestamp to obtain a directed timing graph containing instruction dependencies, the method further includes the following steps: The underlying instruction stream is segmented according to a preset window length to obtain several sliding window segments.

3. The method according to claim 1, characterized in that, The step of sorting the underlying instruction stream according to the instruction execution timestamp to obtain a directed timing graph containing instruction dependencies includes the following steps: The instruction units are sorted in ascending order according to the execution timestamps of the instructions to obtain an ordered instruction sequence; If in the ordered instruction sequence there exists an instruction unit that is executed earlier and directly triggers the instruction unit that is executed later, then a directed edge is obtained from the instruction unit executed earlier to the instruction unit executed later. Using each instruction unit as a node, instruction dependencies are established based on the directed edges to obtain a directed timing graph.

4. The method according to claim 2, characterized in that, The step of extracting instruction behavior features from the directed time sequence graph to obtain an instruction behavior vector includes the following steps: Each instruction opcode is treated as a behavior state, and the number of transitions of the behavior state is counted based on the instruction dependency relationship of the directed timing graph to obtain the state transition probability matrix. Perform probability statistics on each instruction opcode within the sliding window segment to obtain the probability distribution of each instruction opcode. The average entropy is calculated based on the state transition probability matrix to obtain the behavioral complexity. Based on all the probability distributions and the behavioral complexity, the instruction behavior vector is obtained.

5. The method according to claim 1, characterized in that, The step of modeling command behavior based on the command behavior vector of the power monitoring system under safe operating conditions to obtain a normal behavior baseline model includes the following steps: The average behavior feature vector is obtained by calculating the mean of the instruction behavior vector of the power monitoring system under safe operation. The covariance matrix is ​​obtained by calculating the covariance of the instruction behavior vector of the power monitoring system under safe operating conditions. Based on the average behavioral feature vector and the covariance matrix, a normal behavior baseline model is obtained.

6. The method according to claim 2, characterized in that, The process of detecting abnormal commands and identifying vulnerabilities in the currently collected command behavior vectors based on the normal behavior benchmark model to obtain vulnerability identification results includes the following steps: The anomaly index is obtained by calculating Mahalanobis distance based on the currently collected command behavior vector and the normal behavior benchmark model. Anomalies are detected based on the anomaly index and the preset anomaly determination threshold. If the anomaly index is greater than the preset anomaly determination threshold, the sliding window segment containing the instruction behavior vector is determined to be an anomaly window. The target type statistics of the instruction opcodes in the abnormal window are performed to obtain the first instruction count, the second instruction count, and the third instruction count, wherein the first instruction count is the number of instructions involving memory read and write by the instruction opcode, the second instruction count is the number of instructions involving jump by the instruction opcode, and the third instruction count is the total number of instruction opcodes; The risk weight value is obtained by weighting the first number of instructions, the second number of instructions, and the third number of instructions. Vulnerability identification is performed based on the risk weight value and the preset risk threshold. If the risk weight value is greater than the preset risk threshold, the vulnerability identification result is determined to be that a vulnerability exists.

7. The method according to claim 1, characterized in that, The method further includes the following steps: After the power monitoring system has been running periodically, the parameters of the normal behavior benchmark model are updated based on the historical detection results of the preset detection period.

8. A vulnerability monitoring system for power monitoring systems based on dynamic command flow analysis, characterized in that, The system includes: The first module is used to obtain the underlying instruction stream during the operation of the power monitoring system through a piling mechanism. The underlying instruction stream includes multiple instruction units, and each instruction unit includes an instruction opcode, an instruction read register, an instruction write register, an instruction access address, and an instruction execution timestamp. The second module is used to perform time-series sorting of the underlying instruction stream according to the instruction execution timestamp to obtain a directed timing graph containing instruction dependencies. The third module is used to extract instruction behavior features based on the directed timing graph to obtain instruction behavior vectors; The fourth module is used to model the command behavior based on the command behavior vector of the power monitoring system under safe operating conditions, and obtain the normal behavior benchmark model. The fifth module is used to perform abnormal instruction detection and vulnerability identification on the currently collected instruction behavior vector based on the normal behavior benchmark model, and obtain the vulnerability identification result; The sixth module is used to classify risks based on the vulnerability identification results to obtain a risk level.

9. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 7.

Images