A method and device for power terminal link hidden dyeing and in-line detection

Abstract

This invention provides a method and apparatus for covert coloring and flow-following detection of power terminal links. The method includes: setting a dual-state baseline for power terminal probes; generating probe data packets when the network deteriorates; serializing and encoding the probe data packets and encapsulating them into a service message, which is then sent to the cloud through a pre-registered whitelist port; extracting the coloring payload in the cloud; setting a cloud analysis sliding window; calculating the real-time dynamic information entropy within the cloud analysis sliding window and combining it with the average packet length and packet interval of the real-time extracted cloud-received probe data packets to calculate the multi-dimensional feature deviation; determining a security risk when the real-time dynamic information entropy changes abnormally and the multi-dimensional feature deviation exceeds a security threshold. This method can legally penetrate the network without changing the existing security policy of the power defense-in-depth gateway, accurately capture instantaneous network faults with extremely low power consumption, and achieve tamper-proof security early warning using the probe traffic itself.

Description

Technical Field

[0001] This invention relates to the field of power Internet of Things, communication measurement technology and network security monitoring, and in particular to a method and device for covert coloring and flow-following detection of power terminal links. Background Technology

[0002] With the comprehensive advancement of the construction of new power systems, a massive number of power Internet of Things (IoT) terminals are being widely deployed at the end of the power grid. These terminals typically operate in complex scenarios characterized by extremely dispersed geographical locations, harsh electromagnetic environments, and highly heterogeneous communication standards. The stability, low latency, and high security of communication links are directly related to the continuity of power production operations and the absolute safety of power grid operation.

[0003] To achieve high-precision end-to-end network quality monitoring, current flow-following detection technology is widely used to measure link latency and packet loss rate. However, most existing technologies directly apply network-layer flow-following detection technology to private networks in the power industry, facing significant technical challenges and limitations.

[0004] Following-the-flow detection technology relies heavily on brute-force modifications to the underlying network protocol stack. However, to prevent external network attacks, the power industry has deployed robust physical isolation devices, forward and reverse isolation gateways, and industrial-grade firewalls with DPI (Deep Packet Inspection) capabilities between the information control zone and the production control zone. These security devices employ extremely strict whitelisting mechanisms and strong protocol compliance checks. Any IP packets with non-standard extension headers, abnormally long TCP options, or unknown probe traffic transmitted using unreported ports are judged as malformed packets or illegal network scans and are directly intercepted and discarded. Following-the-flow detection based on the network layer not only cannot penetrate the power security isolation zone but also completely fails to reflect the most accurate business data transmission path.

[0005] Existing flow detection solutions, in pursuit of real-time and fine-grained network monitoring, mostly employ high-frequency packet transmission or indiscriminate full-packet coloring of service packets flowing through network devices. However, the CPU computing power, memory capacity, and uplink wireless network bandwidth resources of massive power edge IoT terminals are often extremely limited. Continuously enabling high-frequency detection will not only severely squeeze normal production service bandwidth and cause network congestion, but also result in high power consumption for devices. On the other hand, using traditional low-frequency detection will leave the system in a monitoring blind spot at the moment network congestion or failure occurs, making it impossible to capture on-site data in a timely manner.

[0006] Existing flow detection technology architectures ultimately aim only at measuring basic network connectivity and performance metrics such as latency and packet loss rate. They lack the ability to detect the security attributes of the actual content carried within packets in today's increasingly complex security environment and therefore lack early warning capabilities.

[0007] Therefore, it is necessary to provide a flow detection method suitable for network quality monitoring in complex scenarios. Summary of the Invention

[0008] The purpose of this invention is to provide a method and apparatus for covert coloring and flow-following detection of power terminal links, which can be used to monitor network quality and provide security early warning in complex power communication scenarios.

[0009] In a first aspect, the power terminal link covert coloring and flow-following detection method provided by the present invention includes: setting the power terminal probe to operate in a dual-state baseline mode to trigger the active state of the network layer and count the number of transmitted service data packets; the power terminal monitors the data retransmission rate and signal strength changes based on a set sliding time window; when the data retransmission rate or signal strength change reaches a preset network degradation judgment condition, a probe data packet is generated, which includes coloring data and a signature magic number; the probe data packet is serialized and encoded, then encapsulated into a service message, and sent to the cloud through a pre-registered whitelist port; the cloud receives the network data sent by the power terminal. The system analyzes network data streams and parses the TCP / IP quintuple within them. It filters network data streams by whitelisted ports, locates the magic number of the signature code within the data stream to mark the colored streams, and performs deserialization and decoding on the marked streams to extract the colored payload. A cloud analysis sliding window is set up, and the byte probability distribution of the colored payload is statistically analyzed within this window. Real-time dynamic information entropy is calculated based on the byte probability distribution, and multi-dimensional feature deviation is calculated by combining the average packet length and packet interval of the cloud-received probe data packets extracted in real time. When the real-time dynamic information entropy changes abnormally and the multi-dimensional feature deviation exceeds a security threshold, a security risk is identified, and an active warning is triggered.

[0010] The beneficial effects of the power terminal link covert coloring and flow detection method provided by the present invention are: it can legally penetrate the network without changing the existing security strategy of the power defense-in-depth gateway, accurately capture instantaneous network faults with extremely low power consumption, and realize anti-tampering security early warning by using the detection traffic itself.

[0011] In one possible embodiment, the dual-state baseline mode operation of the power terminal probe includes running a low-frequency heartbeat mode and a silent listening mode. The low-frequency heartbeat mode operation process includes: the power terminal probe establishing an independent timer to send pure protocol keep-alive frames to the cloud according to a set sending period to trigger the active state of the network layer and maintain the physical connection activity of the transmission link; the silent listening mode operation process includes: the power terminal probe using eBPF technology to mount a custom hook function on the operating system to count the number of service data packets transmitted and store the counting result in a shared memory structure.

[0012] In another possible embodiment, the power terminal calculates the real-time data retransmission rate of service data packets based on the total number of sent and retransmitted service data packets extracted from the shared memory structure. At the same time, a baseline mean is maintained based on historical data. and standard deviation ,when When the data retransmission rate changes to a preset network degradation threshold, the original radio signal is obtained through the operating system's underlying wireless module driver interface, and the signal smoothing value for each sliding time window is calculated. , Indicates the first The signal smoothing value for a sliding time window, Represents the smoothing coefficient. Indicates the first The original radio signals are collected in a sliding time window; the difference in signal smoothing value between adjacent sliding time windows is compared, and when the difference in signal smoothing value is greater than the preset step drop threshold, the signal strength change reaches the preset network degradation judgment condition.

[0013] In other possible embodiments, the probe data packet is serialized and encoded before being encapsulated into a service message, including: concatenating the data in the probe data packet into a binary byte array according to a predefined data structure after serialization, encoding the binary byte array; filling the encoded string into a JSON structure object that conforms to the known service specifications of the power Internet of Things, and using the filled JSON structure object as the payload of the message.

[0014] The cloud analyzes the TCP / IP 5-tuple in the received network data stream and intercepts network data streams whose destination port is a whitelisted port. It searches for the magic number of the probe data packet in the intercepted data stream and marks the corresponding network data stream as a colored stream based on the magic number. The colored stream is sent to a deep processing queue to perform JSON text parsing to extract specific fields. The extracted specific fields are decoded and deserialized into binary to extract the colored payload.

[0015] The coloring data includes UUIDs; the byte probability distribution of the coloring payload is statistically analyzed within the cloud analysis sliding window, including: aggregating the binary byte stream data of all extracted coloring payloads under the same UUID within the cloud analysis sliding window; scanning byte by byte, counting the total frequency of each byte value, and dividing the total frequency of each byte value by the total number of bytes within the cloud analysis sliding window to obtain the byte probability distribution of each byte value.

[0016] Calculate the real-time dynamic information entropy of the staining payload within the sliding window of cloud analysis using the Shannon entropy formula: , Represents real-time dynamic information entropy. Indicates byte value The byte probability distribution; real-time extraction of the average packet length and packet interval of the colored stream, combined with real-time dynamic information entropy, average packet length, and packet interval to calculate multi-dimensional feature deviation: , Indicates the first Multidimensional feature deviation of a cloud-based analysis sliding window. Indicates the first The first cloud analytics sliding window The value of each feature, Represents the feature weight coefficients. This indicates the first [number] determined based on historical data. The baseline mean of each feature, This indicates the first [number] determined based on historical data. The standard deviation of each feature, in Time The three features represent real-time dynamic information entropy, average packet length, and packet sending interval, respectively.

[0017] Abnormal changes in real-time dynamic information entropy and deviations of multidimensional features exceeding the safety threshold include: and , Represents the baseline information entropy. This represents the information entropy tolerance bias. This indicates the safety threshold.

[0018] Secondly, the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-described method for covert coloring and flow-following detection of power terminal links.

[0019] Thirdly, the present invention also provides an electronic device, comprising: a processor and a memory; the memory being used to store a computer program; the processor being used to execute the computer program stored in the memory, so that the electronic device performs the above-described power terminal link covert staining and flow-following detection method.

[0020] For the beneficial effects of the second and third aspects mentioned above, please refer to the description of the first aspect mentioned above. Attached Figure Description

[0021] Figure 1 A flowchart illustrating a method for covert staining and flow-following detection of power terminal links provided in an embodiment of the present invention;

[0022] Figure 2 A schematic diagram illustrating the process of monitoring network security based on extracted staining data, provided in an embodiment of the present invention;

[0023] Figure 3 This is a schematic diagram of an electronic device structure provided in an embodiment of the present invention. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions in the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention. Unless otherwise defined, the technical or scientific terms used herein should have the ordinary meaning understood by those skilled in the art. The terms "comprising" and similar expressions used herein mean that the element or object preceding the word covers the element or object listed following the word and its equivalents, but do not exclude other elements or objects.

[0025] This embodiment provides a method for covert staining and current-following detection of power terminal links. See also Figure 1 The method includes:

[0026] S101: The power terminal probe is set to run in dual-state baseline mode to trigger the active state of the network layer and count the number of service data packets transmitted. The power terminal monitors the data retransmission rate and signal strength changes based on the set sliding time window. When the data retransmission rate or signal strength change reaches the preset network degradation judgment condition, a probe data packet is generated. The probe data packet includes colored data and signature magic number.

[0027] In one possible embodiment, the dual-state baseline operation mode of the power terminal probe includes a low-frequency heartbeat mode and a silent monitoring mode. The low-frequency heartbeat mode operation includes: the power terminal probe establishing an independent timer to send pure protocol keep-alive frames to the cloud according to a set sending period to trigger the active state of the network layer and maintain the physical connection activity of the transmission link. The silent monitoring mode operation includes: the power terminal probe using eBPF technology to mount a custom hook function on the operating system to count the number of transmitted service data packets and store the counting results in a shared memory structure. The pure protocol keep-alive frame is a message containing only a small number of bytes of fixed protocol header. The purpose of sending the pure protocol keep-alive frame is to trigger the active state of the network layer with a small number of bytes, ensuring that the TCP session NAT (Network Address Translation) entries of the operator's base stations, firewalls, and internal network gateways along the route are not aged out and discarded, thus maintaining the physical connection activity of the transmission link.

[0028] The power terminal calculates the real-time data retransmission rate of service data packets based on the total number of sent and retransmitted service data packets extracted from the shared memory structure. At the same time, the baseline mean is determined based on historical data. and standard deviation ,when When the data retransmission rate reaches the preset network degradation judgment condition; the original radio signal is obtained through the operating system's underlying wireless module driver interface, and the signal smoothing value for each sliding time window is calculated. , Indicates the first The signal smoothing value for a sliding time window, Represents the smoothing coefficient. Indicates the first The original radio signals are collected in a sliding time window; the difference in signal smoothing value between adjacent sliding time windows is compared, and when the difference in signal smoothing value is greater than the preset step drop threshold, the signal strength change reaches the preset network degradation judgment condition.

[0029] The raw radio signal specifically refers to the raw radio received signal strength indication of the power terminal wireless communication module. This raw radio signal is the underlying data source and calculation basis for signal strength changes.

[0030] In one specific embodiment, the low-frequency heartbeat mode is designed as follows: After the power terminal probe starts in the background, it allocates a very small amount of system memory to establish an independent timer. When the timer reaches its trigger time, the probe calls the underlying Socket API to send a protocol keep-alive heartbeat (MQTT PINGREQ) containing only 2 bytes (e.g., 0xC0 0x00) to the cloud. The protocol keep-alive heartbeat does not carry any additional business data or probe payload, and its impact on bandwidth is almost zero. The purpose of periodically sending the protocol keep-alive heartbeat is to periodically stimulate the mobile core network (UPF / PGW) and power grid boundary security firewalls along the physical link of data transmission, refresh the timestamps of the transport session (TCP / UDP) network address translation (NAT) mapping table, and prevent the physical link from being forcibly reclaimed and cut off by network devices due to prolonged lack of data interaction.

[0031] The design of the silent monitoring mode involves integrating a miniature eBPF (Extended Berkeley Packet Filter) bytecode within the probe program. This eBPF program is then mounted onto a key function of the Linux operating system's kernel network protocol stack via system calls. The key function is a functionally named feature in the engineering process, and the core criteria for determining a key function are: it must be a path-dependent feature, it can obtain the complete skb (struct sk_buff) structure data, and it can observe collisions / errors / retransmissions. eBPF performs atomic-level counting of collisions, errors, and retransmissions in the real business data stream directly in kernel space and stores the statistical results in a high-efficiency shared-memory structure, BPF Map. The user-space probe only needs to periodically read the BPF Map to obtain the actual underlying network overhead. In the silent monitoring mode, the probe is absolutely "silent," never actively generating or sending any probe packets. Applying this mode to obtain the actual underlying network overhead completely avoids the high context switching and data copying CPU overhead of traditional packet capture schemes.

[0032] The probe sets a sliding time window at the terminal transport layer and continuously extracts the total number of underlying packets sent within the window from the BPFMap based on the length of the sliding time window. Total number of retransmissions Calculate the real-time retransmission rate : Meanwhile, the system maintains a baseline mean in the background based on historical data. and standard deviation When the judgment When the data retransmission rate reaches the preset network degradation judgment condition, network degradation is confirmed, triggering the generation and processing of probe data packets.

[0033] Since the raw radio signals read through the underlying network card driver interface often contain severe high-frequency noise and glitches, direct use is prone to false alarms. This embodiment employs an exponential moving average (EMA) algorithm to smooth the raw radio signals, obtaining a smoothed signal value. This smoothed signal value is then used to determine whether the signal strength has deteriorated. Specifically, the smoothed signal value is calculated according to the following formula: , Indicates the first The signal smoothing value for a sliding time window, Represents the smoothing coefficient. Indicates the first Raw radio signals acquired within a sliding time window, Indicates the first The signal smoothing value is calculated for each sliding time window. The difference in signal smoothing values ​​between adjacent sliding time windows is compared. If the difference in signal smoothing values ​​exceeds a preset step descent threshold, a threshold is set. ,Right now When the signal strength change reaches a preset network degradation judgment condition, it confirms that the wireless link has suffered severe fading, triggering the generation of probe data packets. In one possible embodiment, a configuration is set... for .

[0034] When the data retransmission rate is satisfied Or signal strength change When any of the following deterioration conditions occur, the power terminal instantly generates a probe data packet containing the probe's unique fingerprint UUID, an incrementing sequence, a high-precision nanosecond-level timestamp, and a magic number, ready to be sent.

[0035] S102: Serialize and encode the probe data packets, encapsulate them into a business message, and send them to the cloud through a pre-registered whitelist port.

[0036] In one possible embodiment, the probe data packet is serialized and encoded before being encapsulated into a service message, including: serializing the data in the probe data packet and concatenating it into a binary byte array according to a predefined data structure; encoding the binary byte array; filling the encoded string into a JSON structure object that conforms to the conventional business specifications of the power Internet of Things; and using the filled JSON structure object as the coloring payload of the message.

[0037] In one specific embodiment, the data (UUID, Sequence, Timestamp, Magic Number) in the generated probe data packet is serialized and concatenated into binary byte data according to a predefined data structure. This binary byte value is then Base64 or Hex string encoded to completely convert special binary characters that might cause misjudgments by the underlying firewall protocol into regular ASCII printable characters, eliminating the abnormal data characteristics of the probe packet. The encoded string is then used as a valid value to fill a JSON structure object conforming to the regular business specifications of the power IoT (e.g., disguised as regular temperature and humidity telemetry data or status reports from terminal devices). This JSON structure object filled with the encoded string is placed in a valid Payload field as the message's payload and reported, specifically by sending it to the cloud through a business whitelist port that has been extracted and registered from the security management center. Through the design of this embodiment, when a packet flows through a security gateway with a Deep Packet Inspection (DPI) parsing engine, the gateway will unpack the packet layer by layer to confirm that the IP five-tuple is correct, the transmission port is compliant, and the payload is a standard JSON text structure. Ultimately, the security gateway will determine that this is a fully compliant IoT production data and allow it to pass, thereby solving the technical problem that traditional flow detection is directly blocked at the boundary.

[0038] For example, filling the encoded string as a valid value into a JSON structure object that conforms to the regular business specifications of the power Internet of Things can be done by constructing a JSON text of the form {"msg_type":"heartbeat", "device_id":"[UUID]","payload_data":"[Base64 encoded string]"}. Then, this JSON text is used as the payload of an MQTTPublish message and sent to the cloud through a business whitelist port pre-registered in the firewall using the standard TCP Socket API of the operating system. This is to circumvent the deep validation (DPI) of the application layer message by the security gateway, thereby achieving feature concealment and transparent penetration.

[0039] S103: The cloud receives network data streams sent by power terminals and parses the TCP / IP 5-tuple in the network data streams. It filters the network data streams by whitelisted ports, locates the magic number of the feature code in the network data streams to mark the colored streams, and performs deserialization and decoding processing on the marked colored streams to extract the colored payload.

[0040] In one possible embodiment, the cloud receives network data streams sent by power terminals and parses the TCP / IP 5-tuple in the received network data streams, intercepting network data streams whose destination port is a port in the whitelist; it searches for the signature magic number of probe packets in the intercepted network data streams, and marks the corresponding network data streams as colored streams according to the signature magic number; it sends the colored streams to a deep processing queue to perform JSON text parsing to extract specific fields, and decodes and deserializes the extracted specific fields to extract the colored payload.

[0041] For example, the TCP / IP 5-tuple in a network data stream specifically includes the source IP address, destination IP address, transport layer protocol, source port, and destination port.

[0042] In one specific embodiment, the cloud will receive a massive amount of mixed traffic from simultaneous service and probe reports from terminals. To prevent deep feature matching from dragging down the performance of the cloud server, this embodiment designs a three-level efficient pipeline processing mechanism to extract the coloring data:

[0043] The cloud-based receiving server receives network data streams using RSS (Receive Side Scaling) or Data Plane Development Kit (DPDK) bypass packet reception technology based on the network card. It quickly discards other background traffic by parsing the network layer 5-tuple, intercepting only network data streams whose destination port is a whitelisted port. The intercepted network data streams are then scanned using a multi-pattern string matching algorithm to find the characteristic magic number of the probe packets, marking the corresponding network data streams as colored streams. Only successfully marked colored streams are sent to the backend deep processing cluster for deserialization and decoding, stripping away the external disguise and restoring the colored payload (UUID, Sequence, Timestamp fields) in plaintext.

[0044] For example, if the whitelist port for the probe packet is 1883 and the magic number is 0x9a4d2e1f, and the probe packet is encapsulated into a service message using Base64 encoding to encode the binary byte stream, the specific process of extracting the colored data using the three-level high-efficiency pipeline processing mechanism designed in this embodiment includes: parsing the network layer 5-tuple based on the network card's RSS or introducing DPDK bypass packet reception technology, quickly discarding other background traffic, and only intercepting the critical service TCP traffic pool with the destination port 1883; using the Aho-Corasick multi-pattern string matching algorithm, without performing a full memory copy, directly scanning the TCP data payload byte stream in the intercepted traffic pool to quickly find the magic number feature of the probe packet (the Base64 string corresponding to 0x9a4d2e1f), and marking the corresponding network flow as a high-priority colored flow as long as the feature string is matched; only this part of the successfully marked colored flow is sent to the backend deep processing cluster. The cluster performs standard JSON deserialization and Base64 decoding, stripping away the external disguise and restoring and extracting the UUID, Sequence, and Timestamp fields in plaintext.

[0045] S104: Set a cloud analysis sliding window, statistically analyze the byte probability distribution of the coloring payload within the cloud analysis sliding window, calculate the real-time dynamic information entropy based on the byte probability distribution, and calculate the multi-dimensional feature deviation by combining the average packet length and packet interval of the cloud received probe data packets extracted in real time. When the real-time dynamic information entropy changes abnormally and the multi-dimensional feature deviation exceeds the safety threshold, it is determined that there is a security risk.

[0046] In one possible embodiment, the byte probability distribution of the colorized payload is statistically analyzed within the cloud analysis sliding window, including: aggregating the binary byte stream data of all extracted colorized payloads under the same UUID within the cloud analysis sliding window; scanning byte by byte, counting the total frequency of each byte value, and dividing the total frequency of each byte value by the total number of bytes within the cloud analysis sliding window to obtain the byte probability distribution of each byte value.

[0047] Calculate the real-time dynamic information entropy of the staining payload within the sliding window of cloud analysis using the Shannon entropy formula: , Represents real-time dynamic information entropy. Indicates byte value The byte probability distribution; real-time extraction of the average packet length and packet interval of the colored stream, combined with real-time dynamic information entropy, average packet length, and packet interval to calculate multi-dimensional feature deviation: , Indicates the first Multidimensional feature deviation of a cloud-based analysis sliding window. Indicates the first The first cloud analytics sliding window The value of each feature, Represents the feature weight coefficients. This indicates the first [number] determined based on historical data. The baseline mean of each feature, This indicates the first [number] determined based on historical data. The standard deviation of each feature, in Time The three features represent real-time dynamic information entropy, average packet length, and packet sending interval, respectively.

[0048] Abnormal changes in real-time dynamic information entropy and deviations of multidimensional features exceeding the safety threshold include: and , This represents the baseline entropy, specifically the baseline entropy under normal system conditions. It is used to compare with the real-time entropy value to determine whether the current behavior deviates from the normal pattern. This represents the information entropy tolerance bias. This indicates the safety threshold.

[0049] In one specific embodiment, after the cloud extracts the color payload from the received message, the extracted data is transformed into core operation and maintenance indicators and used for monitoring network security.

[0050] Specifically, converting the extracted data into core operational metrics includes: immediately adding a local receiving timestamp to the cloud the instant the extracted color payload processing is completed. Calculate latency for: ,in, This indicates the start timestamp, which is added to the power terminal after the probe data packet is generated but before it is encapsulated into an application layer message. This indicates the time taken for the cloud to process probe data packets internally. Since the starting timestamp is embedded before the probe data packets are packaged into a disguised application-layer message, RTT not only includes network transmission latency but also objectively reflects the time spent on terminal protocol stack encapsulation and gateway processing, providing the most accurate end-to-end application-layer latency. The packet loss rate is calculated based on the extracted sequence numbers: Within the statistical period for calculating the packet loss rate, the largest sequence number obtained is found from the sequence number sequences extracted under the same UUID. and minimum sequence number Since the sequence number is strictly incremental, the theoretical total number of packets should be... Compare the number of deduplicated and colorized packages actually received by the cloud during the statistical period. This allows for accurate calculation of the actual packet loss rate of the link during this period, effectively avoiding misjudgments of packet loss rate caused by out-of-order arrival of network packets. Among these factors is the number of deduplicated and colored packets. Within a defined UUID range, the number of unique serial numbers is determined by the absolute number of deduplication results actually received in the cloud within a statistical period.

[0051] See Figure 2 Monitoring network security using extracted data includes: setting up a cloud analysis sliding window, aggregating binary byte stream data of plaintext-colored payloads extracted under the same UUID within the cloud analysis sliding window, and scanning byte by byte to statistically analyze the value of each byte. The probability distribution of a byte is obtained by dividing the total frequency of occurrence by the total number of bytes within the cloud analysis sliding window. .

[0052] Calculate the real-time dynamic information entropy of the staining payload within the sliding window of cloud analysis using the Shannon entropy formula: , Represents real-time dynamic information entropy. Indicates byte value The byte probability distribution.

[0053] Furthermore, to enhance the robustness of network security determination, this embodiment also includes: real-time extraction of the average packet length and packet interval of the colored stream; using the extracted average packet length, packet interval, and real-time dynamic information entropy to form a three-dimensional feature vector; and calculating the multidimensional feature deviation of the above three-dimensional feature vector. , Indicates the first Multidimensional feature deviation of a cloud-based analysis sliding window. Indicates the first The first cloud analytics sliding window The value of each feature, Represents the feature weight coefficients. This indicates the first [number] determined based on historical data. The baseline mean of each feature, This indicates the first [number] determined based on historical data. The standard deviation of each feature, in Time The three features represent real-time dynamic information entropy, average packet length, and packet transmission interval, respectively. The mean and variance are derived from a historical baseline database trained during a safe period.

[0054] It should be noted that the historical baseline database is based on normal colored stream data packets generated on specific monitoring links during the initial deployment phase of the business or during a historical benchmark period of normal operation without network attacks. It collects the packet payload length and arrival timestamps of the colored streams within this normal period, and generates historical sample data using an information entropy algorithm. During safe periods, the system extracts the historical information entropy, average packet length, and packet interval for each window using a sliding window approach. Subsequently, it calculates the arithmetic mean of the observed values ​​for each feature in the entire historical sample set as the baseline mean, and calculates its standard deviation (the square root of the variance) as the baseline standard deviation. When calculating the deviation of multidimensional features, the applied mean and variance use the UUID of the colored stream and its time period as the association index, accurately retrieving and calling dedicated baseline data aligned with both its identity and time from the historical baseline database.

[0055] Because the probe data packets legitimately constructed by power terminals mainly consist of nanosecond-level high-precision timestamps, non-repeating sequence numbers, and pseudo-random interference bits, their overall randomness is extremely high. Therefore, under normal communication conditions, their theoretical information entropy usually stabilizes at a level close to its maximum. Network security can be monitored by monitoring real-time dynamic information entropy. That is, when the link is hijacked by a man-in-the-middle (MITM), subjected to the insertion of regular malicious code, or intercepted and tampered with, its random distribution characteristics will be disrupted, inevitably leading to a decrease in real-time dynamic information entropy. A sudden, precipitous drop occurred. Therefore, it is defined as when a sudden drop is detected. and When a highly concealed security intrusion is detected, a network-wide proactive early warning is triggered.

[0056] This embodiment reflects the performance anomalies in the transmission process through RTT and packet loss rate, and combines them with features such as real-time dynamic information entropy to jointly determine whether there is any MITM tampering or data leakage behavior, thus achieving accurate proactive early warning.

[0057] In one possible implementation, the cloud analytics sliding window can be set to a set time length (e.g., 5 seconds) or to accumulate a certain amount of data. The value space of the extracted plaintext colored payload binary byte stream data is 0x00 to 0xFF, with each byte taking a value of... The value range is 0-255.

[0058] The power terminal link covert coloring and flow-following detection method provided by this invention completely abandons the traditional approach of modifying the underlying protocol stack of the network layer:

[0059] This dual-state architecture, employing both low-frequency heartbeat and silent monitoring modes, revolutionizes the traditional continuous packet-sending probe approach. Instead of using packet capture tools like libpcap (which incurs significant kernel-to-user space memory copy overhead), it introduces eBPF technology. The probe program mounts an eBPF hook onto the operating system's underlying protocol stack, directly counting hits in the kernel space for retransmission functions. Only the calculated statistical results are asynchronously mapped to the user-space program via a BPF map. Simultaneously, it maintains the NAT mapping relationship of the base station or firewall by sending pure protocol keep-alive frames at extremely low frequencies. This solves the challenges of resource constraints and persistent monitoring, achieving precise low-level state perception with zero network packet overhead and zero packet data copying. It overcomes the bottleneck of continuous monitoring for resource-constrained terminals with minimal system cost and provides highly accurate real-time criteria support for subsequent proactive coloring triggering.

[0060] To address the stringent DPI (Deep Packet Inspection) interception challenges of power security gateways, the probe packets are encapsulated into a legitimate upload message that appears perfectly compliant with business specifications to the firewall and DPI engine. Its format, protocol characteristics, and port all perfectly conform to security whitelist rules. Without requiring the power grid information department to modify the ACL (Access Control List) policies of any network devices, "seamless and transparent penetration" of strict security isolation systems can be achieved. This ensures that the probe packets and real production business data undergo the exact same transmission path, and the measured metrics best reflect the actual business experience.

[0061] In the concealed coloring and flow-following detection method for power terminal links, the hidden coloring stream itself is regarded as a decoy probe with a known theoretical probability distribution. A sliding window byte probability statistical method is designed to calculate information entropy using Shannon's formula, while multi-dimensional feature deviation is calculated using average packet length and packet interval. A high-precision nanosecond-level timestamp and pseudo-random padding data are injected into the legitimate probe before packet transmission, ensuring that the probability distribution of the coloring stream's payload within the byte space is relatively uniform during normal transmission, and the information entropy is close to the extreme high bit. However, when the communication link is hijacked by a man-in-the-middle, forcibly injected with regular malicious code, or maliciously intercepted and tampered with, this external regular or repetitive data will inevitably disrupt the original highly random probability distribution instantly, leading to a decrease in the real-time calculated information entropy. It exhibits the characteristic of unexpected, precipitous drops. By monitoring both the sudden drop in information entropy and the deviation from the baseline exceeding the limit, the system can instantly trigger a pre-emptive security warning before an extremely covert attack causes substantial catastrophic damage to the business system, thus achieving the integration of performance monitoring and security defense.

[0062] In other embodiments of this application, an electronic device is disclosed, such as... Figure 3 As shown, the electronic device 300 may include: one or more processors 301; a memory 302; a display 303; one or more application programs (not shown); and one or more computer programs 304. These devices can be connected via one or more communication buses 305. The one or more computer programs 304 are stored in the memory and configured to be executed by the one or more processors 301. The one or more computer programs 304 include instructions that can be used to perform actions such as... Figure 1 And the steps in the corresponding embodiments.

[0063] Through the above description of the embodiments, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0064] In the embodiments of this application, the functional units can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0065] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, essentially, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as flash memory, portable hard disk, read-only memory, random access memory, magnetic disk, or optical disk.

[0066] The above description is merely a specific implementation of the embodiments of this application, but the protection scope of the embodiments of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the embodiments of this application should be covered within the protection scope of the embodiments of this application. Therefore, the protection scope of the embodiments of this application should be determined by the protection scope of the claims.

Claims

1. A method for covert staining and current-following detection of power terminal links, characterized in that, include: The power terminal probe is set to run in dual-state baseline mode to trigger the active state of the network layer and count the number of service data packets transmitted. The power terminal monitors the data retransmission rate and signal strength changes based on the set sliding time window. When the data retransmission rate or signal strength change reaches the preset network degradation judgment condition, a probe data packet is generated. The probe data packet includes colored data and signature magic number. The probe data packets are serialized, encoded, and then encapsulated into a service message, which is then sent to the cloud through a pre-registered whitelist port. The cloud receives network data streams sent by power terminals and parses the TCP / IP 5-tuple in the network data streams. It filters the network data streams by whitelisted ports, locates the magic number of the feature code in the network data streams to mark the colored streams, and performs deserialization and decoding processing on the marked colored streams to extract the colored payload. Set up a cloud analysis sliding window, and statistically analyze the byte probability distribution of the coloring payload within the cloud analysis sliding window. Calculate the real-time dynamic information entropy based on the byte probability distribution, and calculate the multi-dimensional feature deviation by combining the average packet length and packet interval of the cloud-received probe data packets extracted in real time. When the real-time dynamic information entropy changes abnormally and the multi-dimensional feature deviation exceeds the safety threshold, it is determined that there is a security risk and an active warning is triggered.

2. The method according to claim 1, characterized in that, The dual-state baseline mode operation of the power terminal probe includes a low-frequency heartbeat mode and a silent listening mode; The low-frequency heartbeat mode operation process includes: the power terminal probe establishes an independent timer to send pure protocol keep-alive frames to the cloud according to the set sending period to trigger the active state of the network layer and maintain the physical connection activity of the transmission link; The silent monitoring mode operation process includes: the power terminal probe uses eBPF technology to attach a custom hook function to the operating system to count the number of business data packets transmitted and store the counting results in a shared memory structure.

3. The method according to claim 1, characterized in that, The power terminal calculates the real-time data retransmission rate of service data packets based on the total number of sent and retransmitted service data packets extracted from the shared memory structure. At the same time, a baseline mean is maintained based on historical data. and standard deviation ,when When the data retransmission rate changes to the preset network degradation judgment condition; The raw radio signal is obtained through the operating system's underlying wireless module driver interface, and the signal smoothing value for each sliding time window is calculated. , Indicates the first The signal smoothing value for a sliding time window, Represents the smoothing coefficient. Indicates the first The raw radio signals were collected in a sliding time window; Compare the difference in signal smoothing values ​​between adjacent sliding time windows. When the difference in signal smoothing values ​​is greater than the preset step drop threshold, the signal strength change reaches the preset network degradation judgment condition.

4. The method according to claim 1, characterized in that, The probe data packets are serialized, encoded, and then encapsulated into a service message, including: The data in the probe data packet is concatenated into a binary byte array according to a predefined data structure after serialization, and the binary byte array is then encoded. The encoded string is filled into a JSON structure object that conforms to the known business specifications of the power Internet of Things, and the filled JSON structure object is used as the valid coloring payload of the message.

5. The method according to claim 1, characterized in that, The cloud analyzes the TCP / IP 5-tuple in the received network data stream and intercepts network data streams whose destination port is a whitelisted port. Search for the signature magic number of probe packets in the intercepted data stream, and mark the corresponding network data stream as a colored stream based on the signature magic number; The colored stream is sent to a deep processing queue to perform JSON text parsing to extract specific fields. The extracted specific fields are then decoded and deserialized into binary to extract the colored payload.

6. The method according to claim 1, characterized in that, The staining data includes UUIDs; Analyze the byte probability distribution of the coloring payload within a sliding window in the cloud, including: The cloud-based analysis window aggregates binary byte stream data of all extracted color payloads under the same UUID. Scan each byte sequentially, count the total frequency of each byte value, and divide the total frequency of each byte value by the total number of bytes in the cloud analysis sliding window to obtain the byte probability distribution of each byte value.

7. The method according to claim 1, characterized in that, Calculate the real-time dynamic information entropy of the staining load within the sliding window of cloud analysis using the Shannon entropy formula: , Represents real-time dynamic information entropy. Indicates byte value Byte probability distribution; The average packet length and packet interval of the stained stream are extracted in real time, and the multidimensional feature deviation is calculated by combining the real-time dynamic information entropy, average packet length, and packet interval. , Indicates the first Multidimensional feature deviation of a cloud-based analysis sliding window. Indicates the first The first cloud analytics sliding window The value of each feature, Represents the feature weight coefficients. This indicates the first [number] determined based on historical data. The baseline mean of each feature, This indicates the first [number] determined based on historical data. The standard deviation of each feature, in Time The three features represent real-time dynamic information entropy, average packet length, and packet sending interval, respectively.

8. The method according to claim 7, characterized in that, Abnormal changes in real-time dynamic information entropy and deviations of multidimensional features exceeding the safety threshold include: and , Represents the baseline information entropy. This represents the information entropy tolerance bias. This indicates the safety threshold.

9. A computer-readable storage medium storing a computer program thereon, characterized in that, When the computer program is executed by the processor, it implements the power terminal link covert staining and flow detection method as described in any one of claims 1 to 8.

10. An electronic device, characterized in that, include: Processor and memory; The memory is used to store computer programs; The processor is used to execute the computer program stored in the memory to cause the electronic device to perform the power terminal link covert staining and flow detection method according to any one of claims 1 to 8.

Images