Energy storage system penetration testing method and apparatus, storage medium and computer device

Abstract

The energy storage system penetration testing method, apparatus, storage medium, and computer equipment provided in this application identify each layer of the battery management system to determine the configuration information of each layer, ensuring comprehensive coverage of the multi-level architecture within the battery management system. Based on this, vulnerability scanning is performed on each layer, and targeted attack code is generated for each security vulnerability by combining the configuration information of each layer. This achieves accurate verification of layer-specific vulnerabilities, thereby improving the accuracy of vulnerability detection and the targeting of subsequent attack simulations. Simultaneously, the success probability of each attack code is calculated, and the communication traffic between the energy management system and the battery management system is monitored to identify abnormal behavior. Finally, multi-dimensional information is integrated to generate a penetration test report. This not only achieves comprehensive coverage testing of the multi-level architecture of the energy storage system, effectively improving test coverage, but also enhances adaptability to complex energy storage system architectures through layered and adaptive testing logic.

Description

Technical Field

[0001] This application relates to the field of system testing technology, and in particular to a penetration testing method, apparatus, storage medium and computer equipment for energy storage systems. Background Technology

[0002] With the rapid development of renewable energy technologies, energy storage systems are increasingly widely used in modern power grids, becoming a key component in improving grid stability and efficiency. Energy storage systems mainly consist of multi-level core components such as energy management systems and battery management systems, interconnected through complex communication protocols and control logic. However, this multi-level architecture also introduces certain security risks, including data tampering and unauthorized access. Therefore, penetration testing of energy storage systems to ensure their reliability has become a common method for mitigating these risks.

[0003] Currently, automated penetration testing methods are mainly designed for general application service systems, with relatively simple functions. They are difficult to adapt to the comprehensive evaluation needs of energy storage systems that span multiple levels, resulting in insufficient test coverage and poor adaptability of existing methods when facing the multi-level architecture of energy storage systems. Summary of the Invention

[0004] The purpose of this application is to at least address one of the aforementioned technical deficiencies, particularly the fact that existing automated penetration testing methods are mainly designed for general application service systems, with relatively simple functions, making it difficult to adapt to the comprehensive evaluation needs across multiple levels in energy storage systems. This results in insufficient test coverage and poor adaptability of existing methods when facing multi-level architectures of energy storage systems.

[0005] In a first aspect, this application provides a penetration testing method for an energy storage system, the method comprising:

[0006] Identify the energy storage system to be tested, which includes a battery management system and an energy management system;

[0007] Identify each level of the battery management system to determine the configuration information for each level;

[0008] Vulnerability scanning is performed on each level of the battery management system to identify security vulnerabilities at each level. Based on the configuration information of each level, corresponding attack code is generated for each level's security vulnerabilities and executed.

[0009] During the execution of attack code at each level, the success probability of each attack code is calculated, and the communication traffic between the energy management system and the battery management system is monitored to identify abnormal traffic behavior.

[0010] A penetration test report is generated based on the battery management system's various levels and configuration information, attack codes, attack success probabilities, and identified abnormal traffic behaviors.

[0011] In one embodiment, identifying the layers of the battery management system to determine the configuration information of each layer includes:

[0012] A multi-level scanning strategy is used to perform a full-domain scan of the energy storage system to identify the various levels contained in the battery management system, including the Pack level, Rack level, and Cell level.

[0013] The configuration files at each level are parsed to extract the battery parameters, configuration environment, and communication protocol corresponding to each level, in order to generate the configuration information corresponding to each level.

[0014] In one embodiment, the vulnerability scanning of each level of the battery management system to identify security vulnerabilities at each level includes:

[0015] Identify the open ports at each level, send specific data packets to each open port, and obtain multiple return results;

[0016] Each returned result is matched with the vulnerability features in the preset vulnerability database to obtain the matching result corresponding to each returned result.

[0017] Security vulnerabilities are identified at each level based on the matching results.

[0018] In one embodiment, the step of generating corresponding attack code for each level of security vulnerabilities based on the configuration information of each level, and executing the attack code for each level, includes:

[0019] For each level, security vulnerabilities at that level are classified into multiple vulnerability categories according to their type and triggering mechanism.

[0020] Based on the configuration information of this level, corresponding attack code snippets are generated for each vulnerability category, and attack code for this level is generated based on the attack code snippets corresponding to each vulnerability category.

[0021] Once the attack code for each level is generated, the corresponding attack code is executed at each level.

[0022] In one embodiment, calculating the attack success probability corresponding to each attack code includes:

[0023] For each attack code, the attack code is repeatedly executed in the corresponding environment according to the preset total number of attack attempts, and the number of successful attacks is counted.

[0024] The ratio of the number of successful attacks to the total number of attack attempts is used to obtain the attack success probability corresponding to the attack code.

[0025] In one embodiment, monitoring the communication traffic between the energy management system and the battery management system to identify abnormal traffic behavior includes:

[0026] Capture bidirectional communication traffic between the energy management system and the battery management system;

[0027] A pre-trained flow baseline model is determined, which is obtained by extracting the flow characteristics of the energy management system and the battery management system under normal operating conditions to construct a normal flow behavior baseline;

[0028] The bidirectional communication traffic is input into the traffic baseline model to obtain the deviation score of each traffic behavior in the bidirectional communication traffic;

[0029] When the deviation score exceeds a preset threshold, the traffic behavior corresponding to the deviation score is determined to be abnormal traffic behavior.

[0030] In one embodiment, the step of generating a penetration test report based on the various levels and configuration information of the battery management system, attack code, attack success probability, and identified abnormal traffic behavior includes:

[0031] Get the preset report template;

[0032] According to the filling requirements of the report template, information such as the configuration information of each level of the battery management system, attack code, attack success probability, and identified abnormal traffic behavior are integrated.

[0033] The penetration test report is obtained by filling the report template with the integrated information of each level and its configuration, attack code, attack success probability, and identified abnormal traffic behavior.

[0034] Secondly, this application provides a penetration testing device for an energy storage system, the device comprising:

[0035] The system determination module is used to determine the energy storage system to be tested, the energy storage system including a battery management system and an energy management system;

[0036] A hierarchy identification module is used to identify each level of the battery management system in order to determine the configuration information of each level.

[0037] The attack simulation module is used to perform vulnerability scanning on each level of the battery management system, identify security vulnerabilities at each level, generate corresponding attack code for each level based on the configuration information of each level, and execute the attack code at each level.

[0038] The anomaly monitoring module is used to calculate the success probability of each attack code during the execution of each level of attack code, and to monitor the communication traffic between the energy management system and the battery management system in order to identify abnormal traffic behavior.

[0039] The report generation module is used to generate a penetration test report based on the various levels of the battery management system and their configuration information, attack code, attack success probability, and identified abnormal traffic behavior.

[0040] Thirdly, this application provides a storage medium storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of the energy storage system penetration testing method as described in any of the above embodiments.

[0041] Fourthly, this application provides a computer device, including: one or more processors, and a memory;

[0042] The memory stores computer-readable instructions, and when the one or more processors execute the computer-readable instructions, they perform the steps of the energy storage system penetration testing method as described in any of the above embodiments.

[0043] As can be seen from the above technical solutions, the embodiments of this application have the following advantages:

[0044] The energy storage system penetration testing method, apparatus, storage medium, and computer equipment provided in this application identify each layer of the battery management system to determine the configuration information of each layer, ensuring comprehensive coverage of the multi-level architecture within the battery management system. Based on this, vulnerability scanning is performed on each layer, and targeted attack code is generated for each security vulnerability by combining the configuration information of each layer. This achieves accurate verification of layer-specific vulnerabilities, thereby improving the accuracy of vulnerability detection and the targeting of subsequent attack simulations. Simultaneously, the success probability of each attack code is calculated, and the communication traffic between the energy management system and the battery management system is monitored to identify abnormal behavior. Finally, multi-dimensional information is integrated to generate a penetration test report. This not only achieves comprehensive coverage testing of the multi-level architecture of the energy storage system, effectively improving test coverage, but also enhances adaptability to complex energy storage system architectures through layered and adaptive testing logic. Attached Figure Description

[0045] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0046] Figure 1 A schematic flowchart of a penetration testing method for an energy storage system provided in an embodiment of this application;

[0047] Figure 2 A schematic diagram of the structure of a penetration testing device for an energy storage system provided in an embodiment of this application;

[0048] Figure 3 This is an internal structural diagram of a computer device provided in an embodiment of this application. Detailed Implementation

[0049] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0050] In one embodiment, this application provides a penetration testing method for an energy storage system. The following embodiments illustrate the application of this method to a penetration testing system, hereinafter referred to as the system. It is understood that this system can be deployed in a computer device to execute the energy storage system penetration testing method provided in this application. Based on this, as... Figure 1 As shown, this application provides a penetration testing method for an energy storage system, the method comprising:

[0051] S101: Identify the energy storage system to be tested.

[0052] The energy storage system comprises a battery management system (BMS) and an energy management system (EMS), which integrate energy storage, conversion, monitoring, and scheduling functions. The BMS is the core functional module responsible for the safe operation and performance regulation of the batteries within the energy storage system, possessing hierarchical management characteristics. The EMS is the core of the overall control and scheduling of the energy storage system.

[0053] In this step, when a penetration test of an energy storage system is required, the user can initiate a test command. When the system receives the test command, it can determine the object to be tested, i.e., the energy storage system to be tested, based on the command. Specifically, by parsing the test command, the system identifier can be determined, and then the energy storage system to be tested can be further identified based on this identifier.

[0054] S102: Identify the various levels of the battery management system to determine the configuration information for each level.

[0055] In this context, "level" refers to the management unit in a battery management system, divided based on function and physical structure. It typically includes the Pack level for battery packs, the Rack level for rack-connected battery series-parallel structures, and the Cell level for individual battery cells. Configuration information refers to the set of static or dynamic parameters that each level relies on during operation, including but not limited to hardware model, software version, communication protocol type, network address, battery parameters (such as capacity and voltage thresholds), access control policies, and logical topology relationships.

[0056] In this step, the hierarchical division within the battery management system is clearly defined, and the configuration information corresponding to each level is accurately obtained to ensure that subsequent tests can cover each level specifically. Specifically, a network scanning tool can be used to perform a full-domain probe of the battery management system, identifying the physical deployment nodes and logical relationships at the Cell, Pack, and Rack levels. Then, by parsing the relevant configuration files, the configuration information for each level can be obtained.

[0057] Furthermore, network scanning tools may include probes based on ARP, ICMP, or other specific protocols. This application does not impose any specific limitations in this regard.

[0058] S103: Perform vulnerability scanning on each level of the battery management system, identify security vulnerabilities at each level, generate corresponding attack code for each level based on the configuration information of each level, and execute the attack code at each level.

[0059] Security vulnerabilities refer to security flaws in the hardware, software, protocols, or configurations of various levels of the battery management system that can be exploited to compromise its confidentiality, integrity, or availability. These vulnerabilities include, but are not limited to, unauthorized access vulnerabilities, buffer overflows, default credentials, known firmware vulnerabilities, and communication protocol parsing defects. Attack code refers to program scripts written to target specific levels of security vulnerabilities, used to actively verify the exploitability of the vulnerability to simulate real attack behavior.

[0060] In this step, a systematic scan is first used to locate security vulnerabilities at each level. Then, specific attack code is generated and executed based on the configuration information of each level, thus completing the practical verification of vulnerability exploitability. Specifically, automated security scanning tools can be used to conduct layered scans of the battery management system at the Rack, Pack, and Cell levels. Based on the configuration information of each level (such as version number and communication protocol), vulnerability characteristics are matched to identify security vulnerabilities such as unencrypted protocols, missing data verification, and lax access control at each level. Subsequently, referring to the interface specifications, data transmission formats, and other configuration details of each level, targeted attack code is generated for each vulnerability.

[0061] For example, data eavesdropping attack code was developed to target unencrypted protocol vulnerabilities at the Rack level, and parameter tampering attack code was developed to target overcharge protection vulnerabilities at the Cell level. Finally, the attack code was executed hierarchically in an isolated test environment to avoid affecting the normal power supply of the power plant.

[0062] For example, a scanner supporting the Modbus protocol is used to check for function code misuse risks at the Pack layer, and OWASP ZAP or Burp Suite plugins are used to detect injection vulnerabilities at the Rack layer's web interface. This information is then used to generate highly targeted attack code.

[0063] Specifically, automated security scanning tools can be Nessus, OpenVAS, etc., and this application does not impose any specific restrictions on them.

[0064] S104: During the execution of attack code at each level, calculate the success probability of each attack code and monitor the communication traffic between the energy management system and the battery management system to identify abnormal traffic behavior.

[0065] The attack success probability refers to the quantitative assessment value of the likelihood of successfully achieving the preset attack target after executing corresponding attack code targeting a certain level of security vulnerability. Communication traffic refers to the data stream transmitted between the energy management system and the battery management system, including but not limited to network packets or bus data such as control commands, status reports, parameter configurations, and alarm information. Abnormal traffic behavior refers to traffic patterns that deviate from normal communication patterns during penetration testing between the energy management system and the battery management system.

[0066] In this step, when executing the attack code at each level, a uniform total number of attack attempts can be preset (e.g., 50 attempts for each level of attack code), and whether each attack successfully triggers the security vulnerability can be recorded. Then, the success probability of the attack can be calculated based on the number of successful triggers.

[0067] Meanwhile, traffic monitoring tools (such as Wireshark, Zeek, etc.) can be deployed on the core communication links of the energy management system and battery management system to capture transmitted data packets in real time, extract the traffic baseline under normal conditions, and compare the communication traffic during the execution of attack code to identify abnormal traffic behaviors such as a sudden increase in communication frequency to 50 times per minute or the appearance of non-standard Modbus protocol messages.

[0068] S105: Generate a penetration test report based on the battery management system's various levels and configuration information, attack code, attack success probability, and identified abnormal traffic behavior.

[0069] Among them, the penetration test report refers to a comprehensive document generated after systematically organizing and summarizing the data and results obtained from the entire process of multi-level penetration testing of the battery management system.

[0070] In this step, the multi-dimensional data generated at each stage of the penetration test are integrated, analyzed, and organized, and a structured report is generated according to standardized logic to ensure that the report can comprehensively and clearly reflect the test results.

[0071] For example, in a grid-side centralized energy storage power station scenario, the configuration information of each level in the battery management system, the list of identified security vulnerabilities, the generated attack codes, the success probability data corresponding to each attack code, and the records of monitored abnormal traffic behavior can be summarized first. Then, this data can be correlated and analyzed. For example, the success probability of attacks on unencrypted Rack-level protocol vulnerabilities (e.g., 80%) can be linked to the corresponding abnormal traffic (e.g., a surge in data eavesdropping traffic) to determine the correlation between the vulnerability's harm and the attack's impact. Next, the content is organized logically according to "Test Overview—Level Configuration Details—Vulnerability and Attack Verification Results—Abnormal Traffic Analysis—Security Recommendations" to generate a penetration test report.

[0072] In the above embodiments, each layer of the battery management system is identified to determine the configuration information of each layer, ensuring comprehensive coverage of the multi-level architecture of the battery management system during testing. Based on this, vulnerability scanning is performed on each layer, and targeted attack code is generated for each security vulnerability by combining the configuration information of each layer. This achieves accurate verification of layer-specific vulnerabilities, thereby improving the accuracy of vulnerability detection and the targeting of subsequent attack simulations. Simultaneously, the success probability of each attack code is calculated, and the communication traffic between the energy management system and the battery management system is monitored to identify abnormal behavior. Finally, multi-dimensional information is integrated to generate a penetration test report. This not only achieves comprehensive coverage testing of the multi-level architecture of the energy storage system, effectively improving test coverage, but also enhances adaptability to the complex architecture of the energy storage system through layered and adaptive testing logic.

[0073] In one embodiment, the various levels of the battery management system are identified to determine the configuration information for each level, including:

[0074] S1: Employ a multi-level scanning strategy to perform a full-domain scan of the energy storage system and identify the various levels contained in the battery management system.

[0075] S2: Parse the configuration files of each level, extract the battery parameters, configuration environment and communication protocol corresponding to each level, and generate the configuration information corresponding to each level.

[0076] The hierarchy includes Pack level, Rack level, and Cell level. Configuration files are specific format files used to define or control the operating status, operating parameters, and interaction rules of each level. Battery parameters are a set of data describing the battery's operating characteristics and performance indicators, including but not limited to the number of battery cells, rated capacity, and rated voltage.

[0077] In this embodiment, a multi-level scan covers the entire energy storage system. First, each level of the battery management system is identified. Then, the configuration files for each level are parsed to extract three key types of information: battery parameters, configuration environment, and communication protocols. Finally, configuration information for each level is generated. Specifically, network scanning tools such as Nmap are used to perform a full-domain IP address and port scan of the energy storage system, progressively refining the process from the overall system down to the Cell, Pack, and Rack levels. Subsequently, by accessing the storage paths of the control units at each level, the corresponding configuration files are retrieved, and the battery parameters, configuration environment, and communication protocols for each level are extracted. Based on the extracted information, configuration information for each level is generated.

[0078] Furthermore, when extracting information from the configuration files, for the Cell level, the single-cell voltage threshold and temperature monitoring accuracy can be extracted; for the Pack level, the battery pack capacity and charge / discharge balancing parameters can be extracted; and for the Rack level, battery parameters such as multi-battery coordination strategies can be extracted. Simultaneously, the hardware deployment location (e.g., Cell-level modules are located inside the battery compartment, Rack-level controllers are deployed in the control room), software version, and other configuration environment information for each level are recorded, as well as details of communication protocols used for data interaction between levels and communication between modules. These are also recorded in the configuration information for each level.

[0079] Specifically, the Pack level handles the overall performance and health status of the battery pack and coordinates the operation of individual battery cells. The Rack level manages the rack-level battery packs, typically involving the comprehensive control of multiple battery packs. The Cell level manages and monitors the status of individual battery cells, ensuring that each battery cell operates safely and efficiently.

[0080] It's understandable that a full-domain scan avoids missing any level of the battery management system and creates structured hierarchical configuration information through the configuration files of each level. This process ensures both the comprehensiveness and accuracy of the configuration information and provides precise data for subsequent penetration testing phases such as vulnerability scanning and attack simulation at each level.

[0081] In one embodiment, a vulnerability scan is performed on each level of the battery management system to identify security vulnerabilities at each level, including:

[0082] S1: Determine the open ports in each layer, send specific data packets to each open port, and obtain multiple return results.

[0083] S2: Match each returned result with the vulnerability features in the preset vulnerability database to obtain the matching result corresponding to each returned result.

[0084] S3: Identify security vulnerabilities at each level based on the matching results.

[0085] An open port refers to a communication port that actively listens for and receives external network connection requests. A specific data packet refers to a network data packet specifically designed to probe for vulnerabilities in the services corresponding to that port.

[0086] The returned result is the response data returned by the service or device corresponding to the open port after a specific data packet is sent to the corresponding open port.

[0087] Vulnerability databases are used to store the characteristics of known security vulnerabilities, which may include information such as the vulnerability number, triggering conditions, and scope of impact.

[0088] In this embodiment, by probing open ports at each level, sending customized data packets to obtain responses, and then comparing them with vulnerability database features, security vulnerabilities at each level are ultimately located. Specifically, based on the preliminary hardware identification results, the port scanning function of the Nmap tool can be used to determine the open ports at each level for the identified device IPs.

[0089] Subsequently, based on the service type corresponding to each port (such as Modbus protocol, Web service, etc.), the corresponding specific data packet is determined. After collecting the return results from each port, the service version, response message format, error code, and other information in the results are compared one by one with the corresponding vulnerability features stored in the vulnerability database to obtain the matching status of each return result, i.e., the matching result. Then, based on each matching result, the security vulnerabilities existing at each level are determined. By focusing on the key communication entry points at each level and using customized detection and feature matching methods, security vulnerabilities at each level are efficiently identified, ensuring the targeted and comprehensive nature of vulnerability detection.

[0090] In one example, specific data packets can be dynamically generated based on the port. For instance, a query packet containing an exception register address can be sent to a Modbus protocol port, while an HTTP request packet containing an SQL injection payload can be sent to a Web service port.

[0091] In one embodiment, based on the configuration information of each level, corresponding attack code is generated for the security vulnerabilities of each level, and the attack code of each level is executed, including:

[0092] S1: For each level, the security vulnerabilities at that level are classified into multiple vulnerability categories according to their type and triggering mechanism.

[0093] S2: Based on the configuration information of this level, generate corresponding attack code snippets for each vulnerability category, and generate attack code for this level based on the attack code snippets corresponding to each vulnerability category.

[0094] S3: After generating the attack code for each level, execute the corresponding attack code in each level.

[0095] Among them, the type of security vulnerability refers to the category of security vulnerabilities based on their technical characteristics, harmful scenarios, or scope of impact, such as data tampering vulnerabilities, privilege bypass vulnerabilities, communication protocol vulnerabilities, input validation defects, etc.

[0096] Triggering mechanisms refer to the specific input, operation, or system state conditions required to exploit security vulnerabilities, such as sending an excessively long string to trigger a buffer overflow, constructing a specific SQL statement to achieve injection, or bypassing authentication logic to achieve unauthorized access.

[0097] In this embodiment, for each identified level of security vulnerability, the system can classify them according to their type, and further refine the classification by combining specific triggering mechanisms. For example, even among injection-type security vulnerabilities, some vulnerabilities require passing the attack payload through HTTP parameters, while others require embedding malicious content through Modbus protocol fields. This classification makes the vulnerability structure clearer and facilitates the design of differentiated attack verification logic for vulnerabilities of different categories, ensuring the reliability of penetration testing.

[0098] In one example, taking the Rack level of a battery management system as an example, we first identify the types of security vulnerabilities and their triggering mechanisms, such as the "unencrypted communication protocol vulnerability" (triggered by exploiting the unencrypted transmission characteristics of the Modbus protocol to intercept and tamper with data) and the "missing authorization verification vulnerability" (triggered by constructing unauthorized requests to bypass access control). Then, combining the Rack level configuration information (such as Modbus protocol port 502, data transmission format, and device IP 192.168.1.102), we generate a data tampering attack code snippet for the "unencrypted communication protocol vulnerability" (constructing and sending fake battery pack voltage data) and an unauthorized access code snippet for the "missing authorization verification vulnerability" (simulating an administrator requesting access control).

[0099] The two code snippets are then integrated, and common logic such as port connections and data encapsulation is added to form a complete, rack-level attack code. Furthermore, the code snippets can be generated using the Metasploit framework or a pre-trained code generation model; this application does not impose any specific restrictions on this.

[0100] In one embodiment, the success probability of the attack corresponding to each attack code is calculated, including:

[0101] S1: For each attack code, execute the attack code repeatedly in the corresponding environment according to the preset total number of attack attempts, and count the number of successful attacks.

[0102] S2: Calculate the ratio of the number of successful attacks to the total number of attack attempts to obtain the success probability of the attack code.

[0103] The total number of attack attempts is an experience value that can be adjusted based on actual circumstances.

[0104] In this embodiment, the attack code is executed multiple times in the test environment corresponding to each attack code to count the number of successful attacks. Furthermore, statistical methods are used to obtain a stable and quantitative assessment of the vulnerability's exploitability. This effectively filters out misjudgments caused by instantaneous environmental fluctuations, test noise, or minor changes in the attack payload, making the assessment results closer to the average performance of the vulnerability under actual operating conditions.

[0105] In one example, the probability of an attack succeeding can be calculated using the following formula:

[0106]

[0107] In the formula, This indicates the probability of a successful attack. This indicates the total number of attack attempts. This indicates an indicator function, which has a value of 1 when the i-th attack attempt is successful and a value of 0 when the i-th attack attempt fails.

[0108] In one embodiment, communication traffic between the energy management system and the battery management system is monitored to identify abnormal traffic behavior, including:

[0109] S1: Capture bidirectional communication traffic between the energy management system and the battery management system.

[0110] S2: Determine the pre-trained traffic baseline model.

[0111] S3: Input the bidirectional communication traffic into the traffic baseline model to obtain the deviation score of each traffic behavior in the bidirectional communication traffic.

[0112] S4: When the deviation score exceeds the preset threshold, the traffic behavior corresponding to the deviation score is judged as abnormal traffic behavior.

[0113] The traffic baseline model is constructed by extracting traffic characteristics from the energy management system and battery management system under normal operating conditions to establish a baseline for normal traffic behavior. Two-way communication traffic refers to the total number of data packets sent and received between the two parties. The deviation score represents the degree of deviation of the current traffic behavior from the normal baseline; a higher score indicates a greater likelihood of traffic anomalies.

[0114] In this embodiment, a traffic capture tool can be pre-deployed to obtain the bidirectional communication traffic between the energy management system and the battery management system during penetration testing. This bidirectional communication traffic can then be pre-processed to obtain the final bidirectional communication traffic.

[0115] The bidirectional communication traffic is input into a pre-trained traffic baseline model. The traffic baseline model is used to analyze the bidirectional communication traffic and compare it with the traffic behavior of the normal baseline learned during the training phase. The deviation score of each traffic behavior is output.

[0116] When the deviation score exceeds the preset threshold, the traffic behavior corresponding to the deviation score exceeding the preset threshold can be identified as abnormal traffic behavior.

[0117] It is understood that by establishing a baseline of normal traffic behavior, this embodiment enables the system to identify hidden anomalies that are difficult to determine through exhaustive rule enumeration or simple thresholds. This allows for the timely detection of unexpected traffic behavior caused by attacks or system anomalies, enhancing the ability to detect unknown threats and indirect impacts.

[0118] Specifically, during the training process, the traffic baseline model can be trained by acquiring traffic data under normal operating conditions, using this traffic data as training data, and employing the isolated forest unsupervised learning algorithm to train and obtain the traffic baseline model based on the normal traffic features contained in the training data.

[0119] In addition, different indicators are used for baseline determination of flow behavior at different levels. For example, the Pack level focuses on the overall energy output stability, while the Cell level focuses on whether the charging and discharging curves of individual batteries are abnormal.

[0120] In one embodiment, a penetration test report is generated based on the various levels of the battery management system and their configuration information, the attack code, the probability of attack success, and the identified abnormal traffic behavior, including:

[0121] S1: Get the preset report template.

[0122] S2: Integrate information on each level of the battery management system and its configuration information, attack code, attack success probability, and identified abnormal traffic behavior according to the report template filling requirements.

[0123] S3: The integrated information, including the configuration information of each layer, attack code, attack success probability, and identified abnormal traffic behavior, is filled into the report template to obtain the penetration test report.

[0124] In this embodiment, information is integrated from the data obtained in the above embodiments according to the report template's population requirements. During this process, the format and writing logic of these data can be adjusted sequentially according to the population requirements before information integration. Alternatively, a large language model can be used, with the population requirements and this data as input data, requiring it to integrate according to the requirements. Finally, the integrated data is populated into the corresponding positions in the report template to obtain the penetration test report. This allows for the centralized presentation of multi-dimensional test data, including configuration information at each level, attack code, attack success probability, and abnormal traffic behavior. This ensures both the report's standardization and readability, while also making the security status, vulnerability severity, and abnormal risks of the energy storage system readily apparent.

[0125] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0126] The energy storage system penetration testing apparatus provided in the embodiments of this application is described below. The energy storage system penetration testing apparatus described below can be referred to in correspondence with the energy storage system penetration testing method described above.

[0127] like Figure 2 As shown, this application provides a penetration testing device 200 for an energy storage system, the device comprising:

[0128] The system determination module 201 is used to determine the energy storage system to be tested, which includes a battery management system and an energy management system.

[0129] The hierarchy identification module 202 is used to identify each level of the battery management system in order to determine the configuration information of each level;

[0130] The attack simulation module 203 is used to perform vulnerability scanning on each level of the battery management system, identify security vulnerabilities at each level, generate corresponding attack code for each level based on the configuration information of each level, and execute the attack code at each level.

[0131] The anomaly monitoring module 204 is used to calculate the success probability of each attack code during the execution of each level of attack code, and to monitor the communication traffic between the energy management system and the battery management system in order to identify abnormal traffic behavior.

[0132] The report generation module 105 is used to generate a penetration test report based on the various levels of the battery management system and their configuration information, attack code, attack success probability, and identified abnormal traffic behavior.

[0133] The energy storage system comprises a battery management system (BMS) and an energy management system (EMS), integrating energy storage, conversion, monitoring, and scheduling functions. The BMS is the core functional module responsible for the safe operation and performance regulation of batteries within the energy storage system, exhibiting hierarchical management characteristics. The EMS is the core of the overall control and scheduling of the energy storage system. A hierarchy refers to the management unit within the BMS based on function and physical structure. This typically includes the Pack level for battery packs, the Rack level for rack-connected battery series-parallel structures, and the Cell level for individual battery cells. Configuration information refers to the set of static or dynamic parameters that each level relies on during operation, including but not limited to hardware model, software version, communication protocol type, network address, battery parameters (such as capacity and voltage thresholds), access control policies, and logical topology relationships. Security vulnerabilities refer to security flaws in the hardware, software, protocols, or configurations of each level of the BMS that could be exploited to compromise its confidentiality, integrity, or availability, including but not limited to unauthorized access vulnerabilities, buffer overflows, default credentials, known firmware vulnerabilities, and communication protocol parsing defects. Attack code refers to program scripts written to target specific levels of security vulnerabilities. These scripts are used to actively verify the exploitability of the vulnerability in order to simulate real attack behavior.

[0134] For example, in a grid-side centralized energy storage power station scenario, the configuration information of each level in the battery management system, the list of identified security vulnerabilities, the generated attack codes, the success probability data corresponding to each attack code, and the records of monitored abnormal traffic behavior can be summarized first. Then, this data can be correlated and analyzed. For example, the success probability of attacks on unencrypted Rack-level protocol vulnerabilities (e.g., 80%) can be linked to the corresponding abnormal traffic (e.g., a surge in data eavesdropping traffic) to determine the correlation between the vulnerability's harm and the attack's impact. Next, the content is organized logically according to "Test Overview—Level Configuration Details—Vulnerability and Attack Verification Results—Abnormal Traffic Analysis—Security Recommendations" to generate a penetration test report.

[0135] In the above embodiments, each layer of the battery management system is identified to determine the configuration information of each layer, ensuring comprehensive coverage of the multi-level architecture of the battery management system during testing. Based on this, vulnerability scanning is performed on each layer, and targeted attack code is generated for each security vulnerability by combining the configuration information of each layer. This achieves accurate verification of layer-specific vulnerabilities, thereby improving the accuracy of vulnerability detection and the targeting of subsequent attack simulations. Simultaneously, the success probability of each attack code is calculated, and the communication traffic between the energy management system and the battery management system is monitored to identify abnormal behavior. Finally, multi-dimensional information is integrated to generate a penetration test report. This not only achieves comprehensive coverage testing of the multi-level architecture of the energy storage system, effectively improving test coverage, but also enhances adaptability to the complex architecture of the energy storage system through layered and adaptive testing logic.

[0136] In one embodiment, the hierarchy recognition module includes:

[0137] The system scanning submodule is used to perform a full-domain scan of the energy storage system using a multi-level scanning strategy, identifying the various levels contained in the battery management system, including Pack level, Rack level and Cell level.

[0138] The file parsing submodule is used to parse the configuration files at each level, extract the battery parameters, configuration environment and communication protocol corresponding to each level, and generate the configuration information corresponding to each level.

[0139] In one embodiment, the attack simulation module includes:

[0140] The port determination submodule is used to determine the open ports in each layer, send specific data packets to each open port, and obtain multiple return results.

[0141] The vulnerability matching submodule is used to match each returned result with the vulnerability features in the preset vulnerability database to obtain the matching result corresponding to each returned result.

[0142] Security vulnerabilities are identified at each level based on the matching results.

[0143] In one embodiment, the attack simulation module includes:

[0144] The vulnerability classification submodule is used to classify the security vulnerabilities at each level into multiple vulnerability categories according to the type and triggering mechanism of the security vulnerability.

[0145] The code generation submodule is used to combine the configuration information of this level to generate corresponding attack code snippets for each vulnerability category, and generate attack code for this level based on the attack code snippets corresponding to each vulnerability category.

[0146] The code execution submodule is used to execute the corresponding attack code at each level after the attack code at each level is generated.

[0147] In one embodiment, the anomaly monitoring module includes:

[0148] The count submodule is used to repeatedly execute each attack code in the corresponding environment based on the preset total number of attack attempts, and count the number of successful attacks.

[0149] The calculation submodule is used to calculate the ratio of the number of successful attacks to the total number of attack attempts, thus obtaining the success probability of the attack code.

[0150] In one embodiment, the anomaly monitoring module includes:

[0151] The traffic capture submodule is used to capture bidirectional communication traffic between the energy management system and the battery management system;

[0152] The model determination submodule is used to determine the pre-trained flow baseline model. The flow baseline model is obtained by extracting the flow characteristics of the energy management system and the battery management system under normal operating conditions to construct the normal flow behavior baseline.

[0153] The deviation prediction module is used to input bidirectional communication traffic into the traffic baseline model to obtain the deviation score of each traffic behavior in the bidirectional communication traffic;

[0154] The behavior determination submodule is used to determine the traffic behavior corresponding to the deviation score as abnormal traffic behavior when the deviation score exceeds a preset threshold.

[0155] In one embodiment, the report generation module includes:

[0156] The template retrieval submodule is used to retrieve preset report templates;

[0157] The information integration submodule is used to integrate information on each level of the battery management system and its configuration information, attack codes, attack success probabilities, and identified abnormal traffic behaviors according to the report template filling requirements.

[0158] The report generation submodule is used to fill the report template with the integrated information of each level and its configuration information, attack code, attack success probability, and identified abnormal traffic behavior to obtain a penetration test report.

[0159] The division of modules in the above-described energy storage system penetration testing device is merely illustrative. In other embodiments, the energy storage system penetration testing device can be divided into different modules as needed to complete all or part of its functions. Each module in the above-described energy storage system penetration testing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0160] In one embodiment, this application also provides a storage medium storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the following steps:

[0161] Identify the energy storage system to be tested, which includes a battery management system and an energy management system;

[0162] Identify each level of the battery management system to determine the configuration information for each level;

[0163] Vulnerability scanning is performed on each level of the battery management system to identify security vulnerabilities at each level. Based on the configuration information of each level, corresponding attack code is generated for each level's security vulnerabilities and executed.

[0164] During the execution of attack code at each level, the success probability of each attack code is calculated, and the communication traffic between the energy management system and the battery management system is monitored to identify abnormal traffic behavior.

[0165] A penetration test report is generated based on the battery management system's various levels and configuration information, attack codes, attack success probabilities, and identified abnormal traffic behaviors.

[0166] In one embodiment, the computer-readable instructions, when executed by the processor, further perform the following steps:

[0167] A multi-level scanning strategy is used to perform a full-domain scan of the energy storage system to identify the various levels contained in the battery management system, including the Pack level, Rack level, and Cell level.

[0168] The configuration files at each level are parsed to extract the battery parameters, configuration environment, and communication protocol corresponding to each level, in order to generate the configuration information corresponding to each level.

[0169] In one embodiment, the computer-readable instructions, when executed by the processor, further perform the following steps:

[0170] Identify the open ports at each level, send specific data packets to each open port, and obtain multiple return results;

[0171] Each returned result is matched with the vulnerability features in the preset vulnerability database to obtain the matching result corresponding to each returned result.

[0172] Security vulnerabilities are identified at each level based on the matching results.

[0173] In one embodiment, the computer-readable instructions, when executed by the processor, further perform the following steps:

[0174] For each level, security vulnerabilities at that level are classified into multiple vulnerability categories according to their type and triggering mechanism.

[0175] Based on the configuration information of this level, corresponding attack code snippets are generated for each vulnerability category, and attack code for this level is generated based on the attack code snippets corresponding to each vulnerability category.

[0176] Once the attack code for each level is generated, the corresponding attack code is executed at each level.

[0177] In one embodiment, the computer-readable instructions, when executed by the processor, further perform the following steps:

[0178] For each attack code, the attack code is repeatedly executed in the corresponding environment according to the preset total number of attack attempts, and the number of successful attacks is counted.

[0179] The ratio of the number of successful attacks to the total number of attack attempts is used to obtain the attack success probability corresponding to the attack code.

[0180] In one embodiment, the computer-readable instructions, when executed by the processor, further perform the following steps:

[0181] Capture bidirectional communication traffic between the energy management system and the battery management system;

[0182] A pre-trained flow baseline model is determined, which is obtained by extracting the flow characteristics of the energy management system and the battery management system under normal operating conditions to construct a normal flow behavior baseline;

[0183] The bidirectional communication traffic is input into the traffic baseline model to obtain the deviation score of each traffic behavior in the bidirectional communication traffic;

[0184] When the deviation score exceeds a preset threshold, the traffic behavior corresponding to the deviation score is determined to be abnormal traffic behavior.

[0185] In one embodiment, the computer-readable instructions, when executed by the processor, further perform the following steps:

[0186] Get the preset report template;

[0187] According to the filling requirements of the report template, information such as the configuration information of each level of the battery management system, attack code, attack success probability, and identified abnormal traffic behavior are integrated.

[0188] The penetration test report is obtained by filling the report template with the integrated information of each level and its configuration, attack code, attack success probability, and identified abnormal traffic behavior.

[0189] In one embodiment, this application also provides a computer device storing computer-readable instructions, wherein when the one or more processors execute the computer-readable instructions, they perform the following steps:

[0190] Identify the energy storage system to be tested, which includes a battery management system and an energy management system;

[0191] Identify each level of the battery management system to determine the configuration information for each level;

[0192] Vulnerability scanning is performed on each level of the battery management system to identify security vulnerabilities at each level. Based on the configuration information of each level, corresponding attack code is generated for each level's security vulnerabilities and executed.

[0193] During the execution of attack code at each level, the success probability of each attack code is calculated, and the communication traffic between the energy management system and the battery management system is monitored to identify abnormal traffic behavior.

[0194] A penetration test report is generated based on the battery management system's various levels and configuration information, attack codes, attack success probabilities, and identified abnormal traffic behaviors.

[0195] In one embodiment, the processor also performs the following steps when executing computer-readable instructions:

[0196] A multi-level scanning strategy is used to perform a full-domain scan of the energy storage system to identify the various levels contained in the battery management system, including the Pack level, Rack level, and Cell level.

[0197] The configuration files at each level are parsed to extract the battery parameters, configuration environment, and communication protocol corresponding to each level, in order to generate the configuration information corresponding to each level.

[0198] In one embodiment, the processor also performs the following steps when executing computer-readable instructions:

[0199] Identify the open ports at each level, send specific data packets to each open port, and obtain multiple return results;

[0200] Each returned result is matched with the vulnerability features in the preset vulnerability database to obtain the matching result corresponding to each returned result.

[0201] Security vulnerabilities are identified at each level based on the matching results.

[0202] In one embodiment, the processor also performs the following steps when executing computer-readable instructions:

[0203] For each level, security vulnerabilities at that level are classified into multiple vulnerability categories according to their type and triggering mechanism.

[0204] Based on the configuration information of this level, corresponding attack code snippets are generated for each vulnerability category, and attack code for this level is generated based on the attack code snippets corresponding to each vulnerability category.

[0205] Once the attack code for each level is generated, the corresponding attack code is executed at each level.

[0206] In one embodiment, the processor also performs the following steps when executing computer-readable instructions:

[0207] For each attack code, the attack code is repeatedly executed in the corresponding environment according to the preset total number of attack attempts, and the number of successful attacks is counted.

[0208] The ratio of the number of successful attacks to the total number of attack attempts is used to obtain the attack success probability corresponding to the attack code.

[0209] In one embodiment, the processor also performs the following steps when executing computer-readable instructions:

[0210] Capture bidirectional communication traffic between the energy management system and the battery management system;

[0211] A pre-trained flow baseline model is determined, which is obtained by extracting the flow characteristics of the energy management system and the battery management system under normal operating conditions to construct a normal flow behavior baseline;

[0212] The bidirectional communication traffic is input into the traffic baseline model to obtain the deviation score of each traffic behavior in the bidirectional communication traffic;

[0213] When the deviation score exceeds a preset threshold, the traffic behavior corresponding to the deviation score is determined to be abnormal traffic behavior.

[0214] In one embodiment, the processor also performs the following steps when executing computer-readable instructions:

[0215] Get the preset report template;

[0216] According to the filling requirements of the report template, information such as the configuration information of each level of the battery management system, attack code, attack success probability, and identified abnormal traffic behavior are integrated.

[0217] The penetration test report is obtained by filling the report template with the integrated information of each level and its configuration, attack code, attack success probability, and identified abnormal traffic behavior.

[0218] Indicatively, such as Figure 3 As shown, Figure 3 This is a schematic diagram of the internal structure of a computer device 300 provided in an embodiment of this application. The computer device 300 can be provided as a server. (Refer to...) Figure 3 The computer device 300 includes a processing component 302, which further includes one or more processors, and memory resources represented by memory 301 for storing instructions, such as application programs, that can be executed by the processing component 302. The application programs stored in memory 301 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 302 is configured to execute instructions to perform the energy storage system penetration testing method of any of the above embodiments.

[0219] The computer device 300 may also include a power supply component 303 configured to perform power management of the computer device 300, a wired or wireless network interface 304 configured to connect the computer device 300 to a network, and an input / output (I / O) interface 305. The computer device 300 may operate on an operating system stored in memory 301, such as Windows Server™, Mac OS X™, Unix™, Linux™, Free BSD™, or similar.

[0220] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0221] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising a…" does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element. In this document, the singular forms "a," "an," and "the" may also include the plural forms unless the context clearly indicates otherwise. It should also be understood that the terms “comprising / including” or “having” specify the presence of the stated features, wholes, steps, operations, components, parts or combinations thereof, but do not exclude the possibility of the presence or addition of one or more other features, wholes, steps, operations, components, parts or combinations thereof. Meanwhile, the term “and / or” as used in this specification includes any and all combinations of the associated listed items.

[0222] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. The various embodiments can be combined as needed, and the same or similar parts can be referred to each other.

[0223] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method of penetration testing an energy storage system, the method comprising: The method includes: Identify the energy storage system to be tested, which includes a battery management system and an energy management system; Identify each level of the battery management system to determine the configuration information for each level; Vulnerability scanning is performed on each level of the battery management system to identify security vulnerabilities at each level. Based on the configuration information of each level, corresponding attack code is generated for each level's security vulnerabilities and executed. During the execution of attack code at each level, the success probability of each attack code is calculated, and the communication traffic between the energy management system and the battery management system is monitored to identify abnormal traffic behavior. A penetration test report is generated based on the battery management system's various levels and configuration information, attack codes, attack success probabilities, and identified abnormal traffic behaviors.

2. The energy storage system infiltration testing method of claim 1, wherein, The process of identifying each level of the battery management system to determine the configuration information of each level includes: A multi-level scanning strategy is used to perform a full-domain scan of the energy storage system to identify the various levels contained in the battery management system, including the Pack level, Rack level, and Cell level. The configuration files at each level are parsed to extract the battery parameters, configuration environment, and communication protocol corresponding to each level, in order to generate the configuration information corresponding to each level.

3. The penetration testing method for energy storage systems according to claim 1, characterized in that, The process of performing vulnerability scanning on each level of the battery management system to identify security vulnerabilities at each level includes: Identify the open ports at each level, send specific data packets to each open port, and obtain multiple return results; Each returned result is matched with the vulnerability features in the preset vulnerability database to obtain the matching result corresponding to each returned result. Security vulnerabilities are identified at each level based on the matching results.

4. The penetration testing method for an energy storage system according to claim 1, characterized in that, The process of generating corresponding attack code for each level of security vulnerabilities based on the configuration information at each level, and executing the attack code at each level, includes: For each level, security vulnerabilities at that level are classified into multiple vulnerability categories according to their type and triggering mechanism. Based on the configuration information of this level, corresponding attack code snippets are generated for each vulnerability category, and attack code for this level is generated based on the attack code snippets corresponding to each vulnerability category. Once the attack code for each level is generated, the corresponding attack code is executed at each level.

5. The penetration testing method for an energy storage system according to claim 1, characterized in that, The calculation of the attack success probability corresponding to each attack code includes: For each attack code, the attack code is repeatedly executed in the corresponding environment according to the preset total number of attack attempts, and the number of successful attacks is counted. The ratio of the number of successful attacks to the total number of attack attempts is used to obtain the attack success probability corresponding to the attack code.

6. The penetration testing method for an energy storage system according to claim 1, characterized in that, The monitoring of communication traffic between the energy management system and the battery management system to identify abnormal traffic behavior includes: Capture bidirectional communication traffic between the energy management system and the battery management system; A pre-trained flow baseline model is determined, which is obtained by extracting the flow characteristics of the energy management system and the battery management system under normal operating conditions to construct a normal flow behavior baseline; The bidirectional communication traffic is input into the traffic baseline model to obtain the deviation score of each traffic behavior in the bidirectional communication traffic; When the deviation score exceeds a preset threshold, the traffic behavior corresponding to the deviation score is determined to be abnormal traffic behavior.

7. The penetration testing method for an energy storage system according to any one of claims 1 to 6, characterized in that, The penetration test report is generated based on the battery management system's various levels and configuration information, attack code, attack success probability, and identified abnormal traffic behavior, including: Get the preset report template; According to the filling requirements of the report template, information such as the configuration information of each level of the battery management system, attack code, attack success probability, and identified abnormal traffic behavior are integrated. The penetration test report is obtained by filling the report template with the integrated information of each level and its configuration, attack code, attack success probability, and identified abnormal traffic behavior.

8. A penetration testing device for an energy storage system, characterized in that, The device includes: The system determination module is used to determine the energy storage system to be tested, the energy storage system including a battery management system and an energy management system; A hierarchy identification module is used to identify each level of the battery management system in order to determine the configuration information of each level. The attack simulation module is used to perform vulnerability scanning on each level of the battery management system, identify security vulnerabilities at each level, generate corresponding attack code for each level based on the configuration information of each level, and execute the attack code at each level. The anomaly monitoring module is used to calculate the success probability of each attack code during the execution of each level of attack code, and to monitor the communication traffic between the energy management system and the battery management system in order to identify abnormal traffic behavior. The report generation module is used to generate a penetration test report based on the various levels of the battery management system and their configuration information, attack code, attack success probability, and identified abnormal traffic behavior.

9. A storage medium, characterized in that: The storage medium stores computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of the energy storage system penetration testing method as described in any one of claims 1 to 7.

10. A computer device, characterized in that, include: One or more processors, and memory; The memory stores computer-readable instructions, which, when executed by the one or more processors, perform the steps of the energy storage system penetration testing method as described in any one of claims 1 to 7.

Images