Probe detection rule processing method and device for power network security target range

Abstract

The application discloses a kind of probe detection rule processing method and device for power network security target range, it is related to power technology field and power network security field.The method comprises: forming the rule flow of probe detection rule for power network security target range;The rule flow is converted into the standardization semantic description based on target model, and standardization rule file is generated using the standardization semantic description;Standardization rule file is translated into directed acyclic graph, and the legality of directed acyclic graph is checked and topological optimization is carried out, and the directed acyclic graph that topological optimization is completed is compiled into local machine code matched with target platform;Through double-buffer dynamic hot loading mechanism, local machine code is loaded to probe engine, and the currently effective probe detection rule is replaced.The application solves the technical problem that the generation of probe detection rule in the existing power network security target range excessively depends on professional syntax knowledge, thereby leading to the low efficiency of probe detection rule updating.

Description

Technical Field

[0001] This application relates to the field of power technology, and more particularly to the field of power network security. Specifically, it relates to a probe detection rule processing method and apparatus for power network security test ranges. Background Technology

[0002] In the daily operation of power network security test ranges, probe detection rules are the core basis for identifying network attack behaviors. In existing technologies, detection rules usually require security personnel to manually write professional syntax (such as Snort and Suricata rule syntax). The generation of each rule requires the writer to be proficient in rule syntax specifications, protocol field definitions, and attack feature extraction methods.

[0003] However, most frontline industrial control security personnel in the power industry have an operations and maintenance background and generally lack professional rule syntax writing skills. In practice, when new detection rules need to be added or existing rules need to be adjusted to deal with new attacks, it is necessary to rely on a small number of professionals with syntax writing skills to complete the task, making rule generation and updates highly dependent on human experience. At the same time, the complete process from attack feature identification to rule writing, syntax verification, and rule activation is time-consuming, making it difficult to meet the needs of rapid iteration of detection rules in attack and defense drills and real attack scenarios. Therefore, existing technologies suffer from the technical problem of low efficiency in the generation and updating of probe detection rules. Summary of the Invention

[0004] This application provides a method and apparatus for processing probe detection rules in power network security testbeds, which at least solves the technical problem that the generation of probe detection rules in existing power network security testbeds relies too heavily on professional syntax knowledge, resulting in low efficiency in updating probe detection rules.

[0005] According to one aspect of the embodiments of this application, a probe detection rule processing method for a power network security testbed is provided, comprising: responding to a user's drag-and-drop operation on a visual orchestration canvas, selecting multiple components from a component library and placing them on the canvas, and responding to a user's connection operation between components, defining the execution order and logical relationship between components to form a rule flow for probe detection rules for a power network security testbed, wherein the rule flow is a directed flow description composed of components and the connection relationships between components; converting the rule flow into a standardized semantic description based on a target model, and generating a standardized rule file using the standardized semantic description, wherein the target model is a standardized data model used to describe the structure and semantics of probe detection rules; translating the standardized rule file into a directed acyclic graph, and performing legality verification and topology optimization on the directed acyclic graph, compiling the topology-optimized directed acyclic graph into native machine code matching the target platform; and loading the native machine code into the probe engine through a dual-buffer dynamic hot-loading mechanism to replace the currently effective probe detection rules, wherein the dual-buffer dynamic hot-loading mechanism is used to update the probe detection rules by alternately switching between an active buffer and a backup buffer.

[0006] Optionally, the rule flow is converted into a standardized semantic description based on the target model, and a standardized rule file is generated using the standardized semantic description. This includes: extracting basic rule information from the rule flow and mapping the basic rule information to a rule basic information module of the target model, wherein the rule basic information module is used to record the basic attribute information of the probe detection rules; extracting component information from the rule flow and mapping the component information to a rule node list module of the target model, wherein the rule node list module is used to record the node attribute information of each component in the rule flow; extracting connection information between components in the rule flow and mapping the connection information to a sequence flow list module of the target model, wherein the sequence flow list module is used to record the execution order and condition information between components; extracting execution result information from the rule flow and mapping the execution result information to an alarm action definition module of the target model, wherein the alarm action definition module is used to record the output action information after the probe detection rule is triggered; determining the standardized semantic description of the target model based on the rule basic information module, the rule node list module, the sequence flow list module, and the alarm action definition module, and generating a standardized rule file using the standardized semantic description.

[0007] Optionally, the standardized rule file is translated into a directed acyclic graph, including: parsing the standardized rule file and extracting all attributes of rule nodes and sequence flows from the standardized rule file, wherein rule nodes correspond to components in the rule flow and sequence flows correspond to the connections between components; constructing a vertex set and an edge set based on the extracted full attributes of rule nodes and sequence flows, wherein each vertex in the vertex set corresponds to a rule node and each edge in the edge set corresponds to a sequence flow; and constructing a directed acyclic graph using the vertex set and edge set.

[0008] Optionally, the validity check of the directed acyclic graph includes: traversing the vertices in the directed acyclic graph, marking the visit status of each vertex, and determining that a directed cycle exists in the directed acyclic graph when a vertex marked as being visited is encountered during the traversal; determining that no directed cycle exists in the directed acyclic graph when no vertex marked as being visited is encountered during the traversal; if a directed cycle is determined to exist in the directed acyclic graph, the directed acyclic graph fails the validity check, and the vertices involved in the directed cycle are highlighted on the canvas; checking whether the number of incoming edges and outgoing edges of each vertex conforms to the node type rules, where the node type rules refer to the preset constraints on the number of incoming edges and outgoing edges based on the node type; determining that the validity check fails when the number of incoming edges or outgoing edges of any vertex does not conform to the node type rules; and determining that the validity check passes when no directed cycle is detected and the number of incoming edges and outgoing edges of all vertices conforms to the node type rules.

[0009] Optionally, the node type rules include: the number of incoming edges of the start event node should be zero and the number of outgoing edges should be greater than or equal to one, wherein the start event node is a vertex in the directed acyclic graph that represents the start of rule triggering; the number of outgoing edges of the end event node should be zero and the number of incoming edges should be greater than or equal to one, wherein the end event node is a vertex in the directed acyclic graph that represents the end of rule execution; the number of incoming edges of the task node and the gateway node should be greater than or equal to one and the number of outgoing edges should be greater than or equal to one, wherein the task node is a vertex in the directed acyclic graph that represents atomic detection actions, and the gateway node is a vertex in the directed acyclic graph that represents logical branch judgments.

[0010] Optionally, before performing topology optimization on the directed acyclic graph (DAG), the verified DAG is topologically sorted, and vertices are output sequentially in descending order of in-degree to generate a linear execution sequence for the probe detection rules. This linear execution sequence characterizes the linear arrangement of the vertices. Based on the linear execution sequence, parallel branches in the DAG that do not require serial execution are identified. These parallel branches are multiple execution paths in the DAG where there are no data dependencies. Nodes with parallel relationships are marked as parallel execution units, where a parallel execution unit is a group of nodes that execute simultaneously. Based on the marking results of the parallel execution units, the DAG is divided into multiple parallel execution subgraphs, where each subgraph is a substructure composed of nodes in a parallel execution unit and their associated edges.

[0011] Optionally, topology optimization is performed on the directed acyclic graph to optimize the execution efficiency of probe detection rules, including at least one of the following operations: merging consecutive nodes in the directed acyclic graph that do not have branching logic; pre-compiling expressions in the directed acyclic graph that do not depend on runtime data as constants; pruning branch paths in the directed acyclic graph that have constant condition judgments; and deleting nodes in the directed acyclic graph that will not be executed and the edges associated with those nodes.

[0012] Optionally, a dual-buffer dynamic hot-loading mechanism is used to load local machine code into the probe engine to replace the currently effective probe detection rules. This includes: encapsulating the local machine code into a dynamic link library and loading the dynamic link library into the probe engine's spare buffer to complete the loading of the new probe detection rules; calling the initialization interface of the dynamic link library to create the execution context of the probe detection rules and allocate resources, where the execution context refers to the memory space and state variables required for the rules to run in the probe engine; completing the initialization of the spare buffer, so that the probe detection rules in the spare buffer enter the pending state; responding to the switching command, performing an atomic switching operation to switch the initialized spare buffer to the active buffer, and simultaneously switching the original active buffer to the spare buffer, so as to complete the replacement of the currently effective rules by the new probe detection rules, where the atomic switching operation is an uninterrupted one-time buffer role swap operation; using the switched active buffer to process newly received traffic, so as to achieve the immediate effect of the new probe detection rules; and waiting for the rule instance being executed in the original active buffer to finish executing, releasing the resources of the original active buffer to complete the unloading of the old probe detection rules.

[0013] Optionally, when the probe engine is offline, the dynamic link library is encrypted and cached on the local storage medium; after the probe engine comes back online, the version number of the cached dynamic link library is automatically compared with the version number of the probe detection rule currently in effect; if the version number of the cached dynamic link library is found to be inconsistent with the version number of the currently effective probe detection rule, the cached dynamic link library is synchronously loaded into the probe engine, and the synchronous loading status is reported to the management platform.

[0014] Optionally, the component library includes a three-tiered component library, which is a collection of standardized components divided according to their functional hierarchy. The three-tiered component library includes: a basic component library, including at least one of triggering components, parsing components, matching components, logic components, statistical components, and action components; a power-specific component library, including at least one of power protocol parsing components, power business scenario components, and power attack detection components; and a target range exercise-specific component library, including at least one of exercise scenario triggering components, exercise effect evaluation components, and exercise linkage components. Each component in the component library uses a standardized JSON structure to define metadata, where metadata is structured data used to describe the component's attributes and behaviors. The metadata includes the component's unique identifier, type, input / output ports, configuration items, execution logic, and validation rules.

[0015] Optionally, before responding to the user's drag-and-drop operation on the visual orchestration canvas, a target template is selected from a pre-built power scenario rule template library; the components and connection configurations in the target template are imported to generate a rule flow; or, the detection requirements are described in natural language, and the detection requirements are automatically parsed using a power industry-specific large language model to generate corresponding visual orchestration rules.

[0016] Optionally, the power industry-specific large language model is constructed using the following methods: an open-source large language model is used as the base model; a power industry cybersecurity dataset is constructed, which includes at least one of the following: power industry cybersecurity threat intelligence, power proprietary protocol specifications, power industry detection rule base, and power industrial control vulnerability base; the base model is trained based on the power industry cybersecurity dataset to obtain the power industry-specific large language model.

[0017] Optionally, after loading the local machine code into the probe engine, an independent version repository is built for each probe detection rule. The version repository is a data structure used to store the historical versions of the probe detection rule. The version repository includes a main branch storing stable release versions, a development branch storing development versions, a feature branch storing new feature development, and a hotfix branch storing emergency fixes. In response to a user's request to submit a new version rule, a version number conforming to the semantic versioning specification is generated. The semantic versioning specification refers to the naming rule where the version number consists of three parts: a major version number, a minor version number, and a revision number. The new version rule is digitally signed, where the digital signature is an anti-counterfeiting identifier generated by using a cryptographic algorithm for the new version rule. The signed new version rule is stored in the version repository to update the information in the version repository.

[0018] Optionally, network traffic entering the probe engine is acquired, carrying protocol type, source network address, destination network address, and port number. A multi-level hash index for probe detection rules is constructed based on the protocol type, source network address, destination network address, and port number. This multi-level hash index is an index structure organized hierarchically according to protocol type, network address, and port number. Using the multi-level hash index, at least one target probe detection rule matching the network traffic is located from all probe detection rules. At least one target probe detection rule is pre-filtered based on the basic characteristics of the network traffic, retaining the target probe detection rule matching the basic characteristics as the rule to be executed. A complete rule detection is performed on the rule to be executed, generating the detection result.

[0019] Optionally, multiple probe detection rules are obtained, each containing a priority attribute, an applicable scenario attribute, and a triggering condition. A rule conflict detection matrix is ​​constructed based on the priority attribute, applicable scenario attribute, and triggering condition of each probe detection rule. This matrix is ​​a two-dimensional data structure with probe detection rules as rows and columns, and conflict relationships between probe detection rules as matrix elements. The matrix elements are traversed to identify logical conflicts, duplicate detections, and action conflicts among the multiple probe detection rules. When a conflict is identified, a conflict optimization scheme is generated based on a preset resolution strategy. This strategy includes at least one of priority-first, accuracy-first, and minimum range-first approaches. Priority-first approaches retain the probe detection rule with the highest priority, accuracy-first approaches retain the probe detection rule with the highest detection accuracy, and minimum range-first approaches retain the probe detection rule with the smallest applicable condition range. The configuration parameters of the multiple probe detection rules are adjusted according to the conflict optimization scheme to eliminate detection conflicts.

[0020] Optionally, the system detects the state of the training scenario in the target range, including scenario creation events and scenario switching events. When a scenario creation event or scenario switching event is detected, the system loads the probe detection rule set corresponding to the scenario identifier from the rule base based on the scenario identifier of the current training scenario. The loaded probe detection rule set is then distributed to the probe nodes corresponding to the training scenario. The system obtains the attack phase information or red team action information of the current training scenario. Based on the attack phase information or red team action information, the system determines the first probe detection rule to be enabled and the second probe detection rule to be disabled from the probe detection rule set. The system enables the first probe detection rule and disables the second probe detection rule. Based on the attack phase information or red team action information, the system dynamically adjusts the priority of the enabled probe detection rules.

[0021] According to another aspect of this application, a probe detection rule processing device for a power network security testbed is also provided, comprising: a first processing unit, configured to, in response to a user's drag-and-drop operation on a visual arrangement canvas, select multiple components from a component library and place them on the canvas, and, in response to a user's connection operation between components, define the execution order and logical relationship between components to form a rule flow for probe detection rules for a power network security testbed, wherein the rule flow is a directed flow description composed of components and the connection relationships between components; and a second processing unit, configured to convert the rule flow into a standardized semantic description based on a target model, using standardized language... The system consists of four processing units: a first unit generates a standardized rule file, where the target model is a standardized data model used to describe the structure and semantics of probe detection rules; a second unit translates the standardized rule file into a directed acyclic graph (DAG), performs validity checks and topology optimization on the DAG, and compiles the topology-optimized DAG into native machine code that matches the target platform; and a third unit loads the native machine code into the probe engine through a dual-buffer dynamic hot-loading mechanism to replace the currently effective probe detection rules. The dual-buffer dynamic hot-loading mechanism is used to update probe detection rules by alternately switching between an active buffer and a backup buffer.

[0022] According to another aspect of this application, a computer-readable storage medium is also provided, which stores a computer program, wherein when the computer program is executed, the device on which the computer-readable storage medium is located executes the above-described probe detection rule processing method for power network security test range.

[0023] According to another aspect of this application, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to execute the above-described probe detection rule processing method for power network security test ranges.

[0024] According to another aspect of this application, a computer program product is also provided, including a computer program or instructions that, when executed by a processor, implement the above-described probe detection rule processing method for power network security test ranges.

[0025] As described above, the technical solution of this application transforms the process of constructing probe detection rules from writing professional syntax to a visual drag-and-drop connection operation. First, responding to drag-and-drop and connection operations, it uses components and connections to construct the rule flow, replacing the process of manually writing syntax code. Then, through an automated process (converting to a standardized description, generating rule files, translating into a directed acyclic graph, compiling into machine code, and double-buffered hot loading), the rule flow generated through these operations is finally applied to the probe engine. Throughout this process, users only need to drag and drop components and define connections, without writing any professional syntax code; and all subsequent steps, from constructing the rule flow to loading it into the probe engine, are automatically completed by the system. Therefore, the solution of this application helps reduce the dependence of rule generation on professional syntax knowledge, thereby shortening the overall processing time from rule construction to rule application, and thus solving the technical problem of low rule update efficiency caused by excessive reliance on professional syntax knowledge in existing technologies. Attached Figure Description

[0026] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0027] Figure 1 This is a flowchart of an optional probe detection rule processing method for a power network security test range according to an embodiment of this application;

[0028] Figure 2 This is an example diagram of an optional visual arrangement canvas according to an embodiment of this application;

[0029] Figure 3 This is a flowchart of an optional directed acyclic graph construction according to an embodiment of this application;

[0030] Figure 4 This is an optional just-in-time compilation architecture diagram according to an embodiment of this application;

[0031] Figure 5 This is a schematic diagram of an optional double-buffer hot-loading mechanism according to an embodiment of this application;

[0032] Figure 6 This is a probe detection rule processing device for a power network security test range, according to an embodiment of this application. Detailed Implementation

[0033] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0034] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0035] According to an embodiment of this application, an embodiment of a probe detection rule processing method for a power network security test range is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0036] Figure 1 This is a flowchart of an optional probe detection rule processing method for a power network security test range according to an embodiment of this application, such as... Figure 1 As shown, the method includes the following steps:

[0037] Step S101: In response to the user's drag-and-drop operation on the visual arrangement canvas, select multiple components from the component library and place them on the canvas. In response to the user's connection operation between the components, define the execution order and logical relationship between the components to form a rule flow for probe detection rules for power network security test range.

[0038] The rule process is a directed process description consisting of components and the connections between them.

[0039] For example, the visual orchestration canvas is a graphical user interface, and the components are pre-built standardized modules with independent detection functions, such as parsing components for matching specific protocol fields or logic components for determining numerical ranges. Connection operations are used to define the data flow and execution order between different components. The rule flow is essentially a directed flow description, where components constitute the nodes of the directed flow, and the connections between components constitute the directed edges of the directed flow. This directed flow describes the complete logical path from triggering conditions to detection actions and then to result output.

[0040] Optionally, Figure 2 This is an example diagram of an optional visual arrangement canvas according to an embodiment of this application, such as... Figure 2 As shown, users can arrange rules by dragging and dropping components and defining connections in the canvas.

[0041] Specifically, in response to user drag-and-drop operations on the visual orchestration canvas, the probe detection rule processing system selects multiple components from the component library and places them on the canvas. Responding to user operations on connecting components, it defines the execution order and logical relationships between components, forming a rule flow for probe detection rules in power network security test ranges. The rule flow is a directed process description composed of components and their interconnections. The system can be extended to industrial control security scenarios based on the BPMN 2.0 standard, mapping the execution logic of network security probe detection rules one-to-one with BPMN process elements: start events are mapped to rule triggering conditions; task nodes are mapped to atomic detection actions; gateway nodes are mapped to logical branch judgments; end events are mapped to rule execution results; and sequence flows are mapped to execution order and conditions. Furthermore, this system constructs a three-level component library: a basic component library with 42 atomic components; a power-specific component library with 28 dedicated components; and a test range-specific component library including test scenario trigger components, test effect evaluation components, and test linkage components. All components use a standardized JSON structure to define metadata.

[0042] In some embodiments, the probe detection rule processing system provides a blank editing area and a list of components categorized by function on a canvas. The user selects a component for matching source IP addresses by dragging and dropping it onto the canvas, and then drags another component for determining port numbers to the right of the first component. Subsequently, the user draws a line between the two components using the mouse. The system automatically associates the output port of the first component with the input port of the second component based on the direction of the line, thus defining the detection process as matching the source IP address first and then determining the port number.

[0043] In other embodiments, the probe detection rule processing system responds to a user's long-press and drag operation on a component in the component library used for parsing power control protocols on a touchscreen device. It moves the component to a designated position on the canvas and continues to add a component for threshold comparison by dragging with a finger. The user forms a connecting line by sliding between two components. The system automatically recognizes the sliding trajectory and connects the component at the starting point of the trajectory to the component at the ending point. Simultaneously, a configuration window pops up for the user to set connection conditions. Based on these connection conditions, the system defines the logical jump relationship between the two components, thereby completing the construction of the rule flow.

[0044] Step S102: Convert the rule process into a standardized semantic description based on the target model, and use the standardized semantic description to generate a standardized rule file.

[0045] The target model is a standardized data model used to describe the structure and semantics of probe detection rules.

[0046] For example, the target model is a predefined standardized data model used to uniformly describe the structured and semantic information of probe detection rules. Standardized semantic description refers to mapping and expressing each element (including components, connections, configuration parameters, etc.) in the rule flow formed by visual orchestration according to the data structure and field specifications defined by the target model, enabling the same rule flow to be stored and exchanged in a machine-readable standard format. The standardized rule file is a data file containing the aforementioned standardized semantic description.

[0047] In some embodiments, the probe detection rule processing system parses the rule flow orchestrated by the user in the canvas into an object graph in memory, where each component corresponds to a node object and each connection corresponds to a connection object. The system traverses all node objects, generating a node entry for each node object that conforms to the target model definition. This node entry includes a node type identifier, input / output port definitions, and execution parameter key-value pairs. Simultaneously, the system traverses all connection objects, generating a sequence flow entry for each connection object. This sequence flow entry contains a source node reference, a target node reference, and optional transition condition expressions. The system organizes all node entries and sequence flow entries according to the root structure of the target model and serializes them into a standardized rule file in JSON format.

[0048] In other embodiments, the probe detection rule processing system employs a streaming conversion approach, incrementally generating standardized semantic description fragments in real time as the user drags and drops components and draws connections. When a user adds a component to the canvas, the system immediately assigns a unique identifier to the component and looks up a predefined target model template based on the component type, generating a node entry skeleton corresponding to the component and writing it to a temporary buffer. When the user completes the connection operation, the system generates a sequence stream entry containing source and target references based on the unique identifiers of the two components connected by the connection and appends it to the buffer. When the user finally submits the arrangement, the system assembles the set of node entries and the set of sequence stream entries in the buffer into a complete standardized rule file and performs format validation and integrity checks according to the format defined by the target model.

[0049] Step S103: Translate the standardized rule file into a directed acyclic graph (DAG), perform legality verification and topology optimization on the DAG, and compile the topology-optimized DAG into local machine code that matches the target platform.

[0050] For example, a directed acyclic graph (DAG) is a graph data structure consisting of vertices and directed edges. Vertices represent detection actions or logical judgment units in the rule flow, and directed edges represent the execution order and data flow between units. No directed cycles exist in the graph. Validity verification refers to checking the correctness of the DAG's graph structure, including detecting the existence of directed cycles and whether the in-degree and out-degree of each vertex satisfy preset node type constraints. Topology optimization refers to operations that improve execution efficiency by performing equivalent transformations on the graph structure while maintaining the semantics of the DAG. Native machine code refers to an executable instruction sequence that matches the hardware platform and operating system of the target probe engine, and can be directly loaded and executed by the probe engine.

[0051] In some embodiments, the probe detection rule processing system reads a standardized rule file and parses out the node list and sequence stream list. The system iterates through the node list, generating a unique vertex identifier for each node, recording the node type and configuration parameters, and constructing a vertex set. The system iterates through the sequence stream list, generating a directed edge from the source vertex to the target vertex for each sequence stream, and writing it into the edge set. The system constructs a directed acyclic graph (DAG) object in memory based on the vertex set and edge set. Subsequently, the system performs a validity check on the DAG, confirming that there are no directed cycles and that the in-degree and out-degree of each vertex conform to the preset rules for its node type. After the check passes, the system merges and optimizes redundant nodes in the graph and inputs the optimized DAG into the underlying compiler. Based on the CPU architecture information of the target probe engine, the compiler compiles the detection operation corresponding to each vertex in the DAG into one or more native machine code instructions, and compiles the control flow relationships between vertices into jump instructions, ultimately generating a complete executable binary code block.

[0052] In other embodiments, the probe detection rule processing system employs incremental graph construction during the translation of standardized rule files into directed acyclic graphs (DAGs). The system first creates an empty graph object and then reads node entries from the standardized rule file one by one. For each node entry read, the system determines if it is a starting node; if so, it adds it as the root vertex with zero degree. The system continues reading sequence stream entries. For each sequence stream entry read, the system immediately adds a directed edge between the corresponding source and target vertices and locally checks whether the edge introduces a cycle. If a cycle is detected, the system rolls back the edge addition operation and marks the corresponding sequence stream entry in the standardized rule file as illegal. After all nodes and sequence streams have been processed, the system performs topological sorting on the constructed DAG, identifies independent parallel branch structures in the graph, and marks these parallel branches. The system then passes the marked DAG to the just-in-time (JIT) compilation engine, which generates native machine code supporting multi-threaded parallel execution based on the parallel branch marking information, enabling independent detection branches to run in parallel on the probe engine's multi-core processor.

[0053] Optionally, Figure 3 This is a flowchart illustrating an optional directed acyclic graph construction process according to an embodiment of this application, such as... Figure 3As shown, the probe detection rule processing system includes at least the following components: a model parsing unit, a directed graph construction unit, a validity verification unit, a topology sorting unit, an execution optimization unit, and an output result unit. The probe detection rule processing system converts the rule flow into a standardized semantic description based on the YANG model, generating standardized rule files. The core definition of the YANG model includes five modules: a rule basic information module, a rule node list module, a sequence stream list module, an alarm action definition module, and a power test field scenario adaptation module.

[0054] The YANG model parsing unit can read the YANG model instance file corresponding to the rule, parse out all attributes of the rule node and sequence flow, and complete the structured extraction of the original data. The directed graph construction unit can construct the vertex set and edge set of the directed graph based on the parsing results, completing the mapping from the rule flow to the directed graph. The legality verification unit can perform full-dimensional legality verification on the constructed directed graph to ensure the integrity and logical correctness of the rule flow. The topology sorting unit can perform topology sorting on the verified directed graph to generate a linear execution sequence of the rule. The execution optimization unit can optimize the execution efficiency of the topology-sorted directed graph. The output result unit outputs the optimized directed graph and the topology sorting result to the version management module and the just-in-time compilation module. The mathematical model of the directed graph is defined as follows: Let the directed graph corresponding to the rule be G=(V,E), where each vertex in the vertex set V corresponds to a rule node in the YANG model, and each edge in the edge set E corresponds to a sequence flow in the YANG model.

[0055] Step S104: The local machine code is loaded into the probe engine through the dual-buffer dynamic hot-loading mechanism to replace the currently effective probe detection rules. The dual-buffer dynamic hot-loading mechanism is used to update the probe detection rules by alternating between the active buffer and the backup buffer.

[0056] For example, the dual-buffer dynamic hot-loading mechanism refers to the probe engine maintaining two rule execution buffers in memory: an active buffer and a standby buffer. These two buffers can switch roles alternately. The active buffer stores the local machine code of the probe detection rules currently processing traffic and log data; all data entering the probe engine is matched and processed by the rules in the active buffer. The standby buffer stores the local machine code of new rules to be implemented or old rules to be cleaned up. Before the switching operation is executed, the rules in the standby buffer do not participate in data processing. By exchanging the roles of the two buffers, a seamless replacement of old rules by new rules is achieved.

[0057] In some embodiments, the probe detection rule processing system encapsulates the compiled native machine code into a dynamic link library file and sends this file to the target probe engine. Upon receiving the file, the probe engine first performs integrity and signature verification on the dynamic link library. If correct, it loads the library into a spare buffer and calls an initialization function to create the rule context and allocate resources. After initialization, the probe engine performs an atomic pointer swap operation, switching the pointer that originally pointed to the active buffer to the spare buffer, and simultaneously switching the pointer that originally pointed to the spare buffer to the original active buffer. After the swap, newly entering traffic is immediately processed by the rules in the new active buffer, while the rule instances currently executing in the original active buffer continue to execute until completion. Once the rule instance count in the original active buffer reaches zero, the probe engine releases the resources in that buffer and unloads the dynamic link library.

[0058] In other embodiments, the probe detection rule processing system supports atomic hot loading of batch rules. When an update involves multiple probe detection rules, the system packages the local machine code of multiple rules into a single dynamic link library file and sends it to the probe engine. After receiving the packaged file, the probe engine loads all the rules in the packaged file sequentially in the backup buffer and initializes each rule independently. After all rules are loaded, the probe engine performs an atomic buffer switch operation in one go, replacing all the rules in the backup buffer with the currently effective rules. During the operation after the switch, if the probe engine detects an execution exception in a rule in the newly loaded rule set, the system automatically rolls back the buffer switch operation, restores the active buffer to its state before the switch, unloads the exception rule set from the backup buffer, and reports the rollback event and the exception rule identifier to the management platform.

[0059] For example, converting the rule flow into a standardized semantic description based on the target model, and generating a standardized rule file using the standardized semantic description, includes: extracting basic rule information from the rule flow and mapping the basic rule information to a rule basic information module of the target model, wherein the rule basic information module is used to record the basic attribute information of the probe detection rules; extracting component information from the rule flow and mapping the component information to a rule node list module of the target model, wherein the rule node list module is used to record the node attribute information of each component in the rule flow; extracting connection information between components in the rule flow and mapping the connection information to a sequence flow list module of the target model, wherein the sequence flow list module is used to record the execution order and condition information between components; extracting execution result information from the rule flow and mapping the execution result information to an alarm action definition module of the target model, wherein the alarm action definition module is used to record the output action information after the probe detection rule is triggered; determining the standardized semantic description of the target model based on the rule basic information module, the rule node list module, the sequence flow list module, and the alarm action definition module, and generating a standardized rule file using the standardized semantic description.

[0060] For example, the rule basic information module is a logical unit in the target model used to carry global attribute information of the probe detection rules. Basic attribute information includes, but is not limited to, rule name, rule identifier, version number, rule description, applicable scenarios, and priority level. The rule node list module is a logical unit in the target model used to record the various components in the rule flow, with each component corresponding to a node entry. The sequence flow list module is a logical unit in the target model used to record the connection relationships between components, with each connection corresponding to a sequence flow entry. The alarm action definition module is a logical unit in the target model used to describe the response behavior after a rule is triggered, defining the alarm level, alarm content template, reporting target interface, and execution action type.

[0061] In some embodiments, after the user completes rule arrangement and submission, the probe detection rule processing system extracts basic information from the rule attribute configuration area in the canvas and maps the acquired basic information to the corresponding fields in the rule basic information module. Subsequently, the system traverses all component instances in the canvas, reading the unique identifier, component type, user-configured parameter values, and input / output port definitions for each component, and structurally organizing this information into a node entry in the rule node list module. Simultaneously, the system traverses all connections in the canvas, obtaining the source component identifier, target component identifier, and user-set conditional expression for each connection, generating corresponding sequence stream entries, and adding them to the sequence stream list module. The system reads the user-configured alarm output settings, organizing the alarm level, alarm title, and reporting action into entries in the alarm action definition module. Finally, the system assembles the contents of the above four modules according to the unified root structure of the target model to generate a complete standardized rule file.

[0062] In other embodiments, the probe detection rule processing system employs an asynchronous, block-based extraction method, generating standardized rule files in real-time during user orchestration. When a user modifies basic attribute information in the rule attribute panel, the system captures this modification in real-time and dynamically updates the values ​​of the corresponding fields in the rule basic information module. When a user drags a new component from the component library onto the canvas, the system immediately retrieves its node template in the target model from a pre-defined mapping table based on the component's type, fills in the component's current identifier and default parameters, generates a node entry, and appends it to the temporary storage area of ​​the rule node list module. When a user deletes a component from the canvas, the system synchronously removes the corresponding node entry from the rule node list module and iterates through the sequence stream list module to delete all sequence stream entries involving that component's identifier. Upon final submission, the system performs integrity checks on the accumulated content of each module in the temporary storage area, confirming that the required fields in the rule basic information module are not empty, the rule node list module contains at least one node entry, and the source and target of each entry in the sequence stream list module exist in the rule node list module. After successful verification, the system serializes the data into a standardized rule file.

[0063] For example, translating a standardized rule file into a directed acyclic graph includes: parsing the standardized rule file; extracting all attributes of rule nodes and sequence flows from the standardized rule file, wherein rule nodes correspond to components in the rule flow, and sequence flows correspond to connections between components; constructing a vertex set and an edge set based on the extracted full attributes of rule nodes and sequence flows, wherein each vertex in the vertex set corresponds to a rule node, and each edge in the edge set corresponds to a sequence flow; and constructing a directed acyclic graph using the vertex set and edge set.

[0064] For example, the full attributes of a rule node include its unique identifier in the standardized rule file, node type identifier, set of configuration parameter key-value pairs, and definition information of input / output ports. The full attributes of a sequence stream include its unique identifier in the standardized rule file, source node identifier, target node identifier, and execution condition expression. The vertex set is the set of all vertices in the directed acyclic graph, with each vertex carrying the full execution semantics of a rule node. The edge set is the set of all directed edges in the directed acyclic graph, with each edge carrying the transition relationship and condition constraints of a sequence stream.

[0065] In some embodiments, the probe detection rule processing system reads a standardized rule file, calls the parser corresponding to the target model, and extracts a rule node list and a sequence stream list from the file. The system iterates through each node entry in the rule node list, creates a vertex object for each node entry, records the unique identifier, node type, configuration parameters, and execution function reference of the node entry into the vertex object, and stores all vertex objects in a vertex set. The system iterates through each sequence stream entry in the sequence stream list, creates a directed edge object for each sequence stream entry, records the source node identifier and target node identifier of the sequence stream entry, and uses the execution condition expression in the sequence stream entry as the trigger condition for the directed edge, storing all directed edge objects in an edge set. Based on the vertex set and edge set, the system constructs a directed acyclic graph data structure in memory.

[0066] In some other embodiments, the probe detection rule processing system employs an incremental graph construction method. The system first creates an empty graph object, then reads node entries from the standardized rule file one by one. For each node entry read, the system determines if it is a starting node type; if so, it adds the node as the root vertex with zero degree; otherwise, it adds it as a regular vertex. The system continues to read sequence flow entries one by one. For each sequence flow entry, the system establishes a directed edge between the added vertices based on the source and target node identifiers in the entry. After adding each directed edge, the system performs fast loop detection on the local graph region involved by the edge. If a directed cycle is detected, the addition of the directed edge is revoked, and an error message indicating that the sequence flow entry is illegal is recorded in the parsing result. After all node entries and sequence flow entries have been processed, the system outputs the completed directed acyclic graph and an error report of the illegal sequence flow.

[0067] For example, the validity check of a directed acyclic graph includes: traversing the vertices in the directed acyclic graph, marking the visit status of each vertex, and determining that a directed cycle exists in the directed acyclic graph when a vertex marked as being visited is encountered during the traversal; determining that no directed cycle exists in the directed acyclic graph when no vertex marked as being visited is encountered during the traversal; determining that the directed acyclic graph fails the validity check when a directed cycle exists, and highlighting the vertices involved in the directed cycle on the canvas; checking whether the number of incoming edges and outgoing edges of each vertex conforms to the node type rules, where the node type rules refer to the preset constraints on the number of incoming edges and outgoing edges based on the node type; determining that the validity check fails when the number of incoming edges or outgoing edges of any vertex does not conform to the node type rules; and determining that the validity check passes when no directed cycle is detected and the number of incoming edges and outgoing edges of all vertices conforms to the node type rules.

[0068] For example, the access status includes three states: unvisited, being visited, and visited, used to mark the processing progress of each vertex during traversal. A directed cycle is a cyclic path that starts from a vertex, traverses several vertices along directed edges, and returns to the vertex. In graph structures containing directed cycles, the legal execution order of rules cannot be determined. The number of incoming edges represents the number of edges pointing to the vertex, and the number of outgoing edges represents the number of edges originating from the vertex. Node type rules predefine legal value ranges for the number of incoming and outgoing edges for different types of vertices.

[0069] In some embodiments, the probe detection rule processing system selects any unvisited vertex in the directed acyclic graph as the starting point and recursively visits all its successor vertices using a depth-first traversal. During the recursion, the system marks the visiting status of a vertex as "being visited" when it visits it, and marks it as "visited" after completing the recursion of all its successor vertices. When the system traverses to a vertex, if it detects that the visiting status of the vertex is already "being visited," it determines that a directed cycle has been found, immediately terminates the traversal, and marks the validity check as failed. The system records the identifiers of all vertices involved in forming the directed cycle and returns these vertices to the front-end canvas for highlighting.

[0070] In other embodiments, the probe detection rule processing system first performs directed cycle detection on the directed acyclic graph to ensure that there are no circular dependencies in the graph structure. After the directed cycle detection passes, the system can count the number of incoming and outgoing edges for each vertex. For vertices marked as start event nodes, the system checks whether their number of incoming edges is zero and whether their number of outgoing edges is greater than or equal to one; for vertices marked as end event nodes, the system checks whether their number of outgoing edges is zero and whether their number of incoming edges is greater than or equal to one; for vertices marked as task nodes or gateway nodes, the system checks whether their number of incoming and outgoing edges is greater than or equal to one. If the number of incoming or outgoing edges of any vertex does not meet the corresponding node type rule, the system determines that the validity check has failed and locates the vertex. Only when there are no directed cycles in the directed acyclic graph and the number of incoming and outgoing edges of all vertices meets the node type rule does the system determine that the validity check has passed.

[0071] For example, the start event node is a vertex type in the directed acyclic graph representing rule triggering logic. It maps to the starting point in the rule flow and is used to receive external input traffic or log data as the entry point for rule processing. The end event node is a vertex type in the directed acyclic graph representing rule output logic. It maps to the ending point in the rule flow and is used to output detection results or trigger alarm actions. The task node is a vertex type in the directed acyclic graph representing atomic detection operations. It maps to the smallest execution unit in the rule flow and is used to perform single detection actions such as protocol parsing, field extraction, or string matching. The gateway node is a vertex type in the directed acyclic graph representing logical branch judgments. It maps to the conditional branch point in the rule flow and is used to determine the execution path selection based on the truth value of the conditional expression.

[0072] In some embodiments, when constructing a directed acyclic graph, the probe detection rule processing system labels the node type for each vertex according to the type field of the node entry. The system performs checks on the number of incoming and outgoing edges for each start event node, ensuring that its number of incoming edges is zero to guarantee that the node serves as the sole entry point for rule execution; simultaneously, it ensures that its number of outgoing edges is greater than or equal to one to ensure that the rule flow can be passed downstream from the entry point. The system performs checks on each end event node, ensuring that its number of outgoing edges is zero to guarantee that the rule flow terminates at that node; simultaneously, it ensures that its number of incoming edges is greater than or equal to one to guarantee that the node can be reached by upstream nodes. The system performs checks on each task node and gateway node, ensuring that both its number of incoming and outgoing edges are greater than or equal to one to guarantee that these nodes can be triggered and can also pass execution results downstream in the rule flow.

[0073] In other embodiments, the probe detection rule processing system constructs a mapping table between node types and incoming / outgoing edge rules during the legality verification process. Start event nodes correspond to rules with zero in-degree and non-zero out-degree, end event nodes correspond to rules with zero out-degree and non-zero in-degree, and task nodes and gateway nodes correspond to rules with both non-zero in-degree and non-zero out-degree. The system traverses all vertices in the directed acyclic graph. For each vertex, it looks up the corresponding incoming / outgoing edge constraints in the mapping table based on its node type, and compares the actual number of incoming and outgoing edges of that vertex with the constraints. For any vertex that does not meet the constraints, the system records the vertex's identifier and the expected constraints, and feeds the verification result back to the front-end canvas for display.

[0074] For example, before performing topology optimization on the directed acyclic graph (DAG), the verified DAG is topologically sorted, and vertices are output sequentially in descending order of in-degree to generate a linear execution sequence for probe detection rules. This linear execution sequence characterizes the linear arrangement order of the vertices. Based on the linear execution sequence, parallel branches in the DAG that do not require serial execution are identified. These parallel branches are multiple execution paths in the DAG where there are no data dependencies. Nodes with parallel relationships are marked as parallel execution units, where a parallel execution unit is a group of nodes that execute simultaneously. Based on the marking results of the parallel execution units, the DAG is divided into multiple parallel execution subgraphs, where each subgraph is a substructure composed of nodes in a parallel execution unit and their associated edges.

[0075] For example, topological sorting refers to the linear arrangement of all vertices in a directed acyclic graph, such that for each directed edge, the source vertex always appears before the target vertex in the arrangement. In-degree represents the number of edges pointing to a vertex; outputting vertices in descending order of in-degree prioritizes nodes with more dependencies. The linear execution sequence is the list of vertices output by the topological sorting, representing the execution order of nodes in the rule process. Data dependency refers to the association created when the output of one node serves as the input of another node; nodes with data dependencies must be executed sequentially. A parallelizable execution unit is a set of nodes that do not have data dependencies on each other; nodes within this set can be executed simultaneously.

[0076] In some embodiments, after the probe detection rule processing system passes the validity check, it counts the in-degree of each vertex in the directed acyclic graph and adds all vertices with an in-degree of zero to the processing queue. The system repeatedly performs the following operations: taking a vertex from the processing queue and outputting it to the linear execution sequence, decrementing the in-degree of all successor vertices of that vertex by one, and adding any successor vertex to the processing queue if its in-degree becomes zero, until the processing queue is empty. The system constructs a dependency matrix based on the generated linear execution sequence, traverses the dependency matrix to identify vertices without direct or indirect dependencies, and marks these vertices as parallelizable execution units.

[0077] In other embodiments, after completing the topological sorting, the probe detection rule processing system determines the position index of each vertex in the execution sequence based on the linear execution sequence. The system traverses each directed edge in the edge set and constructs a dependency graph based on the position indices of the source and target vertices. The system performs a depth-first traversal of the dependency graph, grouping vertices with the same execution depth and no intersecting dependency paths into the same parallel set. For each parallel set, the system extracts the vertices and the associated edges between them, forming an independent subgraph. The system marks these subgraphs as parallelizable substructures and appends parallel marking information to the attributes of each vertex and edge for subsequent compilation stage parallel code generation.

[0078] For example, topology optimization is performed on a directed acyclic graph to optimize the execution efficiency of probe detection rules, including at least one of the following operations:

[0079] Merge consecutive nodes in a directed acyclic graph that do not have branching logic;

[0080] Pre-compute expressions in a directed acyclic graph that do not depend on runtime data as constants;

[0081] Prune branches in a directed acyclic graph that have constant condition checks.

[0082] Delete nodes in a directed acyclic graph that will not be executed, as well as the edges associated with those nodes.

[0083] For example, consecutive nodes without branching logic refer to multiple nodes on a single path in a directed acyclic graph that are connected end-to-end without any branches or merging in between. These nodes can be merged into composite nodes to reduce execution overhead. Expressions that do not depend on runtime data refer to expressions whose operands are all constants or whose values ​​can be determined at compile time. These expressions can be pre-computed at compile time. Constant condition judgments refer to branch nodes whose value can be determined as either always true or always false at compile time. Always true means that the branch path will definitely be executed, and always false means that the branch path will never be executed. Nodes that will not be executed include nodes that are unreachable from the starting event node and vertices that become isolated nodes after being pruned due to constant condition judgments.

[0084] In some embodiments, the probe detection rule processing system traverses the directed acyclic graph (DAG), identifies directed paths consisting of consecutive nodes without branching logic, merges these consecutive nodes into a single node, and defines the execution function of the merged node as a new function that executes the functions of each original node sequentially. The system traverses all expressions in the DAG, checks whether each expression contains runtime variable references, and for expressions that do not contain runtime variable references, the system calculates the value of the expression during the compilation phase and replaces the expression node with a constant node.

[0085] In other embodiments, the probe detection rule processing system detects condition judgment nodes in a directed acyclic graph and evaluates whether the value of the conditional expression in the condition judgment can be determined during the compilation phase. When the value of the conditional expression is consistently true, the system deletes all subsequent nodes and associated edges of the corresponding false branch in the condition judgment node. When the value of the conditional expression is consistently false, the system deletes all subsequent nodes and associated edges of the corresponding true branch. After completing the above optimization operations, the system deletes all nodes that cannot be reached from the starting event node and isolated nodes without outgoing edges from the directed acyclic graph, and simultaneously deletes all edges associated with these nodes.

[0086] For example, a dual-buffer dynamic hot-loading mechanism is used to load local machine code into the probe engine to replace the currently effective probe detection rule. This includes: encapsulating the local machine code into a dynamic link library and loading the dynamic link library into the probe engine's spare buffer to complete the loading of the new probe detection rule; calling the dynamic link library's initialization interface to create the execution context of the probe detection rule and allocate resources, where the execution context refers to the memory space and state variables required for the rule to run in the probe engine; completing the initialization of the spare buffer, so that the probe detection rule in the spare buffer enters the pending state; responding to the switching instruction, performing an atomic switching operation to switch the initialized spare buffer to the active buffer, and simultaneously switching the original active buffer to the spare buffer, so as to complete the replacement of the currently effective rule by the new probe detection rule, where the atomic switching operation is an uninterrupted one-time buffer role swap operation; using the switched active buffer to process newly received traffic, so as to achieve the immediate effect of the new probe detection rule; and waiting for the rule instance being executed in the original active buffer to finish executing, releasing the resources of the original active buffer to complete the unloading of the old probe detection rule.

[0087] For example, the dynamic link library is an executable file format containing native machine code, encapsulating standard interfaces for probe detection rule initialization, execution, cleanup, and metadata retrieval. The spare buffer is a storage area reserved in the probe engine's memory for loading new rules; rules in this area do not participate in actual traffic processing. The execution context includes the memory space, state variables, configuration parameter cache, and temporary data area required for rule execution; it is the runtime environment in which rules can be executed normally. An atomic switch operation refers to the operation of exchanging the active buffer pointer and the spare buffer pointer within a single machine instruction; this operation cannot be interrupted. The active buffer is the buffer currently processing traffic, containing the currently effective probe detection rules.

[0088] In some embodiments, the probe detection rule processing system encapsulates the compiled native machine code into a standard-format dynamic link library (DLL) and transmits this DLL to the target probe engine over the network. Upon receiving the DLL, the probe engine loads it into a standby buffer, calls the DLL's initialization interface, creates the execution context required for rule execution, and allocates memory resources. After initialization, the probe engine performs an atomic switch operation, switching the standby buffer to the new active buffer and simultaneously switching the original active buffer to the standby buffer. After the switch, newly received traffic is processed by the rules in the new active buffer.

[0089] In other embodiments, the probe detection rule processing system supports hot loading of multiple rules. The probe engine loads multiple dynamic link libraries sequentially in the spare buffer, creating an independent execution context for each dynamic link library. After all dynamic link libraries are loaded and initialized, the probe engine performs an atomic switch operation at once, switching multiple rules to an active state simultaneously. After the switch, the probe engine starts a background thread to monitor the execution progress of the rule instances currently being executed in the original active buffer. When the execution counters of all rule instances reach zero, the cleanup interface of each old rule is called sequentially to release resources, completing the unloading of the old rules.

[0090] Optionally, Figure 4 This is an optional just-in-time compilation architecture diagram according to an embodiment of this application, such as... Figure 4 As shown, this application is based on a general compilation framework and has developed its own just-in-time compilation engine specifically for power industrial control rules. The overall process is divided into three core stages, including:

[0091] During the front-end compilation phase, the front-end compilation unit is responsible for converting the optimized DAG graph and topological sorting results into an intermediate representation (IR) in static single-assignment form.

[0092] During the IR optimization phase, the IR optimization unit performs machine-independent and machine-dependent optimizations on the static single-assignment form of IR. The core optimization strategies include constant propagation and folding, dead code elimination, common subexpression elimination, loop optimization, inlining optimization, instruction scheduling, and memory access optimization.

[0093] In the backend compilation stage, the backend compilation unit is responsible for compiling the optimized IR into native machine code for the target platform. The core process includes instruction selection, register allocation, instruction scheduling, stack frame optimization, machine code generation, linking, and relocation.

[0094] The machine code encapsulation unit can encapsulate the compiled machine code into a dynamic link library, and the national cryptographic signature unit signs the generated dynamic library based on the SM2 national cryptographic algorithm.

[0095] Optionally, Figure 5 This is a schematic diagram of an optional double-buffer hot-loading mechanism according to an embodiment of this application, as shown below. Figure 5 As shown, the probe engine maintains two rule execution buffers to achieve atomic switching between old and new rules. The active buffer stores the currently active rule dynamic library, and all traffic, logs, and events are processed by the rules in this buffer; the standby buffer stores the rule dynamic library to be updated, used for loading and initializing new version rules.

[0096] like Figure 5As shown, the entire process of dynamic hot loading is as follows: The compiled machine code is encapsulated into a standard dynamic link library; after receiving the rule dynamic library, the probe engine first verifies the SM2 digital signature, rule ID, and version number of the dynamic library; the verified new rule dynamic library is loaded into the standby buffer, and the rule initialization interface is called to complete the rule context creation, parameter initialization, and resource allocation; an atomic switch operation is performed to switch the standby buffer to the active buffer, and the original active buffer is switched to the standby buffer. All newly entering traffic, logs, and events are processed by the rules in the new active buffer; after all the rule instances currently being executed in the original active buffer have finished executing, the cleanup interface of the old rule is called to release resources and unload the dynamic library of the old rule; the probe engine reports the rule's effective status, effective time, and node information to the system management platform and outputs alarms.

[0097] For example, when the probe engine is offline, the dynamic link library is encrypted and cached on the local storage medium; after the probe engine comes back online, the version number of the cached dynamic link library is automatically compared with the version number of the probe detection rule currently in effect; if the version number of the cached dynamic link library is found to be inconsistent with the version number of the currently effective probe detection rule, the cached dynamic link library is synchronously loaded into the probe engine, and the synchronous loading status is reported to the management platform.

[0098] For example, offline status refers to a state where the network connection between the probe engine and the management platform is interrupted, and the probe engine cannot receive new rule update instructions from the management platform. Encrypted caching refers to the operation where the probe engine uses a symmetric encryption algorithm to encrypt the received dynamic link libraries and then stores them on the local disk to prevent rule files from being tampered with while offline. The version number is a string identifying the rule version information, with a format of three parts: major version number, minor version number, and revision number, used to compare the relationship between old and new rules. Synchronous loading refers to the process of updating the locally cached rules to the effective buffer after the probe engine comes back online.

[0099] In some embodiments, after the probe engine in the probe detection rule processing system detects a network connection interruption with the management platform, it stores the most recently received dynamic link library in an encrypted manner to a designated local directory. The probe engine periodically checks the network connection status. When the network connection is restored, the probe engine requests the latest version number of the currently effective rule from the management platform and compares the latest version number with the version number of the locally cached rule. If the version number of the locally cached rule is inconsistent with the latest version number, the probe engine loads the locally cached dynamic link library into the backup buffer and performs a hot reload process to complete the rule update, while simultaneously reporting the update result to the management platform.

[0100] In other embodiments, the probe engine in the probe detection rule processing system continues to perform detection tasks using the rules in the currently active buffer while offline. The probe engine caches detection results and alarm data in a local circular buffer and records the rule version number corresponding to each detection result. When the network is restored, the probe engine reports the cached detection results and alarm data to the management platform in batches, and simultaneously reports the rule version number corresponding to each data point for the management platform to audit and trace.

[0101] For example, the component library includes a three-level component library, wherein the three-level component library is a collection of standardized components divided according to the functional hierarchy of the components. The three-level component library includes:

[0102] The basic component library includes at least one of the following: triggering components, parsing components, matching components, logic components, statistical components, and action components. The power-specific component library includes at least one of the following: power protocol parsing components, power business scenario components, and power attack detection components. The target range exercise-specific component library includes at least one of the following: exercise scenario triggering components, exercise effect evaluation components, and exercise linkage components. Each component in the component library uses a standardized JSON structure to define metadata, where metadata is structured data used to describe component attributes and behaviors. The metadata includes the component's unique identifier, type, input / output ports, configuration items, execution logic, and validation rules.

[0103] For example, the three-tier component library is a component organization structure divided according to functional hierarchy. The basic component library provides general detection capabilities, the power-specific component library provides industry-specific capabilities, and the test range-specific component library provides scenario linkage capabilities. JSON structure is a lightweight data exchange format that organizes metadata in key-value pairs. Metadata is structured data describing the essential attributes and behavioral characteristics of components, including the component's unique identifier, type, input / output port definitions, configuration item definitions, execution logic descriptions, and validation rule declarations.

[0104] In some embodiments, the component library of the probe detection rule processing system comprises three layers: a basic component library, a power-specific component library, and a test range-specific component library. Each component in the basic component library defines its metadata in JSON format. A unique identifier in the metadata is used to reference the component in the canvas. The type field indicates whether the component belongs to a trigger, parsing, matching, logic, statistics, or action class. Input / output port definitions declare the data interaction format between the component and preceding / following components. Configuration item definitions declare the user-configurable parameter names, types, and value ranges. The execution logic description declares the core processing function of the component. The verification rules declare the preconditions that the component must meet before use.

[0105] In other embodiments, the probe detection rule processing system supports user-defined extended components. The system provides a component template generation tool. Users fill out a form to input the name of the new component, select its type (basic component, power-specific component, or test range-specific component), define input / output ports, configure parameters and their default values. The system automatically generates metadata definitions conforming to JSON structure specifications based on the user input. The system performs mode validation on the user-generated metadata. After confirming that required fields are fully filled, port types are correctly defined, and configuration items conform to specifications, the system registers the new component's metadata in the corresponding level of the component library. The component can then be dragged and dropped into the canvas for use.

[0106] For example, before responding to the user's drag-and-drop operation on the visual orchestration canvas, a target template is selected from a pre-built power scenario rule template library; the components and connection configurations in the target template are imported to generate a rule flow; or, the detection requirements are described in natural language, and the detection requirements are automatically parsed using a power industry-specific large language model to generate corresponding visual orchestration rules.

[0107] For example, the power scenario rule template library is a pre-built collection of rule templates, where each template contains a pre-configured set of components, the connections between components, and the parameter configuration values ​​for each component. Natural language descriptions refer to the detection requirements expressed by users in everyday language, without containing any professional rule syntax. The power industry-specific large language model is a language model fine-tuned with power industry data, capable of understanding professional terminology and detection logic in the field of power safety.

[0108] In some embodiments, the probe detection rule processing system provides a template library entry button on the canvas interface. Clicking this button displays a list of templates in the power scenario rule template library. The user selects the template that best matches their current detection needs from the list. The system reads the component identifier list, connection definitions between components, and pre-configured parameter values ​​for each component stored in the template, and automatically generates the corresponding component instance and connections on the canvas. The user can then fine-tune the component positions or modify some parameter configurations without having to start from scratch with drag-and-drop arrangement.

[0109] In other embodiments, the probe detection rule processing system provides a natural language input box on the canvas, where users type a description of their detection requirements. The system sends the user-input natural language text to a large language model specific to the power industry. The model parses the semantic information in the text, such as trigger conditions, detection fields, matching rules, and output actions. Based on the parsing results output by the model, the system automatically selects matching component types from the component library, determines the connection order between components, and sets the component configuration parameters, ultimately automatically generating a complete rule flow on the canvas. Users can preview and manually adjust the automatically generated rule flow.

[0110] For example, the power industry-specific large language model is constructed using the following method: an open-source large language model is used as the base model; a power industry cybersecurity dataset is constructed, which includes at least one of the following: power industry cybersecurity threat intelligence, power proprietary protocol specifications, power industry detection rule base, and power industrial control vulnerability base; the base model is trained based on the power industry cybersecurity dataset to obtain the power industry-specific large language model.

[0111] For example, the open-source large language model is a publicly available basic language model with general natural language understanding and generation capabilities. The power industry cybersecurity dataset is a collection of power security-related corpora specifically collected and organized for model fine-tuning. Supervised fine-tuning refers to a method of supervised training of the model using labeled data, enabling the model to learn the input-output mapping relationship of a specific domain. Human feedback reinforcement learning refers to a method of optimizing model parameters based on human evaluation feedback of the model's output, making the model's output more in line with human preferences.

[0112] In some embodiments, the builders of the probe detection rule processing system select an open-source large language model as the base model and prepare a power industry cybersecurity dataset. The data in this dataset consists of paired samples of natural language descriptions and corresponding structured representations of rule processes. The builders employ a supervised fine-tuning method, using the natural language descriptions from the dataset as model input and the corresponding structured representations of rule processes as the expected output, to update and train the base model's parameters, enabling the model to acquire the ability to convert from natural language to rule processes.

[0113] In other embodiments, after supervised fine-tuning, the builders of the probe detection rule processing system further optimize the model using human feedback reinforcement learning. They invite professionals in the power safety field to score and evaluate the multiple rule processes generated by the model, collecting human preference data. Based on this preference data, the builders train a reward model and then use reinforcement learning algorithms to perform secondary optimization on the supervised fine-tuned model, making the rule processes generated by the model more logically correct and practically aligned with the actual needs of the power industry.

[0114] For example, after loading the local machine code into the probe engine, an independent version repository is built for each probe detection rule. The version repository is a data structure used to store the historical versions of the probe detection rule. The version repository includes a main branch storing stable release versions, a development branch storing development versions, a feature branch storing new feature development, and a hotfix branch storing emergency fixes. In response to a user's request to submit a new version rule, a version number conforming to the semantic versioning specification is generated. The semantic versioning specification refers to the naming rule where the version number consists of three parts: a major version number, a minor version number, and a revision number. The new version rule is digitally signed, where the digital signature is an anti-counterfeiting identifier generated by using a cryptographic algorithm. The signed new version rule is stored in the version repository to update the information in the version repository.

[0115] For example, a version repository is a historical version storage structure maintained independently for each probe detection rule, using a directed acyclic graph model to record the derivation relationships between versions. The main branch stores stable versions that have undergone complete testing and verification; versions in this branch are directly loaded by the probe engine by default. The development branch stores versions under development and debugging; versions in this branch are not publicly available. Feature branches store versions developed for specific needs; these are merged into the development branch after development is complete. Hotfix branches store versions that fix urgent issues; these are simultaneously merged into both the main and development branches after the fix is ​​completed. Semantic versioning is the naming standard for version numbers, formatted as major version number, minor version number, and revision number, separated by periods.

[0116] In some embodiments, the probe detection rule processing system creates an independent version repository for each rule, initially containing a main branch and a development branch. When a user needs to add new detection functionality, the system derives a new feature branch from the development branch, where the user orchestrates and debugs rules. After completing development, the user submits a merge request, and the system merges the changes from the feature branch into the development branch. When the rules in the development branch have passed testing and verification and meet the release standards, the user submits a release request, and the system merges the current version of the development branch into the main branch, automatically generating a new version number, with minor version numbers automatically incrementing.

[0117] In other embodiments, after receiving a new version rule submitted by a user, the probe detection rule processing system parses the change type filled in by the user. If the change type is marked as a core logic incompatibility change, the system increments the major version number and resets the minor version number and revision number to zero; if the change type is marked as a backward compatible feature addition, the system increments the minor version number and resets the revision number to zero; if the change type is marked as a backward compatible bug fix, the system only increments the revision number. After generating a complete version number, the system jointly calculates an SM2 digital signature for the rule file, DAG graph file, and canvas metadata file of the new version rule, stores the signature value along with the rule file in the version repository, and records the submitting user identifier and submission timestamp.

[0118] For example, network traffic entering the probe engine is acquired, carrying protocol type, source network address, destination network address, and port number. A multi-level hash index for probe detection rules is constructed based on the protocol type, source network address, destination network address, and port number. This multi-level hash index is an index structure organized hierarchically according to protocol type, network address, and port number. Using the multi-level hash index, at least one target probe detection rule matching the network traffic is located from all probe detection rules. At least one target probe detection rule is pre-filtered based on the basic characteristics of the network traffic, retaining the target probe detection rule matching the basic characteristics as the rule to be executed. A complete rule detection is performed on the rule to be executed, generating the detection result.

[0119] For example, a multi-level hash index is an index structure organized in a hierarchical order of protocol type, source network address, destination network address, and port number. The first-level index key is the protocol type, the second-level index key is the network address, and the third-level index key is the port number. Pre-filtering refers to the process of quickly eliminating mismatched rules based on fundamental characteristics of network traffic. These fundamental characteristics include 5-tuple information and packet length characteristics. Hot and cold data separation storage refers to a strategy of classifying rules into hot and cold data based on their hit frequency and storing them on different media. High-frequency triggered rules reside in memory as hot data, while low-frequency triggered rules are stored on disk as cold data.

[0120] In some embodiments, after receiving network data packets, the probe engine in the probe detection rule processing system extracts the protocol type, source IP address, destination IP address, source port number, and destination port number of the data packets. The probe engine uses the protocol type as the first-level index key to locate the rule subset corresponding to that protocol type; it uses the source IP address and destination IP address as the second-level index key to further narrow down the candidate rule range; and it uses the port number as the third-level index key to finally locate the list of potentially matching rules. The probe engine performs pre-filtering on the located rule list based on basic characteristics such as data packet length and flag bits, excluding rules that clearly do not match the basic characteristics, and only performs complete protocol parsing and feature matching on the remaining rules.

[0121] In other embodiments, the probe engine in the probe detection rule processing system maintains a hit counter for each rule, which increments when a rule is successfully matched. The probe engine scans the hit frequency of all rules at a preset time period, marking rules with a hit frequency above a threshold as "hot rules" and storing them in a rule cache in memory. Rules with a hit frequency below the threshold are marked as "cold rules" and unloaded from memory, retaining only their index information. When a cold rule is frequently hit due to changes in network traffic characteristics, the probe engine loads the rule from disk into the hot rule cache in memory.

[0122] For example, multiple probe detection rules are obtained, each containing a priority attribute, an applicable scenario attribute, and a triggering condition. A rule conflict detection matrix is ​​constructed based on the priority attribute, applicable scenario attribute, and triggering condition of each probe detection rule. This rule conflict detection matrix is ​​a two-dimensional data structure with probe detection rules as rows and columns, and conflict relationships between probe detection rules as matrix elements. The matrix elements in the rule conflict detection matrix are traversed to identify logical conflicts, duplicate detections, and action conflicts among the multiple probe detection rules. When a conflict is identified, a conflict optimization scheme is generated according to a preset resolution strategy. This resolution strategy includes at least one of priority-first, accuracy-first, and minimum range-first approaches. Priority-first is used to retain the probe detection rule with the highest priority, accuracy-first is used to retain the probe detection rule with the highest detection accuracy, and minimum range-first is used to retain the probe detection rule with the smallest applicable condition range. The configuration parameters of the multiple probe detection rules are adjusted according to the conflict optimization scheme to eliminate detection conflicts.

[0123] In some embodiments, before a user publishes a new rule, the probe detection rule processing system acquires the attribute information of all existing and new rules in the system and constructs a rule conflict detection matrix. The system iterates through each element of the matrix, detecting whether the triggering conditions of row and column rules overlap, whether the detection targets overlap, and whether the execution actions are consistent. When a logical conflict is detected between two rules, the system compares their priority attributes, retains the rule with higher priority, and issues a warning to the user. When duplicate detection is detected, the system suggests that the user merge the two rules or disable one of them. When an action conflict is detected, the system prompts the user to manually adjust the rule's execution action definition.

[0124] In other embodiments, the probe detection rule processing system detects real-time conflicts during runtime. When the probe engine matches a traffic flow that simultaneously satisfies multiple rules, the system obtains the priority values, accuracy scores, and applicable scope labels of these rules. The system selects the rule with the highest priority and executes its action according to a priority-first strategy; if priorities are the same, it selects the rule with the highest accuracy score according to an accuracy-first strategy; if accuracy scores are the same, it selects the rule with the narrowest applicable scope according to a minimum scope-first strategy. The system records the identifiers of the selected and unselected rules together in the log for future rule optimization reference.

[0125] For example, the system detects the state of the training scenario in the target range, including scenario creation events and scenario switching events. When a scenario creation event or scenario switching event is detected, the system loads the probe detection rule set corresponding to the scenario identifier from the rule base based on the scenario identifier of the current training scenario. The loaded probe detection rule set is then distributed to the probe nodes corresponding to the training scenario. The system obtains the attack phase information or red team action information of the current training scenario. Based on the attack phase information or red team action information, the system determines the first probe detection rule to be enabled and the second probe detection rule to be disabled from the probe detection rule set. The system enables the first probe detection rule and disables the second probe detection rule. Based on the attack phase information or red team action information, the system dynamically adjusts the priority of the enabled probe detection rules.

[0126] For example, the exercise scenario status includes scenario creation events and scenario switching events. A scenario creation event indicates that a new exercise scenario has been created in the target range, and a scenario switching event indicates that the currently active exercise scenario in the target range has changed. The scenario identifier is a string that uniquely identifies an exercise scenario and is used to index the rule set corresponding to that scenario from the rule base. Attack phase information indicates which stage the current exercise is in: the attack preparation phase, the attack implementation phase, or the post-attack phase. Red team action information indicates the type of attack steps performed by the attacker, including information gathering, vulnerability detection, penetration testing, and privilege escalation. Priority is a numerical value that identifies the importance of a rule; rules with higher priority have higher execution priority during detection.

[0127] In some embodiments, the probe detection rule processing system interfaces with the power network security test range platform and subscribes to event notifications from the test range platform. When the test range platform creates a new training scenario, the system receives a scenario creation event and extracts a scenario identifier from the event. Based on the scenario identifier, the system retrieves the corresponding preset rule set from the rule template library and distributes the rule set to all probe nodes bound to that scenario. When the test range platform switches training scenarios, the system receives a scenario switching event, automatically unloads the rule set of the old scenario from the probe nodes of the current scenario, and loads the rule set corresponding to the new scenario.

[0128] In other embodiments, after the probe detection rule processing system distributes rules to the probe nodes, it receives real-time exercise progress information pushed by the range platform. The system analyzes the current attack phase of the exercise and the type of action recently performed by the red team, identifying rules related to the current attack phase and precise rules directly corresponding to the current red team's actions from the distributed rule set. The system enables these relevant and precise rules and increases their priority scores on the probe node. Simultaneously, the system identifies rules unrelated to the current attack phase, lowers their priority to the lowest level, or temporarily disables them to reduce the processing load on the probe engine.

[0129] According to another aspect of the embodiments of this application, Figure 6 This is a probe detection rule processing device for a power network security test range according to an embodiment of this application, such as... Figure 6As shown, the device includes: a first processing unit 601, configured to, in response to a user's drag-and-drop operation on a visual arrangement canvas, select multiple components from a component library and place them on the canvas, and, in response to a user's connection operation between components, define the execution order and logical relationship between the components to form a rule flow for probe detection rules for a power network security testbed, wherein the rule flow is a directed flow description composed of components and the connection relationships between components; and a second processing unit 602, configured to convert the rule flow into a standardized semantic description based on the target model, and generate a standardized rule file using the standardized semantic description, wherein the target model... The standard model is a standardized data model used to describe the structure and semantics of probe detection rules; the third processing unit 603 is used to translate the standardized rule file into a directed acyclic graph, and to perform legality verification and topology optimization on the directed acyclic graph, and to compile the topology-optimized directed acyclic graph into native machine code that matches the target platform; the fourth processing unit 604 is used to load the native machine code into the probe engine through a dual-buffer dynamic hot-loading mechanism to replace the currently effective probe detection rules, wherein the dual-buffer dynamic hot-loading mechanism is used to update the probe detection rules by alternately switching between the active buffer and the backup buffer.

[0130] Optionally, the second processing unit 602 includes: a first extraction subunit, used to extract basic rule information from the rule flow and map the basic rule information to a rule basic information module of the target model, wherein the rule basic information module is used to record the basic attribute information of the probe detection rule; a second extraction subunit, used to extract component information from the rule flow and map the component information to a rule node list module of the target model, wherein the rule node list module is used to record the node attribute information of each component in the rule flow; a second extraction subunit, used to extract connection information between components in the rule flow and map the connection information to a sequence flow list module of the target model, wherein the sequence flow list module is used to record the execution order and condition information between components; a third extraction subunit, used to extract execution result information from the rule flow and map the execution result information to an alarm action definition module of the target model, wherein the alarm action definition module is used to record the output action information after the probe detection rule is triggered; and a first determination subunit, used to determine the standardized semantic description of the target model based on the rule basic information module, the rule node list module, the sequence flow list module, and the alarm action definition module, and generate a standardized rule file using the standardized semantic description.

[0131] Optionally, the third processing unit 603 includes: a parsing subunit for parsing a standardized rule file and extracting all attributes of rule nodes and sequence streams from the standardized rule file, wherein rule nodes correspond to components in the rule flow and sequence streams correspond to connections between components; a first construction subunit for constructing a vertex set and an edge set based on the extracted all attributes of rule nodes and sequence streams, wherein each vertex in the vertex set corresponds to a rule node and each edge in the edge set corresponds to a sequence stream; and a second construction subunit for constructing a directed acyclic graph using the vertex set and edge set.

[0132] Optionally, the third processing unit 603 includes: a traversal subunit, used to traverse the vertices in the directed acyclic graph, mark the visit status of each vertex, and determine that a directed cycle exists in the directed acyclic graph when a vertex marked as being visited is encountered during the traversal; and determine that no directed cycle exists in the directed acyclic graph when no vertex marked as being visited is encountered during the traversal; a second determination subunit, used to determine that the directed acyclic graph has failed the validity check when a directed cycle is determined to exist in the directed acyclic graph, and to highlight the vertices involved in the directed cycle on the canvas; a detection subunit, used to detect whether the number of incoming edges and outgoing edges of each vertex conforms to the node type rules, wherein the node type rules refer to the preset constraints on the number of incoming edges and outgoing edges based on the node type; a third determination subunit, used to determine that the validity check has failed when the number of incoming edges or outgoing edges of any vertex does not conform to the node type rules; and a fourth determination subunit, used to determine that the validity check has passed when no directed cycle is detected and the number of incoming edges and outgoing edges of all vertices conforms to the node type rules.

[0133] Optionally, the node type rules include: the number of incoming edges of the start event node should be zero and the number of outgoing edges should be greater than or equal to one, wherein the start event node is a vertex in the directed acyclic graph that represents the start of rule triggering; the number of outgoing edges of the end event node should be zero and the number of incoming edges should be greater than or equal to one, wherein the end event node is a vertex in the directed acyclic graph that represents the end of rule execution; the number of incoming edges of the task node and the gateway node should be greater than or equal to one and the number of outgoing edges should be greater than or equal to one, wherein the task node is a vertex in the directed acyclic graph that represents atomic detection actions, and the gateway node is a vertex in the directed acyclic graph that represents logical branch judgments.

[0134] Optionally, the apparatus further includes: a topology sorting unit, used to perform topology sorting on the verified directed acyclic graph, outputting vertices sequentially in descending order of in-degree to generate a linear execution sequence of probe detection rules, wherein the linear execution sequence is used to characterize the linear arrangement order of vertices; an identification unit, used to identify parallel branches in the directed acyclic graph that do not require serial execution based on the linear execution sequence, wherein the parallel branches are multiple execution paths in the directed acyclic graph that do not have data dependencies; a marking unit, used to mark nodes with parallel relationships as parallel execution units, wherein a parallel execution unit is a group of nodes that execute simultaneously; and a partitioning unit, used to partition the directed acyclic graph into multiple parallel execution subgraphs based on the marking results of the parallel execution units, wherein a subgraph is a substructure composed of nodes in the parallel execution units and the associated edges of those nodes.

[0135] Optionally, the third processing unit 603 further includes: a node merging subunit for merging consecutive nodes in the directed acyclic graph that do not have branching logic; a constant calculation subunit for pre-calculating expressions in the directed acyclic graph that do not depend on runtime data as constants; a pruning subunit for pruning branch paths in the directed acyclic graph that have constant condition judgments; and a deletion subunit for deleting nodes in the directed acyclic graph that will not be executed and the edges associated with those nodes.

[0136] Optionally, the fourth processing unit 604 includes: a loading subunit, used to encapsulate local machine code into a dynamic link library and load the dynamic link library into the probe engine's spare buffer to complete the loading of new probe detection rules; an interface call subunit, used to call the initialization interface of the dynamic link library, create the execution context of the probe detection rules and allocate resources, wherein the execution context refers to the memory space and state variables required for the rules to run in the probe engine; an initialization subunit, used to complete the initialization of the spare buffer, so that the probe detection rules in the spare buffer enter the pending state; an atomic switching subunit, used to respond to the switching instruction, perform an atomic switching operation, switch the initialized spare buffer to the active buffer, and at the same time switch the original active buffer to the spare buffer, so as to complete the replacement of the currently effective rule by the new probe detection rule, wherein the atomic switching operation is an uninterrupted one-time buffer role exchange operation; a rule activation subunit, used to use the switched active buffer to process newly received traffic, so as to realize the immediate activation of the new probe detection rule; and a resource release subunit, used to wait for the execution of the rule instance currently being executed in the original active buffer to complete the execution, release the resources of the original active buffer, and complete the unloading of the old probe detection rule.

[0137] Optionally, the device further includes: an encrypted caching unit, used to encrypt and cache the dynamic link library to the local storage medium when the probe engine is offline; a comparison unit, used to automatically compare the version number of the cached dynamic link library with the version number of the probe detection rule currently in effect in the probe engine after the probe engine is brought back online; and a loading unit, used to synchronously load the cached dynamic link library into the probe engine when the version number of the cached dynamic link library is detected to be inconsistent with the version number of the currently effective probe detection rule, and report the synchronous loading status to the management platform.

[0138] Optionally, the component library includes a three-tiered component library, which is a collection of standardized components divided according to their functional hierarchy. The three-tiered component library includes: a basic component library, including at least one of triggering components, parsing components, matching components, logic components, statistical components, and action components; a power-specific component library, including at least one of power protocol parsing components, power business scenario components, and power attack detection components; and a target range exercise-specific component library, including at least one of exercise scenario triggering components, exercise effect evaluation components, and exercise linkage components. Each component in the component library uses a standardized JSON structure to define metadata, where metadata is structured data used to describe the component's attributes and behaviors. The metadata includes the component's unique identifier, type, input / output ports, configuration items, execution logic, and validation rules.

[0139] Optionally, the device further includes: a template selection unit for selecting a target template from a pre-built power scenario rule template library; a rule flow generation unit for importing the component and connection configurations in the target template to generate a rule flow; or, describing the detection requirements in natural language and automatically parsing the detection requirements using a power industry-specific large language model to generate corresponding visual orchestration rules.

[0140] Optionally, the device further includes: a model determination unit for using an open-source large language model as the base model; a dataset construction unit for constructing a power industry cybersecurity dataset, which includes at least one of power industry cybersecurity threat intelligence, power proprietary protocol specifications, power industry detection rule base, and power industrial control vulnerability base; and a model training unit for training the base model based on the power industry cybersecurity dataset to obtain a power industry-specific large language model.

[0141] Optionally, the device further includes: a version repository construction unit, used to build an independent version repository for each probe detection rule, wherein the version repository is a data structure for storing historical versions of the probe detection rule; the version repository includes a main branch storing stable release versions, a development branch storing development versions, a feature branch storing new feature development, and a hotfix branch storing emergency fixes; a version number generation unit, used to generate a version number conforming to the semantic version specification in response to a user's request to submit a new version rule, wherein the semantic version specification refers to a naming rule in which the version number consists of three parts: a major version number, a minor version number, and a revision number; a digital signature unit, used to digitally sign the new version rule, wherein the digital signature refers to an anti-counterfeiting identifier generated by using a cryptographic algorithm for the new version rule; and a rule storage unit, used to store the signed new version rule into the version repository to update the information in the version repository.

[0142] Optionally, the apparatus further includes: a traffic acquisition unit for acquiring network traffic entering the probe engine, the network traffic carrying protocol type, source network address, destination network address, and port number; an index construction unit for constructing a multi-level hash index of probe detection rules based on protocol type, source network address, destination network address, and port number, wherein the multi-level hash index is an index structure organized in hierarchical order according to protocol type, network address, and port number; a rule location unit for using the multi-level hash index to locate at least one target probe detection rule that matches the network traffic from all probe detection rules; a rule filtering unit for pre-filtering at least one target probe detection rule based on the basic characteristics of the network traffic, retaining the target probe detection rule that matches the basic characteristics as the rule to be executed; and a rule detection unit for performing complete rule detection on the rule to be executed and generating detection results.

[0143] Optionally, the device further includes: a rule acquisition unit for acquiring multiple probe detection rules, each probe detection rule containing a priority attribute, an applicable scenario attribute, and a triggering condition; a matrix construction unit for constructing a rule conflict detection matrix based on the priority attribute, applicable scenario attribute, and triggering condition of each probe detection rule, wherein the rule conflict detection matrix is ​​a two-dimensional data structure with probe detection rules as rows and columns and conflict relationships between probe detection rules as matrix elements; an element traversal unit for traversing the matrix elements in the rule conflict detection matrix to identify logical conflicts, duplicate detections, and action conflicts among multiple probe detection rules; a scheme generation unit for generating a conflict optimization scheme based on a preset resolution strategy when a conflict is identified, wherein the resolution strategy includes at least one of priority priority, accuracy priority, and minimum range priority, where priority priority is used to retain the probe detection rule with the highest priority, accuracy priority is used to retain the probe detection rule with the highest detection accuracy, and minimum range priority is used to retain the probe detection rule with the smallest applicable condition range; and a parameter adjustment unit for adjusting the configuration parameters of multiple probe detection rules according to the conflict optimization scheme to eliminate detection conflicts.

[0144] Optionally, the device further includes: a status detection unit for detecting the status of the training scenario in the target range, the training scenario status including scenario creation events and scenario switching events; a rule loading unit for loading a probe detection rule set corresponding to the scenario identifier from the rule base according to the scenario identifier of the current training scenario when a scenario creation event or scenario switching event is detected; a rule distribution unit for distributing the loaded probe detection rule set to the probe node corresponding to the training scenario; a training information acquisition unit for acquiring the attack phase information or red team action information of the current training; a rule selection unit for determining the first probe detection rule to be enabled and the second probe detection rule to be disabled from the probe detection rule set according to the attack phase information or red team action information; a rule execution unit for enabling the first probe detection rule and disabling the second probe detection rule; and a rule adjustment unit for dynamically adjusting the priority of the enabled probe detection rules according to the attack phase information or red team action information.

[0145] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, which stores a computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located executes the above-described probe detection rule processing method for power network security test range.

[0146] According to another aspect of the embodiments of this application, an electronic device is also provided, including one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors cause the one or more processors to execute the above-described probe detection rule processing method for power network security test ranges.

[0147] According to another aspect of the embodiments of this application, a computer program product is also provided, including a computer program or instructions, which, when executed by a processor, implement the above-described probe detection rule processing method for power network security test ranges.

[0148] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0149] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0150] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0151] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0152] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0153] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0154] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for processing probe detection rules for a power network security range, characterized in that, include: In response to the user's drag-and-drop operation on the visual arrangement canvas, multiple components are selected from the component library and placed on the canvas. In response to the user's connection operation between the components, the execution order and logical relationship between the components are defined to form a rule flow for probe detection rules for power network security test range. The rule flow is a directed flow description composed of the components and the connection relationship between the components. The rule process is converted into a standardized semantic description based on the target model, and a standardized rule file is generated using the standardized semantic description. The target model is a standardized data model used to describe the structure and semantics of the probe detection rules. The standardized rule file is translated into a directed acyclic graph (DAG), and the DAG is validated and its topology optimized. The DAG with the optimized topology is then compiled into native machine code that matches the target platform. The local machine code is loaded into the probe engine through a dual-buffer dynamic hot-loading mechanism to replace the currently effective probe detection rules. The dual-buffer dynamic hot-loading mechanism is used to update the probe detection rules by alternately switching between the active buffer and the backup buffer.

2. The method of claim 1, wherein, The rule process is converted into a standardized semantic description based on the target model, and a standardized rule file is generated using the standardized semantic description, including: Extract basic rule information from the rule process and map the basic rule information to the rule basic information module of the target model, wherein the rule basic information module is used to record the basic attribute information of the probe detection rule; Extract component information from the rule flow and map the component information to the rule node list module of the target model, wherein the rule node list module is used to record the node attribute information of each component in the rule flow; Extract the connection information between components in the rule process, and map the connection information to the sequence flow list module of the target model, wherein the sequence flow list module is used to record the execution order and condition information between the components; Extract the execution result information of the rule process, and map the execution result information to the alarm action definition module of the target model, wherein the alarm action definition module is used to record the output action information after the probe detection rule is triggered; Based on the rule basic information module, the rule node list module, the sequence stream list module, and the alarm action definition module, a standardized semantic description of the target model is determined, and a standardized rule file is generated using the standardized semantic description.

3. The method of claim 1, wherein, Translating the standardized rule file into a directed acyclic graph includes: The standardized rule file is parsed, and all attributes of rule nodes and sequence streams are extracted from the standardized rule file, wherein the rule nodes correspond to components in the rule process, and the sequence streams correspond to the connections between the components; Based on the extracted rule nodes and the full attributes of the sequence stream, a vertex set and an edge set are constructed, wherein each vertex in the vertex set corresponds to one rule node, and each edge in the edge set corresponds to one sequence stream; The directed acyclic graph is constructed using the set of vertices and the set of edges.

4. The method of claim 3, wherein, The validity verification of the directed acyclic graph includes: Traverse the vertices in the directed acyclic graph and mark the visit status of each vertex. When a vertex marked as being visited is encountered during the traversal, it is determined that a directed cycle exists in the directed acyclic graph; when no vertex marked as being visited is encountered during the traversal, it is determined that a directed cycle does not exist in the directed acyclic graph. If it is determined that a directed cycle exists in the directed acyclic graph, the directed acyclic graph fails the validity check, and the vertices involved in the directed cycle are highlighted in the canvas. Check whether the number of incoming edges and outgoing edges of each vertex conforms to the node type rules, where the node type rules refer to the preset constraints on the number of incoming edges and outgoing edges based on the node type. If the number of incoming or outgoing edges of any vertex does not conform to the node type rule, it is determined that the validity check has failed. If no directed cycle is detected and the number of incoming and outgoing edges of all vertices conforms to the node type rules, the validity check is deemed to have passed.

5. The method of claim 4, wherein, The node type rules include: The number of incoming edges of the start event node should be zero and the number of outgoing edges should be greater than or equal to one. The start event node is the vertex in the directed acyclic graph that represents the start of rule triggering. The number of outgoing edges of the end event node should be zero and the number of incoming edges should be greater than or equal to one. The end event node is the vertex in the directed acyclic graph that represents the end of rule execution. The number of incoming edges of the task node and the number of outgoing edges of the gateway node are greater than or equal to one. The task node is the vertex representing the atomic detection action in the directed acyclic graph, and the gateway node is the vertex representing the logical branch judgment in the directed acyclic graph.

6. The method of claim 3, wherein, Before performing topology optimization on the directed acyclic graph, the method further includes: The directed acyclic graph that has passed the verification is topologically sorted, and the vertices are output in descending order of in-degree to generate a linear execution sequence of the probe detection rules, wherein the linear execution sequence is used to characterize the linear arrangement order of the vertices; Based on the linear execution sequence, identify parallel branches in the directed acyclic graph that do not require serial execution, wherein the parallel branches are multiple execution paths in the directed acyclic graph that do not have data dependencies. Nodes that have a parallel relationship are marked as parallel execution units, wherein the parallel execution unit is a group of nodes that execute simultaneously; Based on the labeling results of the parallelizable execution unit, the directed acyclic graph is divided into multiple parallelizable subgraphs, wherein each subgraph is a substructure composed of nodes in the parallelizable execution unit and the associated edges of those nodes.

7. The method of claim 3, wherein, Topology optimization is performed on the directed acyclic graph to optimize the execution efficiency of the probe detection rules, including at least one of the following operations: Merge consecutive nodes in the directed acyclic graph that do not have branching logic; The expressions in the directed acyclic graph that do not depend on runtime data are pre-computed as constants; Prune the branch paths in the directed acyclic graph that have constant condition judgments; Delete nodes that will not be executed in the directed acyclic graph, as well as the edges associated with those nodes.

8. The method of claim 1, wherein, The local machine code is loaded into the probe engine through a dual-buffer dynamic hot-loading mechanism, replacing the currently effective probe detection rules, including: The local machine code is encapsulated into a dynamic link library, and the dynamic link library is loaded into the probe engine's spare buffer to complete the loading of new probe detection rules. The initialization interface of the dynamic link library is called to create the execution context of the probe detection rule and allocate resources, wherein the execution context refers to the memory space and state variables required for the rule to run in the probe engine; Complete the initialization of the backup buffer, and put the probe detection rules in the backup buffer into a pending state; In response to the switching command, an atomic switching operation is performed to switch the initialized standby buffer to the active buffer, and at the same time switch the original active buffer to the standby buffer, so as to complete the replacement of the currently effective rule by the new probe detection rule. The atomic switching operation is a one-time buffer role exchange operation that cannot be interrupted. The newly received traffic is processed using the switched active buffer, enabling the new probe detection rules to take effect immediately. After the rule instance currently being executed in the original active buffer has finished executing, release the resources of the original active buffer and complete the unloading of the old probe detection rule.

9. The method of claim 8, wherein, The method further includes: When the probe engine is offline, the dynamic link library is encrypted and cached to the local storage medium; After the probe engine is brought back online, the version number of the cached dynamic link library is automatically compared with the version number of the probe detection rules currently in effect by the probe engine. If the version number of the cached dynamic link library is found to be inconsistent with the version number of the currently effective probe detection rule, the cached dynamic link library will be synchronously loaded into the probe engine, and the synchronous loading status will be reported to the management platform.

10. The method according to claim 1, characterized in that, The component library includes a three-level component library, wherein the three-level component library is a set of standardized components divided according to the functional hierarchy of the components. The three-level component library includes: The basic component library includes at least one of the following: trigger components, parsing components, matching components, logic components, statistics components, and action components. A power-specific component library, including at least one of the following: power protocol parsing components, power business scenario components, and power attack detection components; A dedicated component library for range exercises, including at least one of the following: exercise scenario triggering components, exercise effect evaluation components, and exercise linkage components; Each component in the component library uses a standardized JSON structure to define metadata, which is structured data used to describe the component's attributes and behaviors. The metadata includes the component's unique identifier, type, input / output ports, configuration items, execution logic, and validation rules.

11. The method according to claim 1, characterized in that, Prior to responding to a user's drag-and-drop action on the visual arrangement canvas, the method further includes: Select the target template from the pre-built power scenario rule template library; Import the components and connection configurations from the target template to generate the rule flow; or, describe the detection requirements in natural language, use a power industry-specific large language model to automatically parse the detection requirements, and generate corresponding visual orchestration rules.

12. The method according to claim 11, characterized in that, The power industry-specific large language model is constructed using the following method: The open-source large language model is used as the base model; Construct a cybersecurity dataset for the power industry, which includes at least one of the following: cybersecurity threat intelligence for the power industry, proprietary protocol specifications for the power industry, a detection rule base for the power industry, and a vulnerability database for power industrial control systems. The basic model is trained based on the power industry cybersecurity dataset to obtain the power industry-specific large language model.

13. The method of claim 1, wherein, After loading the local machine code into the probe engine, the method further includes: An independent version repository is built for each probe detection rule. The version repository is a data structure used to store the historical versions of the probe detection rule. The version repository includes a main branch that stores stable release versions, a development branch that stores development versions, a feature branch that stores new feature development, and a hotfix branch that stores emergency fixes. In response to a user's request to submit new version rules, a version number conforming to the semantic versioning specification is generated, wherein the semantic versioning specification refers to the naming rule that the version number consists of three parts: major version number, minor version number, and revision number; The new version of the rule is digitally signed, wherein the digital signature refers to an anti-counterfeiting identifier generated by the new version of the rule using a cryptographic algorithm; The signed new version rule is stored in the version repository to update the information in the version repository.

14. The method of claim 1, wherein, The method further includes: The network traffic entering the probe engine is acquired, and the network traffic carries the protocol type, source network address, destination network address, and port number; Based on the protocol type, the source network address, the destination network address, and the port number, a multi-level hash index is constructed for the probe detection rules, wherein the multi-level hash index is an index structure organized in hierarchical order of protocol type, network address, and port number; Using the multi-level hash index, at least one target probe detection rule that matches the network traffic is located from all the probe detection rules; Based on the basic characteristics of the network traffic, at least one of the target probe detection rules is pre-filtered, and the target probe detection rules that match the basic characteristics are retained as rules to be executed. Perform a complete rule check on the rule to be executed and generate a check result.

15. The method of claim 1, wherein, The method further includes: Obtain multiple probe detection rules, each of which includes priority attributes, applicable scenario attributes, and triggering conditions; Based on the priority attribute, applicable scenario attribute and triggering condition of each probe detection rule, a rule conflict detection matrix is ​​constructed, wherein the rule conflict detection matrix refers to a two-dimensional data structure with probe detection rules as rows and columns and the conflict relationship between probe detection rules as matrix elements; Traverse the matrix elements in the rule conflict detection matrix to identify logical conflicts, duplicate detections, and action conflicts among the multiple probe detection rules; When a conflict is identified, a conflict optimization scheme is generated according to a preset resolution strategy. The resolution strategy includes at least one of priority priority, accuracy priority, and minimum range priority. Priority priority is used to retain the probe detection rule with the highest priority, accuracy priority is used to retain the probe detection rule with the highest detection accuracy, and minimum range priority is used to retain the probe detection rule with the smallest applicable condition range. The configuration parameters of the multiple probe detection rules are adjusted according to the conflict optimization scheme to eliminate detection conflicts.

16. The method of claim 1, wherein, The method further includes: The status of the training scenario at the target range is detected, including scenario creation events and scenario switching events. When the scene creation event or the scene switching event is detected, the probe detection rule set corresponding to the scene identifier is loaded from the rule base according to the scene identifier of the current exercise scene; The loaded probe detection rule set is sent to the probe node corresponding to the exercise scenario; Obtain information about the current attack phase or the red team's actions in the exercise; Based on the attack phase information or the red team action information, determine the first probe detection rule to be enabled and the second probe detection rule to be disabled from the probe detection rule set; Enable the first probe detection rule and disable the second probe detection rule; The priority of enabled probe detection rules is dynamically adjusted based on the attack phase information or the red team action information.

17. A probe detection rule processing apparatus for a power network security range, characterized by, include: The first processing unit is used to respond to the user's drag-and-drop operation on the visual arrangement canvas, select multiple components from the component library and place them on the canvas, and respond to the user's connection operation between the components, define the execution order and logical relationship between the components, and form a rule flow for probe detection rules for power network security test range, wherein the rule flow is a directed flow description composed of the components and the connection relationship between the components. The second processing unit is used to convert the rule process into a standardized semantic description based on the target model, and to generate a standardized rule file using the standardized semantic description, wherein the target model is a standardized data model used to describe the structure and semantics of the probe detection rules; The third processing unit is used to translate the standardized rule file into a directed acyclic graph, perform legality verification and topology optimization on the directed acyclic graph, and compile the topology-optimized directed acyclic graph into native machine code that matches the target platform. The fourth processing unit is used to load the local machine code into the probe engine through a dual-buffer dynamic hot-loading mechanism to replace the currently effective probe detection rules. The dual-buffer dynamic hot-loading mechanism is used to update the probe detection rules by alternately switching between the active buffer and the backup buffer.

18. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein when the computer program is executed, the device containing the computer-readable storage medium performs the probe detection rule processing method for power network security test range as described in any one of claims 1 to 16.

19. An electronic device, comprising: It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to perform the probe detection rule processing method for power network security test ranges as described in any one of claims 1 to 16.

20. A computer program product, characterised in that, It includes a computer program or instructions that, when executed by a processor, implement the probe detection rule processing method for power network security test ranges as described in any one of claims 1 to 16.

Images