Power grid malicious code attack chain construction method and system based on multi-dimensional intention features

Abstract

The present application relates to the technical field of network security, in particular to a power grid malicious code attack chain construction method and system based on multi-dimensional intention characteristics. The present application extracts the industrial control operation field, context load field, timestamp field and subject identifier, and then converts them into sparse vectors, dense vectors and real number vectors, and fuses the above three vectors into a multi-dimensional intention characteristic tensor. Secondly, each multi-dimensional intention characteristic tensor is accurately given a final tactical intention label and an atomic intention node is constructed. Thirdly, the atomic intention node is divided into a session sequence by introducing a dynamic time window, and the atomic intention node is time-series aggregated according to the subject identifier consistency and the damage chain association relationship. Finally, by constructing an initial heterogeneous graph and performing logical pruning, the redundant nodes and edges unrelated to the attack evolution path are removed, and the final heterogeneous graph generated in a structured form presents the whole process of a malicious code attack completely and intuitively.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for constructing a malicious code attack chain for power grids based on multi-dimensional intent features. Background Technology

[0002] With the development of information technology and industrial control systems, power systems are gradually evolving from traditional closed control networks to a highly interconnected and information-based operating mode. During this process, the power grid has widely introduced dispatch automation systems, substation automation systems, and remote control terminals, generating a large amount of heterogeneous operational data from the host side, network side, and industrial control protocol layer. This data reflects the control behavior, communication behavior, and system interaction status of the power grid system from different perspectives during operation.

[0003] In recent years, cyberattacks targeting critical infrastructure such as power grids have increasingly exhibited multi-stage, chain-like penetration characteristics. Attackers typically employ various methods, including host-side malware execution, network communication manipulation, and abuse of industrial control protocols, to progressively advance the attack over a considerable period. Their attacks often span multiple stages, including asset reconnaissance, payload generation, control command delivery, and destructive execution, exhibiting a clear temporal dependency and causal correlation at the overall level. While such attacks may be difficult to detect individually, they can adversely affect the safe operation of the power grid. To address these attack patterns, existing technologies have proposed various security analysis methods. Some methods focus on analyzing single data sources such as host logs, network traffic, or industrial control commands, while others attempt to characterize the local relationships between behavioral entities. However, due to the cross-data source, cross-time stage, and cross-control level characteristics of attacks in the power grid environment, these methods struggle to analyze and trace complete attack behaviors, construct robust attack chains to identify potential attackers, and implement protective measures. Therefore, they still fall short of meeting practical application needs in terms of network security protection.

[0004] Specifically, on the one hand, some existing methods process behavioral data using fixed time windows or single data sources. This may divide what would otherwise be continuous attack behaviors into discrete events, thus affecting the continuous representation of the attack process over time. On the other hand, some existing methods primarily focus on the superficial relationships between events or entities, lacking the ability to characterize the tactical intent and stage semantics inherent in attack behaviors, thus facing difficulties in semantically linking cross-stage attack behaviors. Furthermore, at the level of attack analysis results, some existing technologies struggle to provide structured, traceable forms of attack evidence, thus affecting the intuitive presentation of the attack behavior's evolution and hindering power grid security maintenance personnel from conducting source tracing analysis and risk assessment of attack events. Summary of the Invention

[0005] This invention aims to provide a method and system for constructing a malicious code attack chain for power grids based on multi-dimensional intent features. It integrates multi-source heterogeneous behavioral data, maintains the temporal and causal continuity of attack behavior, and models and reconstructs the attack process with attack intent as the core. This enables the construction and interpretable display of the attack chain for the entire malicious code attack process, solving the problem that existing technologies are unable to trace and analyze network attack behaviors with characteristics of cross-data source, cross-time stage, and cross-control level.

[0006] To achieve the above objectives, the first aspect of the present invention provides a method for constructing a power grid malicious code attack chain based on multi-dimensional intent features, comprising the following steps: Raw behavioral data is collected from the power grid industrial control environment, and then a five-tuple event stream is extracted from the raw behavioral data; For each quintuple event in the quintuple event stream: obtain the industrial control operation field of each quintuple event and convert the industrial control operation field into a sparse vector; obtain the context payload field of each quintuple event and convert the context payload field into a dense vector; obtain the timestamp field and the subject identifier of each quintuple event and convert the timestamp field and the subject identifier into a real number vector; The sparse vector, dense vector and real vector corresponding to each quintuple event are fused to obtain the multidimensional intent feature tensor of each quintuple event; Based on a preset industrial control business rule base and a preset malicious behavior fingerprint base, the final tactical intent label corresponding to each multi-dimensional intent feature tensor is obtained, and then the atomic intent node of each multi-dimensional intent feature tensor is constructed based on the final tactical intent label. By traversing several atomic intent nodes in chronological order, atomic intent nodes with the same subject identifier or that conform to the kill chain relationship are grouped into the same dynamic time window, and then several attack session sequences are obtained based on several dynamic time windows. Construct an initial heterogeneous graph for each of the attack session sequences, and then generate an initial heterogeneous graph sequence based on several of the initial heterogeneous graphs; Logical pruning is performed on the initial heterogeneous graph sequence to obtain the final heterogeneous graph, thus completing the construction of the malicious code attack chain graph.

[0007] The aforementioned method for constructing a power grid malware attack chain based on multi-dimensional intent features converts raw behavioral data into a standardized five-tuple event stream. It then extracts the industrial control operation field, context payload field, timestamp field, and subject identifier from this stream, transforming them into sparse vectors, dense vectors, and real-number vectors. This achieves a unified representation of multi-source heterogeneous data, effectively overcoming the problem of insufficient feature representation from a single data source. Furthermore, the three types of vectors are fused into a multi-dimensional intent feature tensor, which can comprehensively characterize the deep features of a single behavioral event from multiple dimensions, including operation semantics, payload content, time attributes, and subject identity.

[0008] Secondly, this invention combines a pre-set industrial control business rule library and a pre-set malicious behavior fingerprint library to accurately assign a final tactical intent label to each multi-dimensional intent feature tensor and construct atomic intent nodes, so that each behavioral event is mapped to a specific attack stage or business operation, realizing semantic mapping from underlying behavioral data to high-level tactical intent, and solving the problem of limited semantic characterization of attack behavior in existing technologies.

[0009] Furthermore, this invention introduces a dynamic time window to segment atomic intent nodes into session sequences and aggregates them temporally based on subject identifier consistency and kill chain association, avoiding the fragmentation of continuous attack behavior caused by fixed time windows and maintaining the continuity of attack behavior in the time dimension. Finally, by constructing an initial heterogeneous graph and performing logical pruning, redundant nodes and edges unrelated to the attack evolution path are removed. The final heterogeneous graph generated presents the entire process of a malicious code attack in a structured and intuitive manner. Thus, this invention ultimately outputs an attack chain graph sequence containing multiple complete temporal evolution trajectory attack chains, effectively solving the problem that existing technologies struggle to conduct complete source tracing analysis of network attack behaviors with characteristics of cross-data source, cross-time stage, and cross-control level. It provides power grid security operation and maintenance personnel with clear and traceable attack chain evidence, significantly improving the situational awareness and source tracing response capabilities of power grid network security protection.

[0010] Further, the step of obtaining the industrial control operation field of each quintuple event and converting the industrial control operation field into a sparse vector includes: For any of the given quintuple events: Obtain the index number of the preset index library corresponding to the industrial control operation field; Based on the one-hot encoding principle, a sparse vector corresponding to the industrial control operation field is generated according to the index library and the index number.

[0011] In this implementation, industrial control operation fields are typically discrete instruction codes or operation types with clear category attributes. By obtaining index numbers from a pre-set index library and generating sparse vectors using one-hot encoding, discrete industrial control operation instructions can be accurately mapped to a high-dimensional vector space. This preserves the orthogonality and independence between operation instructions without introducing human numerical bias. This strategy forces different instructions such as "write operations" and "read operations" to remain orthogonal in the vector space, mathematically eliminating semantic confusion between high-risk control instructions and ordinary query instructions, and ensuring zero logical misjudgments in the detection model.

[0012] Further, obtaining the context payload field of each quintuple event and converting the context payload field into a dense vector includes: For any of the given quintuple events: The context load field is segmented into several word feature sequences; Based on the feature hashing algorithm, the position and symbol of each word feature sequence in a 64-dimensional spatial vector are calculated; Based on the position and symbol of each word feature sequence in a 64-dimensional spatial vector, a 64-dimensional dense vector of the context payload field is generated.

[0013] Context payload fields typically contain variable-length binary data or text information, and traditional fixed-length encoding struggles to effectively capture their key features. By segmenting the context payload field into word feature sequences and mapping them to 64-dimensional dense vectors using a feature hashing algorithm, this approach addresses the curse of dimensionality caused by high-dimensional sparse data. Firstly, the dimensionality reduction properties of hashing algorithms solve this problem, reducing storage and computational resource requirements. Secondly, dense vectors effectively preserve local correlation features within the payload data, bringing payloads with similar meanings closer together in the vector space. This improves the accuracy and robustness of malicious behavior matching based on content similarity.

[0014] In this implementation, considering the varying text lengths and complex content of payload fields in industrial control protocol messages, such as specific parameters, filenames, IP addresses, and malicious code signature strings, the messages are first segmented into word feature sequences to capture fine-grained semantics. Subsequently, a feature hashing algorithm is used to map the massive, undefined word features into a fixed-dimensional (64-dimensional) dense vector space. This process eliminates the need to maintain a large vocabulary, is computationally efficient, and effectively avoids hash collisions. The resulting 64-dimensional dense vector captures the implicit semantic features of payload fields in a low-dimensional, continuous manner. This allows the dense vector to effectively preserve local correlation features within the payload data, bringing similar payload content closer together in the vector space, thereby improving the accuracy and robustness of malicious behavior matching based on content similarity.

[0015] Furthermore, the step of obtaining the final tactical intent label corresponding to each multidimensional intent feature tensor based on a preset industrial control business rule base and a preset malicious behavior fingerprint base, and then constructing an atomic intent node for each multidimensional intent feature tensor based on the final tactical intent label, includes: For any of the aforementioned multidimensional intent feature tensors: Boolean matching operation is performed on the sparse vector and the preset industrial control business rule base to obtain the Boolean matching operation result; If the result of the Boolean matching operation is not empty, the final tactical intent label is output based on the result of the Boolean matching operation. If the Boolean matching operation result is empty, then the cosine similarity between the dense vector and each standard center vector in the preset malicious behavior fingerprint database is calculated, and then the standard center vector whose cosine similarity satisfies the preset similarity threshold is output as the final tactical intent label.

[0016] In this implementation, Boolean matching based on sparse vectors is first compared with a pre-defined industrial control business rule base. This rule base contains predefined tactical intent tags based on the MITRE ATT&CK for ICS framework, elevating underlying technical features to the intent level. If the Boolean match fails, it indicates that the behavior does not belong to the predefined tactical intent behavior in the rule base. Then, cosine similarity calculation is performed using dense vectors and a pre-defined malicious behavior fingerprint database. The malicious behavior fingerprint database stores standard center vectors of known attack payloads of specific categories after pre-characterization. By calculating similarity, malicious behaviors with feature variants or obfuscation can be identified, overcoming the limitation of rule matching, which can only detect known features. This method effectively improves the accuracy and coverage of tactical intent tag generation, ensuring high credibility of the constructed atomic intent nodes.

[0017] Furthermore, the step of traversing several atomic intent nodes in chronological order, thereby grouping atomic intent nodes with the same corresponding subject identifier or conforming to the kill chain relationship into the same dynamic time window, and then obtaining several attack session sequences based on several dynamic time windows, including: For any of the aforementioned atomic intent nodes: Extract several preceding nodes of the atomic intent node from the remaining atomic intent nodes; If the subject identifier corresponding to the atomic intent node is consistent with that of any of the preceding nodes, and the dynamic time window corresponding to the preceding node is in an active state, then the atomic intent node is assigned to the dynamic time window corresponding to the preceding node; otherwise, the kill chain relationship between the atomic intent node and any of the preceding nodes is further analyzed. If the atomic intent node and any of the preceding nodes conform to the kill chain association relationship, then the atomic intent node is assigned to the dynamic time window corresponding to the preceding node; otherwise, a new dynamic time window is created based on the atomic intent node.

[0018] This implementation employs a dynamic window aggregation algorithm based on temporal and causal relationships. Unlike traditional static time window partitioning, this method maintains a dynamic extension mechanism for active dynamic time windows, packaging discrete intent nodes into semantically coherent attack sessions to prevent long-cycle attacks from being interrupted by fixed time windows. On one hand, subject identifier consistency checks ensure that attack behaviors initiated by the same attack source are fully recorded; on the other hand, the introduction of kill chain relationships means that the association of attack behaviors no longer relies solely on temporal proximity, but is linked according to the logical order of attack tactical evolution, preventing long-cycle, slow attacks from being interrupted by fixed time windows. The algorithm dynamically determines the relationship between each new node and its predecessor, flexibly assigning it to an existing window or creating a new one, thereby generating a complete and semantically coherent attack session sequence. This effectively solves the problem of attackers using long-interval infiltration or slow attack methods to evade detection, ensuring the integrity and logical coherence of the same attack session sequence and providing a reliable data foundation for subsequently constructing an accurate attack chain graph.

[0019] Further, the step of logically pruning the initial heterogeneous spectrum sequence to obtain the final heterogeneous spectrum includes: Obtain the origin endpoint of the initial heterogeneous spectral sequence; A reverse depth-first search is performed based on the source endpoint to obtain the original path set; Obtain the state transition matrix, and then calculate the logical coherence function value of each original path in the original path set based on the state transition matrix; The original paths whose corresponding logical coherence function values ​​meet the preset pruning threshold are pruned and removed from the initial heterogeneous graph sequence to obtain the final heterogeneous graph.

[0020] In this implementation, to extract the most probable attack evolution path from the initial heterogeneous graph containing potential noise and bypass events, a logical pruning-based optimization step is introduced. First, starting from the origin endpoint in the graph, all possible paths leading to that endpoint are exhaustively searched using a reverse depth-first search, forming an initial path set. Then, a state transition matrix is ​​introduced to calculate the logical coherence function value of each initial path. This value reflects the rationality and coherence of the node sequence's evolution at the tactical intent level. If any pair of adjacent nodes in the path does not conform to the pre-defined pattern of the state transition matrix, the logical coherence function value of the entire path immediately drops to 0. Finally, paths with logical coherence function values ​​below a preset pruning threshold are considered logically incoherent or low-probability bypass branches and are removed from the graph. This pruning process retains only the logically coherent path from the initial node to the endpoint that best conforms to the attack evolution pattern, thereby significantly reducing the complexity of the graph and removing noise interference. The resulting heterogeneous graph can more clearly show the core chain process of malicious code attacks, greatly improving the efficiency and accuracy of security operations personnel in attack tracing and forensic analysis.

[0021] A second aspect of the present invention provides a system for constructing a power grid malicious code attack chain based on multi-dimensional intent features, comprising: The data acquisition module is used to collect raw behavioral data in the power grid industrial control environment, and then extract the five-tuple event stream from the raw behavioral data; The feature encoding module is used for each 5-tuple event in the 5-tuple event stream to: obtain the industrial control operation field of each 5-tuple event and convert the industrial control operation field into a sparse vector; obtain the context payload field of each 5-tuple event and convert the context payload field into a dense vector; obtain the timestamp field and the subject identifier of each 5-tuple event and convert the timestamp field and the subject identifier into a real number vector; and fuse the sparse vector, the dense vector and the real number vector corresponding to each 5-tuple event to obtain a multidimensional intent feature tensor for each 5-tuple event. The intent recognition module is used to obtain the final tactical intent label corresponding to each multidimensional intent feature tensor based on a preset industrial control business rule library and a preset malicious behavior fingerprint library, and then construct the atomic intent node of each multidimensional intent feature tensor based on the final tactical intent label. The sequence construction module is used to traverse several atomic intent nodes in chronological order, thereby grouping atomic intent nodes with the same subject identifier or that conform to the kill chain relationship into the same dynamic time window, and then obtaining several attack session sequences based on several dynamic time windows. An attack chain graph construction module is used to construct an initial heterogeneous graph for each attack session sequence, and then generate an initial heterogeneous graph sequence based on several initial heterogeneous graphs. The attack chain graph pruning and reconstruction module is used to perform logical pruning on the initial heterogeneous graph sequence to obtain the final heterogeneous graph, thus completing the construction of the malicious code attack chain graph.

[0022] Further, the step of obtaining the industrial control operation field of each quintuple event and converting the industrial control operation field into a sparse vector includes: For any of the given quintuple events: Obtain the index number of the preset index library corresponding to the industrial control operation field; Based on the one-hot encoding principle, a sparse vector corresponding to the industrial control operation field is generated according to the index library and the index number.

[0023] Further, obtaining the context payload field of each quintuple event and converting the context payload field into a dense vector includes: For any of the given quintuple events: The context load field is segmented into several word feature sequences; Based on the feature hashing algorithm, the position and symbol of each word feature sequence in a 64-dimensional spatial vector are calculated; Based on the position and symbol of each word feature sequence in a 64-dimensional spatial vector, a 64-dimensional dense vector of the context payload field is generated.

[0024] Furthermore, for any of the multidimensional intent feature tensors: Boolean matching operation is performed on the sparse vector and the preset industrial control business rule base to obtain the Boolean matching operation result; If the result of the Boolean matching operation is not empty, the final tactical intent label is output based on the result of the Boolean matching operation. If the Boolean matching operation result is empty, then the cosine similarity between the dense vector and each standard center vector in the preset malicious behavior fingerprint database is calculated, and then the standard center vector whose cosine similarity satisfies the preset similarity threshold is output as the final tactical intent label.

[0025] The method and system for constructing a power grid malicious code attack chain based on multi-dimensional intent features provided by the present invention have at least the following advantages compared with the prior art: To address the differences in data structure and semantic characteristics between power grid industrial control traffic and host audit logs, this invention employs a parallel modeling approach combining discrete logical features and continuous semantic features. Specifically, discrete fields such as function codes in the industrial control protocol are mapped to orthogonal vectors, ensuring linear independence between different types of control commands in the feature space. This reduces the weakening of high-risk control command features during feature representation. Simultaneously, unstructured text parameters from the host logs are embedded in a continuous space, preserving semantic distance information between parameters. This differentiated processing method balances the boundary distinguishability of rigid business logic with the fuzzy matching capability of flexible textual behavior within a unified mathematical space, reducing information loss caused by mandatory uniform encoding.

[0026] This invention improves upon the limitations of traditional fixed-time-window slicing methods in handling long-term attacks by introducing a semantic rule-driven adaptive spatiotemporal sliding window mechanism. When a newly entered behavioral sequence is determined to conform to the attack evolution logic, the effective time range of the current session window is extended, and shared entities are used as connection anchors to associate adjacent time slices. Through this approach, attack behaviors spanning a long time span are incorporated into the same session sequence for processing, thereby maintaining the logical continuity of attack behaviors in the temporal dimension during analysis.

[0027] This invention combines a causal reverse backtracking algorithm with a kill chain state matrix pruning strategy to constrain the screening and reconstruction process of attack paths in massive log data. By performing a reverse topology search with high-risk intent nodes as endpoints and using a state transition matrix to logically verify candidate paths, path branches that do not conform to the attack phase transition rules are pruned. The resulting structured attack chain object contains a sequence of key nodes and corresponding original evidence, achieving structured organization of fragmented logs and reducing the workload of manual log correlation analysis. Attached Figure Description

[0028] Figure 1 This is a flowchart illustrating a method for constructing a power grid malicious code attack chain based on multi-dimensional intent features, provided by an embodiment of the present invention. Figure 2 This is a flowchart illustrating another method for constructing a power grid malicious code attack chain based on multi-dimensional intent features, provided by an embodiment of the present invention. Figure 3 This is a schematic diagram of a power grid malicious code attack chain construction system based on multi-dimensional intent features provided in an embodiment of the present invention. Detailed Implementation

[0029] The present invention will now be described in detail with reference to the accompanying drawings and embodiments. It should be noted that the following detailed descriptions are exemplary and intended to provide further detailed explanation of the invention. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs; the terminology used herein in the specification is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms "comprising" and "having," and any variations thereof, in the specification, claims, and foregoing drawings, are intended to cover non-exclusive inclusion. The terms "first," "second," etc., in the specification, claims, or foregoing drawings are used to distinguish different objects, not to describe a particular order.

[0030] It should be understood that although the steps in the flowcharts of the accompanying figures are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0031] Before describing this application in detail with reference to the accompanying drawings and embodiments, the terms and application scenarios involved in this application will first be explained.

[0032] With the ongoing development of the ubiquitous power internet of things, the heterogeneity of host systems and network systems in the power grid operation environment is constantly increasing. Attackers may exploit the complexity of the multi-source environment to carry out covert and persistent attacks through malicious code and cross-domain collaboration. Once such attacks affect critical control links, they may lead to abnormal equipment operation or system malfunction risks.

[0033] To address the need for correlation analysis of cross-domain, multi-source heterogeneous data (including industrial control traffic and host logs) in the control and process layers of smart power grids, this invention proposes a method for constructing malicious code attack chains for power grids based on multi-dimensional intent features. This method combines joint representation of discrete and continuous feature spaces with causal reverse backtracking analysis techniques to logically correlate and reconstruct attack behaviors with multi-stage characteristics in complex industrial control environments. The method is applicable to scenarios such as power grid industrial control security situation analysis, attack tracing analysis, security drill support, and operational auditing.

[0034] Please refer to Figure 1To achieve the above objectives, the first embodiment of the present invention provides a method for constructing a power grid malicious code attack chain based on multi-dimensional intent features, comprising the following steps: S1. Collect raw behavioral data in the power grid industrial control environment, and then extract the five-tuple event stream from the raw behavioral data; S2. For each quintuple event in the quintuple event stream: obtain the industrial control operation field of each quintuple event and convert the industrial control operation field into a sparse vector; obtain the context payload field of each quintuple event and convert the context payload field into a dense vector; obtain the timestamp field and the subject identifier of each quintuple event and convert the timestamp field and the subject identifier into a real number vector; S3. The sparse vector, the dense vector and the real vector corresponding to each quintuple event are fused to obtain the multidimensional intent feature tensor of each quintuple event; S4. Based on the preset industrial control business rule library and the preset malicious behavior fingerprint library, obtain the final tactical intent label corresponding to each multi-dimensional intent feature tensor, and then construct the atomic intent node of each multi-dimensional intent feature tensor based on the final tactical intent label. S5. Traverse several atomic intent nodes according to time order, thereby grouping atomic intent nodes with the same subject identifier or that conform to the kill chain relationship into the same dynamic time window, and then obtaining several attack session sequences based on several dynamic time windows. S6. Construct an initial heterogeneous graph for each attack session sequence, and then generate an initial heterogeneous graph sequence based on several initial heterogeneous graphs; S7. Perform logical pruning on the initial heterogeneous graph sequence to obtain the final heterogeneous graph, thus completing the construction of the malicious code attack chain graph.

[0035] The aforementioned method for constructing a power grid malware attack chain based on multi-dimensional intent features converts raw behavioral data into a standardized five-tuple event stream. It then extracts the industrial control operation field, context payload field, timestamp field, and subject identifier from this stream, transforming them into sparse vectors, dense vectors, and real-number vectors. This achieves a unified representation of multi-source heterogeneous data, effectively overcoming the problem of insufficient feature representation from a single data source. Furthermore, the three types of vectors are fused into a multi-dimensional intent feature tensor, which can comprehensively characterize the deep features of a single behavioral event from multiple dimensions, including operation semantics, payload content, time attributes, and subject identity.

[0036] Secondly, this invention combines a pre-set industrial control business rule library and a pre-set malicious behavior fingerprint library to accurately assign a final tactical intent label to each multi-dimensional intent feature tensor and construct atomic intent nodes, so that each behavioral event is mapped to a specific attack stage or business operation, realizing semantic mapping from underlying behavioral data to high-level tactical intent, and solving the problem of limited semantic characterization of attack behavior in existing technologies.

[0037] Furthermore, this invention introduces a dynamic time window to segment atomic intent nodes into session sequences and aggregates them temporally based on subject identifier consistency and kill chain association, avoiding the fragmentation of continuous attack behavior caused by fixed time windows and maintaining the continuity of attack behavior in the time dimension. Finally, by constructing an initial heterogeneous graph and performing logical pruning, redundant nodes and edges unrelated to the attack evolution path are removed. The final heterogeneous graph generated presents the entire process of a malicious code attack in a structured and intuitive manner. Thus, this invention ultimately outputs an attack chain graph sequence containing multiple complete temporal evolution trajectory attack chains, effectively solving the problem that existing technologies struggle to conduct complete source tracing analysis of network attack behaviors with characteristics of cross-data source, cross-time stage, and cross-control level. It provides power grid security operation and maintenance personnel with clear and traceable attack chain evidence, significantly improving the situational awareness and source tracing response capabilities of power grid network security protection.

[0038] In such Figure 2 In one specific embodiment, the above-mentioned method for constructing a power grid malicious code attack chain based on multi-dimensional intent features can be divided into the following three main steps: Step 1: Feature projection and vectorization representation of multi-source heterogeneous data. To address the heterogeneity of raw behavioral data such as power grid industrial control traffic data and host log text data in terms of data structure and semantic dimensions, this step constructs discrete and continuous dual feature spaces respectively: First, considering the deterministic nature of industrial control protocol instructions, fields such as function codes are extracted and projected onto the discrete action space using one-hot encoding to form sparse vectors, thus forming a discrete action space representation to accurately represent rigid control logic; second, considering the variable nature of host log text, command line parameters are extracted and projected onto the continuous semantic space using N-Gram hashing to form dense vectors, thus forming a continuous semantic space representation to fuzzily capture flexible behavioral patterns. Finally, dual-space feature concatenation and temporal embedding are performed to output a standardized multi-dimensional intent feature vector. .

[0039] The second step involves rule-driven intent semantic enhancement and dynamic graph construction. This step aims to transform a continuous feature stream into a semantically coherent dynamic graph, thereby avoiding logical fragmentation caused by fragmented data. Specifically, this includes: based on the multi-dimensional intent feature vector obtained in the first step... Utilizing an expert rule base, semantic enhancement is performed based on the rule base to map atomic intent nodes, transforming abstract numerical values ​​into tactically meaningful atomic intent nodes in real time. An adaptive spatiotemporal sliding window is introduced to calculate the spatiotemporal proximity / session segmentation between nodes, thereby dividing the intent sequence into multiple attack sessions that are semantically and temporally consistent. For the nodes contained within each session, this step constructs a dynamic intent association graph, where nodes represent reconnaissance, deployment, and other intents, and edges represent temporal evolution and causal triggering relationships. Simultaneously, this step also identifies shared asset entity anchors appearing between adjacent windows and uses these shared entities as cross-stage connection anchors, forming a dynamic intent association graph flow containing anchors to achieve the inheritance of long-term dependencies and the connection of attack paths throughout the entire lifecycle.

[0040] The third step involves key path extraction and attack chain reconstruction based on causal backtracking. This step aims to accurately reconstruct a single and complete malicious code attack path from a complex intent association graph. Specifically, this includes: using a high-risk anchor point location strategy to identify the source endpoint, identifying intent nodes with destructive or data-stealing attributes in the graph as source endpoints; executing a reverse topology traversal algorithm for depth-first backtracking, recursively searching for preceding causal nodes leading to high-risk consequences until the attack entry point is reached; and implementing logical pruning based on a kill chain model to remove isolated / pseudo-related branches, eliminating isolated nodes lacking contextual association and pseudo-related branches that do not conform to the attack stage transition rules. Finally, the retained key node sequences are structurally reconstructed to generate a visualized power grid malicious code attack chain containing a complete attack timeline and evidence chain.

[0041] Please refer to Figure 2 It should be noted that the technical solution adopted in the embodiments of the present invention is a method for constructing a power grid malicious code attack chain based on multi-dimensional intent features. The method processes multi-source heterogeneous behavioral data in a three-stage process of multi-dimensional feature tensor quantization representation, adaptive dynamic graph construction, and causal logic reverse backtracking, so as to alleviate the problems of semantic differences in heterogeneous data and the easy fragmentation of long-cycle attack context.

[0042] First, this invention utilizes multi-source heterogeneous raw behavioral data collected from a power grid industrial control environment. This raw behavioral data includes industrial protocol payloads such as IEC104 / Modbus, host process creation chains, and key shell commands. Based on this, addressing the differences in data structure and semantic dimensions between rigid industrial control commands and flexible host logs, this scheme employs discrete and continuous dual-space feature projection: industrial control actions (such as function codes) with strict business logic exclusivity are mapped to a high-dimensional discrete orthogonal space to form sparse vectors, accurately defining safety boundaries; while script parameters and payloads with variable morphological structures are mapped to a continuous Euclidean semantic space to form dense vectors. By jointly employing discrete orthogonal representation and continuous semantic embedding, a unified expression of the distinguishing characteristics of industrial control business logic and the semantic similarity of payloads is achieved, constructing a multi-dimensional intent feature tensor.

[0043] Secondly, this invention performs rule-driven intent semantic enhancement and dynamic graph construction. Utilizing deterministic business rules and fuzzy malicious fingerprints, the underlying feature tensor is mapped in real-time to atomic intent nodes with tactical meaning. Addressing the issue of traditional fixed-time windows easily interrupting long-cycle attacks, this solution introduces an adaptive spatiotemporal sliding window mechanism driven by Kill Chain (CKC) logic. By real-time detection of the sequential relationship between new nodes and their predecessor nodes within the window on the kill chain, the window lifecycle is dynamically extended, aggregating temporally discrete but semantically coherent attack steps. Based on this, entity nodes and interaction edges are instantiated to construct a series of dynamically evolving heterogeneous graph snapshots, and the logical connection of long-cycle dependencies is achieved by identifying shared entities (anchor points) across windows.

[0044] Ultimately, this invention employs a critical path extraction and state matrix pruning strategy based on causal backtracking. Using high-risk intent nodes identified in the graph as the source endpoint, a reverse depth-first search is performed to recursively find the preceding causal path leading to the high-risk consequence. Simultaneously, the CKC state transition matrix is ​​introduced as a logical verifier to perform a full-link legality evaluation of the extracted paths, automatically eliminating pseudo-related noise branches that do not conform to the attack phase transition rules.

[0045] Furthermore, the process of collecting raw behavioral data from the power grid industrial control environment and then extracting a five-tuple event stream from the raw behavioral data includes: By combining discrete action modeling on the network side with continuous semantic modeling on the host side, the original data in the physical domain is mapped into a unified mathematical space.

[0046] Specifically, in the power grid industrial control operation environment, the DPI flow probe and host audit interface are used to collect heterogeneous behavioral data such as application layer loads, process creation chains, key shell commands and file system changes of the IEC104 / Modbus protocol in parallel.

[0047] Key elements with security semantics are extracted from the raw binary payload and unstructured log text and aligned along the time dimension to form a standardized 5-tuple event stream. Each 5-tuple event includes a timestamp, subject identifier, action type, target object, and context payload.

[0048] In another specific embodiment, for cross-domain heterogeneous data fragments in which an attacker uses an engineering station as a springboard to launch a malicious circuit breaker tripping operation to the substation monitoring and control device, the original behavior report records the detailed context information of the host-side bash process calling python3 to execute a malicious script and the IEC104 protocol control instructions generated by the network side in both text log and binary stream formats, including key attributes such as timestamp, subject IP, system call parameters, and industrial control function codes.

[0049] This invention transforms the original heterogeneous behavioral fragments into standardized five-tuple behavioral event sequences. Taking host-side logs as an example, the transformed five-tuple events include timestamp, subject identifier, action type, operation object, and context payload.

[0050] Through the above processing, related behaviors scattered in host logs and industrial control traffic can be correlated and modeled to form a structured attack chain that reflects the temporal relationship and causal dependence of the behaviors, which can be used for subsequent attack tracing analysis and security assessment.

[0051] Further, the step of obtaining the industrial control operation field of each quintuple event and converting the industrial control operation field into a sparse vector includes: For any of the given quintuple events: Obtain the index number of the preset index library corresponding to the industrial control operation field; Based on the one-hot encoding principle, a sparse vector corresponding to the industrial control operation field is generated according to the index library and the index number.

[0052] In a preferred embodiment, a high-dimensional discrete orthogonal space is constructed for the action type (e.g., Modbus function code) and operation object (e.g., register address / API name) fields in the quintuple to strictly preserve the mutual exclusion and security boundaries of the business logic. Specifically, a global instruction index library is established to map the above fields to independent bases. One-hot encoding is used to transform each defined industrial control operation into a sparse vector.

[0053] In a typical attack event within a specific power automation system, for a 5-tuple event, the attacker uses the 192.168.1.5 node to send an illegal two-point remote tripping command to the circuit breaker with I / O address 2001. First, the system parses the 5-tuple event message, extracting the core action type field `action:IEC104_Type46` (two-point command) and the operation object field `object:IOA:2001`. Here, `action:IEC104_Type46` represents a two-point command of IEC104 protocol type 46, and `object:IOA:2001` represents the circuit breaker with I / O address 2001. A pre-built index library contains N=128 commonly used protocol commands and key object combinations in power systems. A query reveals that the globally unique index number (Index) corresponding to IEC104_Type46 combined with IOA:2001 is 42. Based on the one-hot encoding principle, a... An initial zero vector of dimension 42. The element at index 42 is set to 1, and the remaining elements are kept at 0. Its mathematical expression is as follows: Through this operation, the high-risk "shutdown" instruction is completely orthogonal to the ordinary general call query instruction in the vector space (the dot product is 0). This discrete orthogonal representation forces the model to define clear business logic boundaries at the feature level, eliminating logical misjudgments caused by feature overlap from a physical perspective.

[0054] In this implementation, industrial control operation fields are typically discrete instruction codes or operation types with clear category attributes. By obtaining index numbers from a pre-set index library and generating sparse vectors using one-hot encoding, discrete industrial control operation instructions can be accurately mapped to a high-dimensional vector space. This preserves the orthogonality and independence between operation instructions without introducing human numerical bias. This strategy forces different instructions such as "write operations" and "read operations" to remain orthogonal in the vector space, mathematically eliminating semantic confusion between high-risk control instructions and ordinary query instructions, and ensuring zero logical misjudgments in the detection model.

[0055] Further, obtaining the context payload field of each quintuple event and converting the context payload field into a dense vector includes: For any of the given quintuple events: The context load field is segmented into several word feature sequences; Based on the feature hashing algorithm, the position and symbol of each word feature sequence in a 64-dimensional spatial vector are calculated; Based on the position and symbol of each word feature sequence in a 64-dimensional spatial vector, a 64-dimensional dense vector of the context payload field is generated.

[0056] In a preferred embodiment, the context payload fields (such as shell command-line arguments and complex write values) in the quintuple event are embedded into a continuous Euclidean geometric space to preserve local morphological structure and anti-adversarial features with low distortion. Specifically, character-level sliding window segmentation is first performed to extract the sub-word feature sequences of the text to capture the microstructure of the string; then, feature hashing is used to project the variable-length sub-word sequences into a dense vector of fixed dimensions.

[0057] It should be noted that feature hashing is an efficient method for converting high-dimensional categorical or textual features into low-dimensional numerical feature vectors.

[0058] In a typical attack event within a specific power automation system, taking the context payload field of a quintuple event as an example, the upper and lower payload fields are first divided into sub-word sequences such as "arg", "rgs", and "gs: "..."iec" using a sliding window of length 3 using 3-grams. For simplicity, a representative set of these sub-words is selected. This will be explained. These sub-words constitute the input elements of the feature hash. A hash function is used to calculate their position and symbol in the spatial vector. The position hash H(s) determines the coordinate position of the sub-word in the 64-dimensional vector, as shown in the formula: The subwords are converted into a numerical sequence using ASCII code, and then mapped to a 64-dimensional array using positional hashing. For example, the corresponding ASCII byte stream is [0x69, 0x63, 0x65]. The feature corresponding to the word "ice" will be placed in the 8th position of the 64-dimensional vector. Symbolic hashing. This determines the sign of the weighting at that position, used to offset biases caused by hash collisions. The calculation formula is: That is, an odd number of bytes in the byte stream is incremented by 1, and an odd number of bytes is incremented by 1. This maps the context payload field to a dense, continuous 64-dimensional vector. When an attacker attempts to evade detection using obfuscation techniques (such as changing `fuzz` to `f_u_z_z`), the hash index (position 8) of unmodified subwords (such as `iec`) in the string remains unchanged due to the characteristics of 3-Gram segmentation. The mapped new vector... With the original vector It has an extremely small Euclidean distance in 64-dimensional Euclidean space, thus enabling fuzzy matching against variant attacks.

[0059] Context payload fields typically contain variable-length binary data or text information, and traditional fixed-length encoding struggles to effectively capture their key features. By segmenting the context payload field into word feature sequences and mapping them to 64-dimensional dense vectors using a feature hashing algorithm, this approach addresses the curse of dimensionality caused by high-dimensional sparse data. Firstly, the dimensionality reduction properties of hashing algorithms solve this problem, reducing storage and computational resource requirements. Secondly, dense vectors effectively preserve local correlation features within the payload data, bringing payloads with similar meanings closer together in the vector space. This improves the accuracy and robustness of malicious behavior matching based on content similarity.

[0060] In this implementation, considering the varying text lengths and complex content of payload fields in industrial control protocol messages, such as specific parameters, filenames, IP addresses, and malicious code signature strings, the messages are first segmented into word feature sequences to capture fine-grained semantics. Subsequently, a feature hashing algorithm is used to map the massive, undefined word features into a fixed-dimensional (64-dimensional) dense vector space. This process eliminates the need to maintain a large vocabulary, is computationally efficient, and effectively avoids hash collisions. The resulting 64-dimensional dense vector captures the implicit semantic features of payload fields in a low-dimensional, continuous manner. This allows the dense vector to effectively preserve local correlation features within the payload data, bringing similar payload content closer together in the vector space, thereby improving the accuracy and robustness of malicious behavior matching based on content similarity.

[0061] Further, the step of obtaining the timestamp field and subject identifier of each quintuple event and converting the timestamp field and subject identifier into real number vectors; and fusing the sparse vector, dense vector, and real number vector corresponding to each quintuple event to obtain the multidimensional intent feature tensor of each quintuple event includes: Through feature concatenation, the sparse action vector and dense payload vector are fused. Next, the timestamp field is extracted and mapped to a periodic trigonometric function encoding, and the subject identifier field is extracted and mapped to a low-dimensional real vector through entity embedding, which is then appended to the feature tail. Finally, a standardized multi-dimensional intent feature tensor F is output, achieving a complete reconstruction of the original physical domain behavior.

[0062] Based on the processed quintuple behavior event sequence, this invention encodes the action type and context payload of each event to obtain a joint representation of each runtime event. .in, Represents a sparse vector; Represents a dense vector; Represents a real number vector.

[0063] Furthermore, the step of obtaining the final tactical intent label corresponding to each multidimensional intent feature tensor based on a preset industrial control business rule base and a preset malicious behavior fingerprint base, and then constructing an atomic intent node for each multidimensional intent feature tensor based on the final tactical intent label, includes: For any of the aforementioned multidimensional intent feature tensors: Boolean matching operation is performed on the sparse vector and the preset industrial control business rule base to obtain the Boolean matching operation result; If the result of the Boolean matching operation is not empty, the final tactical intent label is output based on the result of the Boolean matching operation. If the Boolean matching operation result is empty, then the cosine similarity between the dense vector and each standard center vector in the preset malicious behavior fingerprint database is calculated, and then the standard center vector whose cosine similarity satisfies the preset similarity threshold is output as the final tactical intent label.

[0064] In a preferred embodiment, a slicing operation is performed on any of the multidimensional intent feature tensors: the first segment is truncated into a sparse vector V. act (Discrete action components), the latter part is truncated into a dense vector V. sem (Continuous semantic components), and parse the remaining bits into a real number vector V. meta (Metadata component), which includes timestamp t and subject identifier s, thus separating two types of heterogeneous features: rigid and flexible.

[0065] Mapping discrete action components to deterministic intents: Defining the industrial control business rule base as a set of key-value pairs: in For action fingerprint indexing.

[0066] For a quintuple event, if the combination of the IEC104_Type46 instruction (representing a two-dot command of IEC104 protocol type 46) and the IOA:2001 address (representing a circuit breaker with I / O address 2001) in its corresponding multidimensional intent feature tensor is assigned as base number 42 in the global instruction index library, then the action fingerprint index of this event is... Its function is to transform high-dimensional sparse action feature components It is restored to a highly condensed numerical index, which serves as a query tool for the industrial control business rule base. The key value enables rapid location of standard business actions from raw instructions.

[0067] In the formula, Predefined tactical intent labels, based on the MITRE ATT&CK for ICS framework for cyberattacks on industrial control systems, include, but are not limited to, "Remote Operation" and "Unauthorized Configuration Change." These labels, as the output (Value) of the rule base retrieval, elevate underlying technical characteristics to the intent level. They are a core attribute for subsequently constructing dynamic heterogeneous graph snapshots, enabling the system to transcend the identification of single commands and correlate coherent attack steps at the tactical level.

[0068] For sparse vector V act Extract its non-zero index. Perform Boolean matching operations: in, Indicates a non-zero index Compliant with industrial control business rule library In a key-value pair, otherwise indicates a non-zero index. Does not comply with the industrial control business rule library None indicates that the Boolean matching operation results in an empty string.

[0069] If the match is successful, the deterministic intent label will be output directly. As a label for the final tactical intent, and with a set confidence level. This enables zero false alarm identification of critical industrial control commands.

[0070] If the discrete component is not hit ( If the Boolean matching operation result is empty, the fuzzy analysis mechanism is activated. The malicious behavior fingerprint database is defined as a vector set: in The standard center vector of a known attack sample is a statistically representative fixed-dimensional numerical vector generated after pre-characterization processing of known attack payloads of a specific category. By collecting multiple samples of a specific attack type, each sample is converted into a 64-dimensional continuous semantic vector using the 3-Gram segmentation and feature hashing method described above. The geometric center (mean vector) of this sample vector set is then calculated using a clustering algorithm, thus obtaining the standard center vector. It serves as a mathematical fingerprint for judging fuzzy intent. When dense vectors are detected in real time... When an exact match cannot be found using the rule base, the system calculates a dense vector. With each standard center vector The Euclidean distance between them is used to determine whether they fall within the semantic neighborhood of known attack variants, thereby identifying highly covert obfuscation attacks.

[0071] Calculate dense vectors Cosine similarity with each vector in the fingerprint database: Select the maximum similarity .like ( (Set the preset threshold to 0.85) and output the corresponding intent label. Confidence level This enables effective capture of obfuscated variant payloads.

[0072] It should be noted that when building the database for known attacks, corresponding intent tags are included, especially in dense vectors. When calculating similarity, if the similarity exceeds a threshold, it is classified as the corresponding intent.

[0073] Instantiating atomic intent nodes: Based on the above bimodal mapping results, standardized atomic intent nodes are constructed. This node is formally defined as a quadruple atomic intention node: in The time when the event occurred; As the main identifier; Label the final tactical intent (take priority) The default value is ); This represents the confidence level of the intention.

[0074] In this implementation, Boolean matching based on sparse vectors is first compared with a pre-defined industrial control business rule base. This rule base contains predefined tactical intent tags based on the MITRE ATT&CK for ICS framework, elevating underlying technical features to the intent level. If the Boolean match fails, it indicates that the behavior does not belong to the predefined tactical intent behavior in the rule base. Then, cosine similarity calculation is performed using dense vectors and a pre-defined malicious behavior fingerprint database. The malicious behavior fingerprint database stores standard center vectors of known attack payloads of specific categories after pre-characterization. By calculating similarity, malicious behaviors with feature variants or obfuscation can be identified, overcoming the limitation of rule matching, which can only detect known features. This method effectively improves the accuracy and coverage of tactical intent tag generation, ensuring high credibility of the constructed atomic intent nodes.

[0075] Furthermore, the step of traversing several atomic intent nodes in chronological order, thereby grouping atomic intent nodes with the same corresponding subject identifier or conforming to the kill chain relationship into the same dynamic time window, and then obtaining several attack session sequences based on several dynamic time windows, including: For any of the aforementioned atomic intent nodes: Extract several preceding nodes of the atomic intent node from the remaining atomic intent nodes; If the subject identifier corresponding to the atomic intent node is consistent with that of any of the preceding nodes, and the dynamic time window corresponding to the preceding node is in an active state, then the atomic intent node is assigned to the dynamic time window corresponding to the preceding node; otherwise, the kill chain relationship between the atomic intent node and any of the preceding nodes is further analyzed. If the atomic intent node and any of the preceding nodes conform to the kill chain association relationship, then the atomic intent node is assigned to the dynamic time window corresponding to the preceding node; otherwise, a new dynamic time window is created based on the atomic intent node.

[0076] In a preferred embodiment, the input atomic intent node stream is traversed, and a spatial anchoring operation is performed. For each newly arrived atomic intent node... The algorithm reads the entity identifier contained within, specifically the IP address or host process PID. It then checks if there are any active dynamic event windows anchored to this entity or its associated IP; if so, it directly moves the node... Add it to the cache pool of the active dynamic event window; if it does not exist, create a new dynamic time window, lock the current subject as the spatial anchor point, and set the window's initial expiration time. Add a base duration to the current node time; this can be set to 10 minutes.

[0077] To prevent long-term, slow attacks from being cut off by a fixed time window, semantic consistency judgment logic is superimposed to adaptively extend the window: The system monitors the relationship between new nodes and their preceding nodes within the window in real time. If the relationship matches the CKC kill chain or the new node indicates a high-risk intent, the attack is considered not to have ended. In this case, the current window's deadline is automatically extended, exceeding the basic time threshold limit. This ensures the attack behavior is fully contained in terms of timing and semantics, avoiding logical fragmentation caused by mechanical slicing.

[0078] It should be noted that the Cyber ​​Kill Chain (CKC) is a standard model used to describe the phased evolution of network attacks. This invention applies it to the field of industrial control system security, dividing typical attack behaviors into seven standard phases: reconnaissance, weaponization, delivery, exploitation, installation, command and control (C2), and actions on objectives. For example, "reconnaissance" is followed by "delivery" or "execution"; "delivery" is followed by "execution" or "destruction"; "execution" is followed by "destruction", and so on.

[0079] In one specific embodiment, for the atomic intent node flow The system executes the following detection logic: when a new node... Upon arrival, the system extracts its main identifier as 192.168.1.5, identifies an existing active window with this identifier as its anchor point, and recognizes that the preceding node within the window is... Upon verification, the preceding intent was correct. For Resource_Dev (resource delivery), a new node For Execution. The mapping table shows Resource_Dev The execution logic matches the attack progression logic, and is therefore determined to be semantically relevant. When Upon arrival, the system identifies its intent as Impact (damage) with a confidence level of 1.0. Since Impact is defined as the final stage of the kill chain and belongs to the high-risk intent set, it is determined to be the final achievement of the attack. Based on the above determination, and given the sequential relationship and the presence of high-risk nodes, the system automatically triggers the window extension mechanism. The window deadline is set to... Dynamically extended based on timestamp This allows for a strongly correlated sequence of intentions spanning 4.8 seconds. They are encapsulated into the same attack session sequence.

[0080] Continuously monitor data stream and system clock ,when If no new neighboring nodes join, the current session is considered to have ended. A truncation operation is then performed, encapsulating all intent nodes in the cache pool into an independent attack session sequence in chronological order. Then output it to the next module.

[0081] This implementation employs a dynamic window aggregation algorithm based on temporal and causal relationships. Unlike traditional static time window partitioning, this method maintains a dynamic extension mechanism for active dynamic time windows, packaging discrete intent nodes into semantically coherent attack sessions to prevent long-cycle attacks from being interrupted by fixed time windows. On one hand, subject identifier consistency checks ensure that attack behaviors initiated by the same attack source are fully recorded; on the other hand, the introduction of kill chain relationships means that the association of attack behaviors no longer relies solely on temporal proximity, but is linked according to the logical order of attack tactical evolution, preventing long-cycle, slow attacks from being interrupted by fixed time windows. The algorithm dynamically determines the relationship between each new node and its predecessor, flexibly assigning it to an existing window or creating a new one, thereby generating a complete and semantically coherent attack session sequence. This effectively solves the problem of attackers using long-interval infiltration or slow attack methods to evade detection, ensuring the integrity and logical coherence of the same attack session sequence and providing a reliable data foundation for subsequently constructing an accurate attack chain graph.

[0082] In a preferred embodiment, constructing the initial heterogeneous graph for each of the attack session sequences includes: Instantiating node and edge relationships: Traversing the atomic intent node quadruples within each attack session sequence, performing semantic parsing and type mapping on the entities within them. Mapping the subjects and objects in the event to graph nodes. Specifically, for atomic intention node quadruples ,in The time when the event occurred; The main identifier; y is... Label the final tactical intent (take priority) The default value is ); The subject refers to the atomic intent node quadruple, which represents the confidence level of the intent. The main identifier field The entity representing the initiator of the action, such as the host IP address 192.168.1.5; the object refers to the timestamp of the atomic intent node quadruple. Tracing back to the `object` field extracted from the corresponding standardized quintuple, which represents the entity receiving the action, the system performs deduplication and type normalization on these entities, mapping them to a heterogeneous set of nodes in the graph. Simultaneously, the API call behavior or operation instructions in the atomic intent node quadruple are mapped to directed edges between nodes. Specifically, both API call behavior and operation instructions correspond to the tactical intent label in the atomic intent four-tuple. Specifically, when the behavioral event originates from system logs or the host auditing interface, This is mapped to specific API call behaviors; when the behavior event originates from an industrial control protocol payload... This is mapped to operational instructions at the business layer. The aforementioned behaviors are instantiated as directed edge attributes connecting subject nodes and object nodes, representing the dynamic interaction semantics between entities. This transforms the planar log recording into a three-dimensional interaction network between entities.

[0083] Constructing the topology: For the first Each attack session was analyzed, and key victim assets were identified and defined as the topology center node. Strictly follow the timeline of events. The associated events are instantiated sequentially as surrounding events. The adjacency structure. Through this process, the call dependencies and state change relationships between subjects and objects are accurately reconstructed, forming a heterogeneous graph snapshot representing the causal context of the current stage. .

[0084] In a preferred embodiment, generating an initial heterogeneous spectrum sequence based on a plurality of the initial heterogeneous spectra includes: Generating subsequent snapshots At that time, it automatically identifies its relationship with the previous snapshot. Shared entity collection (Similar to a resident process or C2 connection). [The following text appears to be incomplete and requires further context: " Serving as a cross-stage connection anchor, it logically connects discrete local snapshots. The final output contains an initial heterogeneous spectrum sequence containing the complete temporal evolution trajectory. This serves as the input tensor for the subsequent graph learning module.

[0085] Further, the step of logically pruning the initial heterogeneous spectrum sequence to obtain the final heterogeneous spectrum includes: Obtain the origin endpoint of the initial heterogeneous spectral sequence; A reverse depth-first search is performed based on the source endpoint to obtain the original path set; Obtain the state transition matrix, and then calculate the logical coherence function value of each original path in the original path set based on the state transition matrix; The original paths whose corresponding logical coherence function values ​​meet the preset pruning threshold are pruned and removed from the initial heterogeneous graph sequence to obtain the final heterogeneous graph.

[0086] In a preferred embodiment, in the initial heterogeneous spectral sequence Based on this, the reverse topology traversal algorithm and the kill chain state transition matrix are used to remove noise from the complex graph and reconstruct a single and complete chain of attack evidence.

[0087] Specifically, it traverses the heterogeneous graph to identify intent types belonging to high-risk sets. (Such as sabotage, data theft) Nodes that meet the confidence level are used as the tracing endpoints. Starting from this logical point, a reverse depth-first search is performed. Using the identified high-risk intent node (the endpoint of the tracing) as the starting search point, a depth-first traversal is performed along the reverse direction of the directed edges (i.e., from the object to the subject) to find the longest tracing path, thus tracing from the result to the cause, strictly adhering to the constraint of irreversible time. And prioritize weights when branching through multiple paths Strong causal edges are identified by recursively tracing back along directed edges until they reach entry nodes such as "asset reconnaissance" or "initial access," thereby extracting the original path set containing potential causal relationships. .

[0088] It should be noted that weight It is a core parameter for quantifying the strength of the causal relationship between two intent nodes. When the algorithm scans a connection between a preceding node in a heterogeneous graph... With subsequent nodes When there are directed edges, the weight This is derived from the confidence component calculated for this behavior node in algorithm step 2.1. This represents the underlying probability distribution of whether a single action is judged as having a specific malicious intent, such as "execution" or "sabotage." The higher the confidence level, the stronger the certainty that the action is part of an attack chain.

[0089] To eliminate logical breaks and spurious correlation noise in the path, a CKC state transition matrix is ​​introduced. , of which elements Defined from the tactical phase Leap to The legitimacy of. Specifically, It is a legality Boolean matrix used to define the evolution logic of attack behavior on the timeline, and its dimensions are... ,in This represents the total number of pre-defined tactical intent phases in the system, such as "reconnaissance," "deployment," "execution," and "sabotage." Each element in the matrix... Essentially a Boolean switch, used to characterize the sequence from the preceding tactical phase. Leap to the subsequent tactical phase The causal legitimacy of this is based on the core physical meaning that attack behavior follows a specific evolutionary pattern in cyberspace, meaning that the attacker's tactical objective is usually unidirectional. For example, the evolution from "payload delivery" to "script execution" is logically coherent, and the elements at the corresponding positions in the matrix at this point... Set to 1; conversely, if the detected path shows a "physical destruction" event followed by a regression to "asset reconnaissance," this is usually a pseudo-correlated path formed by overlapping actions of different attackers or interference from background noise, which does not conform to the evolution logic of a single attack chain. In this case, the element at the corresponding position in the matrix... Then set it to 0. Traverse the original set of paths and calculate each path using a chained multiplication mechanism. Logical coherence score: in and This represents two adjacent nodes extracted from the original path sequence; It is to make nodes The intent label is mapped to the specific stage index in the CKC model.

[0090] Since matrix elements only take the values ​​0 or 1, this multiplication operation is essentially a veto-based logical filter. It will only apply if any pair of adjacent nodes in the path does not conform to the CKC's predefined rules (i.e., there is a "destruction"). (illegal reverse jump of "reconnaissance"), cumulative score of the entire path The value will immediately drop to 0. The algorithm will determine that the path is invalid and perform pruning operations, ultimately retaining only valid attack chains that conform to the attack evolution pattern. .

[0091] The cleaned effective paths are encapsulated into standardized attack chain objects, formally defined as follows: This object contains a chronologically ordered sequence of tactical nodes and the original quintuple evidence for each node. Finally, based on this structured object, a comprehensive attack timeline is generated, highlighting the attacker's lateral movement trajectory and the key springboard nodes leading to the final destruction, outputting a complete view of the source evidence.

[0092] In this implementation, to extract the most probable attack evolution path from the initial heterogeneous graph containing potential noise and bypass events, a logical pruning-based optimization step is introduced. First, starting from the origin endpoint in the graph, all possible paths leading to that endpoint are exhaustively searched using a reverse depth-first search, forming an initial path set. Then, a state transition matrix is ​​introduced to calculate the logical coherence function value of each initial path. This value reflects the rationality and coherence of the node sequence's evolution at the tactical intent level. If any pair of adjacent nodes in the path does not conform to the pre-defined pattern of the state transition matrix, the logical coherence function value of the entire path immediately drops to 0. Finally, paths with logical coherence function values ​​below a preset pruning threshold are considered logically incoherent or low-probability bypass branches and are removed from the graph. This pruning process retains only the logically coherent path from the initial node to the endpoint that best conforms to the attack evolution pattern, thereby significantly reducing the complexity of the graph and removing noise interference. The resulting heterogeneous graph can more clearly show the core chain process of malicious code attacks, greatly improving the efficiency and accuracy of security operations personnel in attack tracing and forensic analysis.

[0093] Please refer to Figure 3 The second embodiment of the present invention provides a power grid malicious code attack chain construction system based on multi-dimensional intent features, including: The data acquisition module 100 is used to collect raw behavioral data in the power grid industrial control operation environment, and then extract a five-tuple event stream from the raw behavioral data; The feature encoding module 200 is configured to, for each 5-tuple event in the 5-tuple event stream: obtain the industrial control operation field of each 5-tuple event and convert the industrial control operation field into a sparse vector; obtain the context payload field of each 5-tuple event and convert the context payload field into a dense vector; obtain the timestamp field and the subject identifier of each 5-tuple event and convert the timestamp field and the subject identifier into a real number vector; and fuse the sparse vector, the dense vector and the real number vector corresponding to each 5-tuple event to obtain a multidimensional intent feature tensor for each 5-tuple event. The intent recognition module 300 is used to obtain the final tactical intent label corresponding to each multi-dimensional intent feature tensor based on a preset industrial control business rule library and a preset malicious behavior fingerprint library, and then construct the atomic intent node of each multi-dimensional intent feature tensor based on the final tactical intent label. The sequence construction module 400 is used to traverse several atomic intent nodes according to time order, thereby grouping atomic intent nodes with the same corresponding subject identifier or conforming to the kill chain relationship into the same dynamic time window, and then obtaining several attack session sequences based on several dynamic time windows. The attack chain graph construction module 500 is used to construct an initial heterogeneous graph for each attack session sequence, and then generate an initial heterogeneous graph sequence based on several initial heterogeneous graphs. The attack chain graph pruning and reconstruction module 600 is used to perform logical pruning on the initial heterogeneous graph sequence to obtain the final heterogeneous graph, thereby completing the construction of the malicious code attack chain graph.

[0094] Further, the step of obtaining the industrial control operation field of each quintuple event and converting the industrial control operation field into a sparse vector includes: For any of the given quintuple events: Obtain the index number of the preset index library corresponding to the industrial control operation field; Based on the one-hot encoding principle, a sparse vector corresponding to the industrial control operation field is generated according to the index library and the index number.

[0095] Further, obtaining the context payload field of each quintuple event and converting the context payload field into a dense vector includes: For any of the given quintuple events: The context load field is segmented into several word feature sequences; Based on the feature hashing algorithm, the position and symbol of each word feature sequence in a 64-dimensional spatial vector are calculated; Based on the position and symbol of each word feature sequence in a 64-dimensional spatial vector, a 64-dimensional dense vector of the context payload field is generated.

[0096] Furthermore, for any of the multidimensional intent feature tensors: Boolean matching operation is performed on the sparse vector and the preset industrial control business rule base to obtain the Boolean matching operation result; If the result of the Boolean matching operation is not empty, the final tactical intent label is output based on the result of the Boolean matching operation. If the Boolean matching operation result is empty, then the cosine similarity between the dense vector and each standard center vector in the preset malicious behavior fingerprint database is calculated, and then the standard center vector whose cosine similarity satisfies the preset similarity threshold is output as the final tactical intent label.

[0097] The third embodiment of this invention proposes a method for constructing a malicious code attack chain for power grids based on multi-dimensional intent features. This embodiment is set in the "station control layer" and "process layer" network environment of a smart substation. The attack chain construction system of this invention is deployed in this environment, accessing switch traffic via bypass mirroring and equipped with a host log auditing plugin. Scenario description: One day, an attacker used an engineer's workstation (IP: 192.168.1.5) as a springboard to launch a malicious script that initiated an unauthorized circuit breaker tripping operation against the monitoring and control device (IP: 10.10.5.2). The system of this invention is responsible for reconstructing the complete attack chain from massive amounts of heterogeneous data.

[0098] First, the system in the time window The system collects the following five raw behavioral data in parallel. It then parses, removes the shell, and aligns the time of the raw unstructured data to extract key elements with security semantics, forming a standardized five-tuple event stream.

[0099] For the aforementioned quintuple events, a high-dimensional discrete orthogonal space is first constructed for the action type and operation object fields in the quintuple to capture the mutual exclusion of rigid business logic. Taking one type of industrial control attack event as an example, the system identifies its "action" as IEC104_Type46 (indicating that the action type is a tripping control operation performed on the industrial control object through the IEC104 protocol Type46) and its "object" as IOA:2001 (indicating that the address of the industrial control information object specified in the operation is 2001). By querying the global instruction index library and performing one-hot encoding, it maps it to a 128-dimensional sparse discrete vector. .

[0100] A continuous semantic space is constructed for the context load field in the quintuple to capture the morphological structure of flexible behavioral patterns.

[0101] Taking a host script event as an example, for its parameter path / tmp / iec104_fuzz.py --cmd OFF, the system first performs 3-Gram character-level sliding window segmentation to extract the sub-word sequence, namely "iec", "fuz", "cmd", and then uses feature hashing technology to project it into a 64-dimensional dense continuous vector. This embedding method effectively preserves the micro-semantic structure of the string. Even if an attacker attempts to evade detection by obfuscating the filename, the generated vector in Euclidean space still maintains a minimal distance with low distortion from the original vector, thus achieving fuzzy matching against variant attacks.

[0102] Perform the cascading and unified construction of multidimensional features. This is achieved by using sparse vectors representing the rigid logic described above. With dense vectors representing flexible semantics The data is concatenated, and the timestamp (encoded by trigonometric functions) and entity identifier (embedded by entity embedding) are further extracted from the quintuple and appended to the feature tail. The system outputs a standardized multidimensional intent feature tensor for each behavioral event. The multidimensional intent feature tensor It includes behavioral events E1, E2, E3, E4 and E5.

[0103] In a specific case, based on a rule base and an adaptive window mechanism, the abstract tensor stream is transformed into a semantically coherent attack session. For behavior event E4, the system calculates the cosine similarity between its continuous semantic components and the malicious fingerprint database. Since the calculated result of 0.92 is greater than the preset threshold of 0.85, the system classifies it as Execution. For behavior event E3, its discrete components hit the business whitelist, so it is directly classified as Benign. For behavior event E5, its discrete components hit the high-risk blacklist, so it is classified as Impact, with a confidence level set to 1.0. Finally, behavior events E1, E2, E3, E4, and E5 are transformed into graph nodes N. E1 N E2 N E3 N E4 and N E5 .

[0104] The system locks the main identifier 192.168.1.5 as the spatial anchor point and initializes the session window. When subsequent nodes... When (Resource_Dev, resource delivery intention) arrives, the system monitors its relationship with the preceding node in real time. The association between (Reconnaissance intent) and the determination that the two conform to the CKC kill chain (reconnaissance) is established. The sequential relationship of delivery; nodes belonging to high-risk intentions. (Impact, destructive intent) is added. Based on the above semantic consistency determination, the system automatically triggers the window expansion mechanism, breaking through the basic time threshold limitation, and extending the four key nodes spanning 4.8 seconds ( (Integrated into a single attack session sequence) This effectively prevents logical fragmentation caused by mechanical slicing during long-cycle attacks. At this point, the atomic intent node mapping graph temporarily includes E3 nodes as background noise.

[0105] Perform reverse backtracking and logical verification to remove noise from the graph. By traversing the graph, locate nodes with the intent to impact (destruct). As the endpoint for tracing the source, a reverse search is then performed along the directed edges, forming two paths: path A points to script execution (E4), and path B points to normal business operations (E3). This is achieved by introducing the CKC state transition matrix. Calculate the path score. For path A, verify "Execution (E4)". "Disruption (E5)" is deemed legitimate because it conforms to the attack evolution pattern; for path B, "Normal Business (E3)" is verified. "Destruction (E5)", due to the state matrix (Illegal transition) The system determines E3 to be spurious correlation noise and performs topology pruning. The final state matrix verification and pruning table is as follows: Table 1 State Matrix Verification and Pruning Table As shown in Table 1, for a path segment from an execution intent node (Execution) to an impact intent node (Impact), since the corresponding position in the state transition matrix is ​​1, it indicates that the transition conforms to the attack evolution pattern and is retained. For a path segment from a resource delivery intent node (Resource) to an execution intent node (Execution), since the corresponding position in the state transition matrix is ​​1, it indicates that the transition conforms to the attack evolution pattern and is retained. For a path segment from a reconnaissance intent node (Recon) to a resource delivery intent node (Resource), since the corresponding position in the state transition matrix is ​​1, it indicates that the transition conforms to the attack evolution pattern and is retained. For a path segment from a normal business intent node (Benign) to an impact intent node (Impact), the corresponding position in the state transition matrix is ​​0, indicating that the transition is an illegal transition. The path segment is determined to be pseudo-correlated noise, and a pruning operation is performed to remove the corresponding normal business intent node from the graph.

[0106] The system encapsulates the cleaned effective paths into standardized attack chain objects. These objects chronologically arrange the key nodes of each tactical stage and associate them with the original quintuple evidence, ultimately generating a final heterogeneous graph sequence and completing the construction of the malicious code attack chain graph.

[0107] The method and system for constructing a power grid malicious code attack chain based on multi-dimensional intent features provided by the present invention have at least the following advantages compared with the prior art: This invention constructs a feature decoupling representation architecture for heterogeneous data such as power grid industrial control traffic and host logs, used to distinguish and model the behavioral characteristics of different data attributes. Specifically, it adopts a parallel modeling approach of discrete logical features and continuous semantic features: features reflecting rigid control logic (such as function codes in the IEC104 protocol) are mapped to orthogonal discrete vectors through one-hot encoding to maintain the distinguishable relationship between different control commands in the feature space; simultaneously, features reflecting flexible behavioral patterns (such as shell script parameters) are embedded into the continuous vector space using N-Gram hashing to express the semantic similarity between text behaviors. Furthermore, a unified multidimensional intent feature tensor is constructed through feature concatenation and metadata embedding to achieve a unified expression of the characteristics of industrial control commands and the semantic features of host logs.

[0108] This invention proposes a semantic rule-oriented dynamic session aggregation method for organizing and associating attack behaviors across time stages. The method first utilizes an expert rule base to map underlying multidimensional features into atomic intent nodes with tactical meaning. Based on this, an adaptive spatiotemporal sliding window mechanism is introduced to determine the stage sequence relationship between nodes in the kill chain (CKC). When cross-window attack behaviors or high-risk intent nodes are identified, the current session window is extended, and related behaviors in adjacent time slices are associated through entity anchoring. Through this mechanism, session-level aggregation of semantically related but temporally discrete attack behaviors is achieved.

[0109] This invention constructs a critical path extraction method based on dynamic heterogeneous graph sequences, combining causal reverse backtracking and logical constraints. This method uses high-risk intent nodes with destructive or data-stealing attributes as logical endpoints, performing a reverse depth-first search under the condition of satisfying time irreversibility constraints. Simultaneously, a kill chain (CKC) state transition matrix is ​​introduced to verify the legality of stage transitions in candidate paths, and path branches that do not conform to preset stage evolution rules are pruned. Through the above methods, attack behavior paths are filtered and reconstructed, generating a structured attack chain representation.

[0110] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0111] The term "embodiment" as used herein means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described; however, any combination of these technical features that does not contradict each other should be considered within the scope of this specification.

[0112] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various improvements and substitutions without departing from the concept of this application, and these improvements and substitutions should also be considered within the scope of protection of this invention. Therefore, the scope of protection of this application should be determined by the appended claims.

Claims

1. A method for constructing a power grid malware attack chain based on multi-dimensional intent features, characterized in that, include: Raw behavioral data is collected from the power grid industrial control environment, and then a five-tuple event flow is extracted from the raw behavioral data; For each quintuple event in the quintuple event stream: obtain the industrial control operation field of each quintuple event and convert the industrial control operation field into a sparse vector; Obtain the context payload field for each quintuple event and convert the context payload field into a dense vector; obtain the timestamp field and subject identifier for each quintuple event and convert the timestamp field and subject identifier into a real number vector; The sparse vector, dense vector and real vector corresponding to each quintuple event are fused to obtain the multidimensional intent feature tensor of each quintuple event; Based on a preset industrial control business rule base and a preset malicious behavior fingerprint base, the final tactical intent label corresponding to each multi-dimensional intent feature tensor is obtained, and then the atomic intent node of each multi-dimensional intent feature tensor is constructed based on the final tactical intent label. By traversing several atomic intent nodes in chronological order, atomic intent nodes with the same subject identifier or that conform to the kill chain relationship are grouped into the same dynamic time window, and then several attack session sequences are obtained based on several dynamic time windows. Construct an initial heterogeneous graph for each of the attack session sequences, and then generate an initial heterogeneous graph sequence based on several of the initial heterogeneous graphs; Logical pruning is performed on the initial heterogeneous graph sequence to obtain the final heterogeneous graph, thus completing the construction of the malicious code attack chain graph.

2. The method for constructing a power grid malicious code attack chain based on multi-dimensional intent features according to claim 1, characterized in that, The step of obtaining the industrial control operation field for each quintuple event and converting the industrial control operation field into a sparse vector includes: For any of the given quintuple events: Obtain the index number of the preset index library corresponding to the industrial control operation field; Based on the one-hot encoding principle, a sparse vector corresponding to the industrial control operation field is generated according to the index library and the index number.

3. The method for constructing a power grid malicious code attack chain based on multi-dimensional intent features according to claim 1, characterized in that, The step of obtaining the context payload field for each quintuple event and converting the context payload field into a dense vector includes: For any of the given quintuple events: The context load field is segmented into several word feature sequences; Based on the feature hashing algorithm, the position and symbol of each word feature sequence in a 64-dimensional spatial vector are calculated; Based on the position and symbol of each word feature sequence in a 64-dimensional spatial vector, a 64-dimensional dense vector of the context payload field is generated.

4. The method for constructing a power grid malicious code attack chain based on multi-dimensional intent features according to claim 1, characterized in that, The process involves obtaining the final tactical intent label corresponding to each multidimensional intent feature tensor based on a preset industrial control business rule base and a preset malicious behavior fingerprint base, and then constructing atomic intent nodes for each multidimensional intent feature tensor based on the final tactical intent labels, including: For any of the aforementioned multidimensional intent feature tensors: Boolean matching operation is performed on the sparse vector and the preset industrial control business rule base to obtain the Boolean matching operation result; If the result of the Boolean matching operation is not empty, the final tactical intent label is output based on the result of the Boolean matching operation. If the Boolean matching operation result is empty, then the cosine similarity between the dense vector and each standard center vector in the preset malicious behavior fingerprint database is calculated, and then the standard center vector whose cosine similarity satisfies the preset similarity threshold is output as the final tactical intent label.

5. The method for constructing a power grid malicious code attack chain based on multi-dimensional intent features according to claim 1, characterized in that, The process involves traversing several atomic intent nodes in chronological order, grouping atomic intent nodes with identical subject identifiers or those conforming to kill chain relationships into the same dynamic time window, and then obtaining several attack session sequences based on these dynamic time windows, including: For any of the aforementioned atomic intent nodes: Extract several preceding nodes of the atomic intent node from the remaining atomic intent nodes; If the subject identifier corresponding to the atomic intent node is consistent with that of any of the preceding nodes, and the dynamic time window corresponding to the preceding node is in an active state, then the atomic intent node is assigned to the dynamic time window corresponding to the preceding node; otherwise, the kill chain relationship between the atomic intent node and any of the preceding nodes is further analyzed. If the atomic intent node and any of the preceding nodes conform to the kill chain association relationship, then the atomic intent node is assigned to the dynamic time window corresponding to the preceding node; otherwise, a new dynamic time window is created based on the atomic intent node.

6. The method for constructing a power grid malicious code attack chain based on multi-dimensional intent features according to claim 1, characterized in that, The step of logically pruning the initial heterogeneous spectrum sequence to obtain the final heterogeneous spectrum includes: Obtain the origin endpoint of the initial heterogeneous spectral sequence; A reverse depth-first search is performed based on the source endpoint to obtain the original path set; Obtain the state transition matrix, and then calculate the logical coherence function value of each original path in the original path set based on the state transition matrix; The original paths whose corresponding logical coherence function values ​​meet the preset pruning threshold are pruned and removed from the initial heterogeneous graph sequence to obtain the final heterogeneous graph.

7. A system for constructing a power grid malware attack chain based on multi-dimensional intent features, characterized in that, include: The data acquisition module is used to collect raw behavioral data in the power grid industrial control environment, and then extract the five-tuple event stream from the raw behavioral data; The feature encoding module is used for each 5-tuple event in the 5-tuple event stream to: obtain the industrial control operation field of each 5-tuple event and convert the industrial control operation field into a sparse vector; obtain the context payload field of each 5-tuple event and convert the context payload field into a dense vector; obtain the timestamp field and the subject identifier of each 5-tuple event and convert the timestamp field and the subject identifier into a real number vector; and fuse the sparse vector, the dense vector and the real number vector corresponding to each 5-tuple event to obtain a multidimensional intent feature tensor for each 5-tuple event. The intent recognition module is used to obtain the final tactical intent label corresponding to each multidimensional intent feature tensor based on a preset industrial control business rule library and a preset malicious behavior fingerprint library, and then construct the atomic intent node of each multidimensional intent feature tensor based on the final tactical intent label. The sequence construction module is used to traverse several atomic intent nodes in chronological order, thereby grouping atomic intent nodes with the same subject identifier or that conform to the kill chain relationship into the same dynamic time window, and then obtaining several attack session sequences based on several dynamic time windows. An attack chain graph construction module is used to construct an initial heterogeneous graph for each attack session sequence, and then generate an initial heterogeneous graph sequence based on several initial heterogeneous graphs. The attack chain graph pruning and reconstruction module is used to perform logical pruning on the initial heterogeneous graph sequence to obtain the final heterogeneous graph, thus completing the construction of the malicious code attack chain graph.

8. The power grid malicious code attack chain construction system based on multi-dimensional intent features according to claim 7, characterized in that, The step of obtaining the industrial control operation field for each quintuple event and converting the industrial control operation field into a sparse vector includes: For any of the given quintuple events: Obtain the index number of the preset index library corresponding to the industrial control operation field; Based on the one-hot encoding principle, a sparse vector corresponding to the industrial control operation field is generated according to the index library and the index number.

9. The power grid malicious code attack chain construction system based on multi-dimensional intent features according to claim 7, characterized in that, The step of obtaining the context payload field for each quintuple event and converting the context payload field into a dense vector includes: For any of the given quintuple events: The context load field is segmented into several word feature sequences; Based on the feature hashing algorithm, the position and symbol of each word feature sequence in a 64-dimensional spatial vector are calculated; Based on the position and symbol of each word feature sequence in a 64-dimensional spatial vector, a 64-dimensional dense vector of the context payload field is generated.

10. The power grid malicious code attack chain construction system based on multi-dimensional intent features according to claim 7, characterized in that, For any of the multidimensional intent feature tensors: Boolean matching operation is performed on the sparse vector and the preset industrial control business rule base to obtain the Boolean matching operation result; If the result of the Boolean matching operation is not empty, the final tactical intent label is output based on the result of the Boolean matching operation. If the Boolean matching operation result is empty, then the cosine similarity between the dense vector and each standard center vector in the preset malicious behavior fingerprint database is calculated, and then the standard center vector whose cosine similarity satisfies the preset similarity threshold is output as the final tactical intent label.

Images