Bridge mode operation and maintenance instruction risk detection method and system

Abstract

The application provides a bridge mode operation and maintenance instruction risk detection method and system, relates to the field of power system operation and maintenance safety technology, and comprises the following steps: obtaining original connection information of operation and maintenance traffic in a bridge forwarding path and redirecting to a proxy forwarding module to construct a transparent proxy channel; in the process of forwarding operation and maintenance session data, analyzing the load, extracting operation and maintenance instructions, and constructing an instruction sequence according to a time window; performing timing semantic coding on the instruction sequence to generate a timing semantic fingerprint, and matching the timing semantic fingerprint with a high-risk fingerprint library to determine a risk confidence; determining a risk detection result based on the risk confidence and context factors, and executing a corresponding disposal strategy. The application solves the problems of invisible traffic and lack of sequence-level detection under the bridge mode, and realizes the synchronous execution of transparent proxy and instruction sequence risk detection.

Description

Technical Field

[0001] This application relates to the field of power system operation and maintenance safety technology, specifically to a method and system for detecting risks in bridging mode operation and maintenance instructions. Background Technology

[0002] In the operation and maintenance (O&M) scenarios of power systems and industrial control networks, bridging mode is typically used for network connection to ensure Layer 2 protocol interoperability between O&M terminals and the maintained equipment. However, in bridging mode, O&M traffic is forwarded directly at the data link layer without passing through the network layer packet filtering framework. This prevents security management modules deployed on the host or gateway from capturing O&M traffic, thus hindering effective auditing and risk detection. Even if traffic is obtained through bypass mirroring or network mode modification, existing O&M command risk detection technologies are mostly based on string matching or regular expression rules for single commands, lacking the ability to analyze command context and timing logic. This makes it difficult to identify chain attacks composed of multiple legitimate commands or time-delayed attacks with distributed execution, easily leading to missed detections or false alarms. Therefore, there is an urgent need for a technical solution that can transparently acquire O&M traffic in bridging mode and, based on this, implement command sequence-level risk detection. Summary of the Invention

[0003] To address the issues of existing technologies where operational traffic in bridged mode is invisible and lacks sequence-level risk detection capabilities, this application proposes a method and system for detecting operational commands in bridged mode. This method enables transparent hijacking of operational traffic without altering the bridged network topology and simultaneously performs command sequence risk detection based on temporal semantic fingerprints during proxy forwarding.

[0004] To achieve the above objectives, this application adopts the following technical solution: A method for risk detection of maintenance instructions in bridged mode includes: obtaining the original connection information of maintenance traffic sent by the maintenance terminal in the bridged forwarding path, and redirecting the maintenance traffic to a proxy forwarding module, whereby the proxy forwarding module restores the connection with the maintained object based on the original connection information to construct a transparent proxy channel; during the forwarding of maintenance session data in the transparent proxy channel, parsing the maintenance session payload to extract maintenance instructions, and constructing the maintenance instructions into an instruction sequence according to a preset time window; performing temporal semantic encoding on the instruction sequence to generate a temporal semantic fingerprint, and matching the temporal semantic fingerprint with a high-risk fingerprint database to determine the risk confidence level; determining the risk detection result based on the risk confidence level and context factors, and executing corresponding risk handling strategies on the maintenance traffic according to the risk detection result.

[0005] Preferably, the step of obtaining the original connection information of the maintenance traffic sent by the maintenance terminal in the bridging forwarding path and redirecting the maintenance traffic to the proxy forwarding module includes: introducing the maintenance traffic in the bridging forwarding path into the network layer processing path through the bridging network filtering driver; configuring a log capture target and a destination address translation target in the network filtering rule chain; obtaining the original connection information of the maintenance traffic using the log capture target and notifying the proxy forwarding module; redirecting the maintenance traffic to the proxy forwarding module using the destination address translation target; and having the proxy forwarding module restore the connection with the maintained object based on the original destination address contained in the original connection information.

[0006] Preferably, the step of obtaining the original connection information of the operation and maintenance traffic using the log capture target and notifying the proxy forwarding module includes: the log capture target extracting the original four-tuple information of the operation and maintenance traffic based on physical device matching conditions; sending the original four-tuple information to the user space log process through the kernel log channel; the user space log process sending a protocol proxy request carrying the original four-tuple information to the proxy forwarding module through local inter-process communication; the proxy forwarding module writing the mapping relationship between the original four-tuple information and the target host into a dynamic mapping table; wherein, the proxy forwarding module restoring the connection with the operation and maintenance object based on the original destination address contained in the original connection information includes: the proxy forwarding module querying the dynamic mapping table according to the destination address and port of the redirected operation and maintenance traffic, and establishing a connection with the operation and maintenance object when a match is successful.

[0007] Preferably, the step of introducing maintenance traffic in the bridging forwarding path into the network layer processing path through the bridging network filtering driver includes: the maintenance terminal accessing the bridging network through a virtual network interface card (NIC), the virtual NIC being bridged with a physical NIC; the bridging network filtering driver intercepting maintenance traffic flowing in from the virtual NIC through a registered bridge subsystem hook function, and marking the intercepted maintenance traffic as data packets that need to be processed through the network layer processing path; using physical device matching conditions to distinguish between maintenance terminal traffic flowing in from the virtual NIC and host machine traffic; and judging the same type of traffic processed for the first time based on kernel routing policies, so that subsequent similar traffic reuses the judgment result to optimize the establishment efficiency of the transparent proxy channel.

[0008] Preferably, the proxy forwarding module simultaneously parses the remote login protocol data packet payload to extract operation and maintenance instructions while forwarding the operation and maintenance session data; the process of constructing the instruction sequence is executed synchronously during the forwarding process of the transparent proxy channel.

[0009] Preferably, the step of synchronously parsing the remote login protocol data packet payload to extract operation and maintenance instructions includes: identifying the protocol type to which the remote login protocol data packet payload belongs, the protocol type including SSH protocol or Telnet protocol; when the protocol type is SSH protocol, parsing SSH session channel data to extract encapsulated operating system commands; when the protocol type is Telnet protocol, extracting valid instructions from the network virtual terminal command sequence; recording the instruction content and execution time of each operation and maintenance instruction; wherein, the step of constructing the operation and maintenance instructions into an instruction sequence according to a preset time window includes: tracing back the preset time window from the execution time of the current operation and maintenance instruction as the endpoint, and aggregating the operation and maintenance instructions executed consecutively in chronological order within the window into the instruction sequence.

[0010] Preferably, the step of performing temporal semantic encoding on the instruction sequence to generate a temporal semantic fingerprint, and matching the temporal semantic fingerprint with a high-risk fingerprint database to determine the risk confidence level, includes: mapping each operation and maintenance instruction in the instruction sequence into a dense semantic vector through an embedding function to obtain a vector sequence; performing context encoding on the vector sequence through a temporal encoding model to generate a fixed-dimensional overall sequence representation vector as the temporal semantic fingerprint; calculating the similarity between the temporal semantic fingerprint and each high-risk fingerprint in the high-risk fingerprint database, and determining the highest similarity as the risk confidence level.

[0011] Preferably, the temporal coding model includes a recurrent neural network encoder or a Transformer encoder; the high-risk fingerprint database contains fingerprint vectors corresponding to multiple high-risk operation modes; the method further includes a caching acceleration mechanism: generating sequence digest fingerprints for instruction sequences determined to be low-risk, and storing the sequence digest fingerprints and corresponding determination results in a cache; when a subsequent input instruction sequence hits the cache, the determination result is directly reused and the temporal semantic fingerprint generation and matching steps are skipped; wherein, the cache uses a cache eviction policy to manage the sequence digest fingerprints.

[0012] Furthermore, this application also provides a bridged mode operation and maintenance instruction risk detection system, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the following steps: obtaining the original connection information of the operation and maintenance traffic sent by the operation and maintenance terminal in the bridged forwarding path, and redirecting the operation and maintenance traffic to the proxy forwarding module, which restores the connection with the operation and maintenance object based on the original connection information to build a transparent proxy channel; during the forwarding of operation and maintenance session data in the transparent proxy channel, parsing the operation and maintenance session payload to extract operation and maintenance instructions, and constructing the operation and maintenance instructions into an instruction sequence according to a preset time window; performing temporal semantic encoding on the instruction sequence to generate a temporal semantic fingerprint, and matching the temporal semantic fingerprint with a high-risk fingerprint database to determine the risk confidence level; determining the risk detection result based on the risk confidence level and context factors, and executing corresponding risk handling strategies on the operation and maintenance traffic according to the risk detection result.

[0013] In addition, this application also provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it implements the steps of the bridged mode operation and maintenance instruction risk detection method as described above.

[0014] Beneficial effects: This application solves the technical problem that security modules cannot capture operation and maintenance traffic directly forwarded at the data link layer in bridging mode by obtaining the original connection information in the bridging forwarding path and redirecting the traffic to the proxy forwarding module, and then having the proxy forwarding module restore the connection based on the original connection information. At the same time, by using the constructed transparent proxy channel as an instruction analysis pipeline, instructions are extracted and sequences are constructed synchronously during the forwarding of operation and maintenance session data, realizing the spatiotemporal integration of proxy forwarding and risk detection, avoiding the delay and deployment complexity caused by bypass collection, and ensuring that sequence-level risk detection is completed without changing the bridging usage habits of operation and maintenance terminals.

[0015] By using a bridged network filtering driver to introduce bridging traffic into the network layer processing path, and combining the collaborative work of log capture target and destination address translation target, transparent migration of operation and maintenance traffic from the Layer 2 bridging path to the Layer 3 proxy path is achieved. In particular, by using physical device matching conditions to accurately distinguish between operation and maintenance terminal traffic and host machine traffic, and with the help of a dynamic mapping table mechanism, it is ensured that the proxy forwarding module can accurately restore the original access destination, and achieve a transparent proxy experience with zero client configuration.

[0016] By synchronously parsing the remote login protocol payload and constructing instruction sequences according to time windows during proxy forwarding, risk detection can perceive the temporal dependencies and contextual associations between instructions. Combined with the temporal semantic fingerprint generated by temporal semantic encoding, discrete instruction sequences are mapped into fixed-dimensional vectors representing semantic content and temporal structure. By replacing traditional string rule matching with vector similarity matching, complex and high-risk operation patterns such as combinatorial attacks and delayed attacks are effectively identified, significantly improving the accuracy and robustness of risk detection.

[0017] By introducing a caching acceleration mechanism, a summary fingerprint is generated for low-risk instruction sequences and the judgment result is cached, so that the results can be directly reused for subsequent identical sequences, skipping the complex temporal semantic encoding and matching process. While ensuring detection accuracy, the system's computational overhead is greatly reduced, and the real-time processing capability in high-concurrency operation and maintenance scenarios is improved. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating an embodiment of this application. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0020] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application.

[0021] Example 1: like Figure 1 As shown, this embodiment provides a method for detecting risks in bridged network operation and maintenance commands. This method aims to address the technical problems of difficulty in capturing operation and maintenance traffic and the lack of sequence-level risk analysis capabilities in bridged network environments. The method flow of this embodiment mainly includes the following steps: Step S1: Obtain the original connection information of the operation and maintenance traffic sent by the operation and maintenance terminal in the bridging forwarding path, and redirect the operation and maintenance traffic to the proxy forwarding module. The proxy forwarding module restores the connection with the operation and maintenance object based on the original connection information to build a transparent proxy channel.

[0022] Specifically, bridging forwarding paths typically refer to direct forwarding paths at the data link layer. Under this path, operational traffic often bypasses network layer processing, rendering conventional security detection methods ineffective. This step intervenes in this path to first obtain the original connection information of the operational traffic, such as the original destination IP address and port. This is because subsequent redirection operations modify the destination address of data packets; without pre-saving the original information, the proxy forwarding module cannot determine the target device that the operational personnel truly intend to access. Subsequently, the operational traffic is redirected to the proxy forwarding module, placing it in a processing environment that can be deeply analyzed. Upon receiving the redirected traffic, the proxy forwarding module uses the previously obtained original connection information to initiate a connection to the actual operational object on behalf of the operational terminal, thus establishing a bidirectional transparent proxy channel between the operational terminal and the operational object. It should be understood that this transparent proxy channel construction method eliminates the need for the operational terminal to install any client plugins or modify network configurations, and the operational object perceives the connection source as a legitimate operational terminal, thereby maintaining a seamless operational experience while ensuring security control.

[0023] Step S2: During the forwarding of operation and maintenance session data through the transparent proxy channel, the operation and maintenance session payload is parsed to extract operation and maintenance instructions, and the operation and maintenance instructions are constructed into an instruction sequence according to a preset time window.

[0024] Specifically, the proxy forwarding module not only forwards data but also acts as a pipeline for command analysis, achieving spatiotemporal unification of forwarding and detection. While forwarding maintenance session data, the proxy forwarding module parses the session payload in real time, extracting the operation commands input by maintenance personnel. To avoid missed detections or false alarms caused by analyzing single commands in isolation, this embodiment introduces a time dimension, constructing maintenance commands into command sequences according to preset time windows. For example, starting with the currently intercepted command as the endpoint, a preset time period is traced back, aggregating all commands executed consecutively within that time window into an ordered sequence. This sequence construction method effectively captures the contextual relationships and temporal logic between commands, enabling subsequent analysis to identify chain attack patterns composed of multiple legitimate commands, such as backing up configurations, deleting data, and finally restarting the service, rather than relying solely on feature matching of single commands.

[0025] Step S3: Perform temporal semantic encoding on the instruction sequence to generate a temporal semantic fingerprint, and match the temporal semantic fingerprint with a high-risk fingerprint database to determine the risk confidence level.

[0026] Specifically, temporal semantic fingerprints are vectorized representations of the overall semantic content and temporal structure of an instruction sequence. Their generation is achieved through temporal semantic encoding, mapping discrete text instruction sequences into dense vectors of fixed dimensions. Unlike traditional matching based on regular expressions or keywords, temporal semantic fingerprints can characterize the deep operational intent and behavioral patterns of the instruction sequence. A high-risk fingerprint database pre-stores fingerprint vectors corresponding to various known high-risk operational patterns. These fingerprint vectors are generated by applying the same encoding to historical attack samples or expert experience data. By calculating the similarity between the currently generated temporal semantic fingerprint and each fingerprint in the high-risk fingerprint database, the degree of closeness between the current operational pattern and known high-risk patterns can be quantified, and the highest similarity is determined as the risk confidence level. This approach enables the system to have generalized detection capabilities; even if an attacker performs synonym substitutions or parameter adjustments to the instructions, as long as their behavioral pattern is semantically similar to the high-risk fingerprint, it can still be effectively identified.

[0027] Step S4: Determine the risk detection results based on risk confidence and context factors, and implement corresponding risk handling strategies for operation and maintenance traffic according to the risk detection results.

[0028] Specifically, while risk confidence reflects the high probability of an operational pattern, it is necessary to combine it with contextual factors for comprehensive judgment in order to reduce false alarm rates and adapt to complex operation and maintenance scenarios. Contextual factors may include, but are not limited to, the permission level of the operating user, the time sensitivity of the operation, and the user's historical behavior baseline. For example, for a sensitive sequence of operations performed by a high-privilege user outside of working hours, even if its risk confidence is at a critical value, the overall risk level may be increased. Based on the final risk detection results, the system implements corresponding risk handling strategies for operation and maintenance traffic. These strategies may include real-time connection blocking, sending alarm notifications, recording audit logs, or allowing traffic. Through this multi-dimensional dynamic decision-making mechanism, this embodiment can minimize interference with normal operation and maintenance services while ensuring a bottom line of security.

[0029] Through the coordinated work of steps S1 to S4 above, this embodiment successfully achieves transparent hijacking of operation and maintenance traffic and sequence-level risk detection without changing the existing bridging network topology and operation and maintenance habits. It solves the core problem of lack of security control in bridging mode and provides a basic framework for specific driver implementation, protocol parsing details and algorithm optimization in subsequent embodiments.

[0030] Example 2: In some embodiments, to specifically implement the transparent proxy channel construction mentioned in Embodiment 1, this application provides a more low-level traffic hijacking and forwarding recovery mechanism. Specifically, the maintenance traffic in the bridging forwarding path is introduced into the network layer processing path through the bridging network filtering driver. In the traditional bridging mode, data frames only flow at the data link layer, and the security detection module cannot intervene. This embodiment loads a specific bridging network filtering driver and registers hook functions in the kernel's bridge subsystem, thereby intercepting data packets before they pass through the bridge forwarding decision and forcibly marking them as data packets that need to be processed by the network layer. This mechanism breaks down the isolation barrier between Layer 2 and Layer 3, making bridging traffic that was originally invisible to network layer tools such as iptables able to be matched and processed by rules, laying a data foundation for subsequent security management.

[0031] Based on this, the maintenance terminal accesses the bridged network through a virtual network interface card (NIC), which is bridged to the physical NIC. In one example, the maintenance terminal's virtual machine connects to the virtual NIC tap0, and tap0 then forms a bridge with the host machine's physical NIC. To ensure that only traffic originating from the maintenance terminal is proxied without affecting the host machine's normal communication, this embodiment uses physical device matching conditions to distinguish between traffic from the virtual NIC flowing into the maintenance terminal and traffic from the host machine itself. For example, the ingress interface is specified as tap0 in the network filtering rules; subsequent proxy logic is only triggered when a data packet enters from this specific virtual NIC. This precise matching based on physical devices effectively avoids host network interruptions or proxy loop problems caused by traffic misjudgment.

[0032] After traffic is successfully introduced into the network layer, a log capture target and a destination address translation target need to be configured in the network filtering rule chain. These two targets work together in a custom chain, respectively responsible for information extraction and traffic redirection. Specifically, the log capture target obtains the raw connection information of the operational traffic and notifies the proxy forwarding module. The log capture target extracts the raw four-tuple information of the operational traffic based on physical device matching conditions, specifically the source IP, source port, destination IP, and destination port, and sends this information to the user-space log process through the kernel log channel. Subsequently, the user-space log process sends a protocol proxy request carrying the raw four-tuple information to the proxy forwarding module via local inter-process communication. Using Unix domain sockets instead of TCP / IP sockets for communication not only avoids the additional overhead of the network protocol stack but also ensures the efficiency and security of data transmission between processes within the same host.

[0033] Simultaneously, the Destination Address Translation (DAT) target redirects the maintenance traffic to the proxy forwarding module. The DAT target modifies the destination address and port of the data packet to the local address and port that the proxy forwarding module listens on. Since the actual destination information of the data packet has been modified, the proxy forwarding module must rely on the previously received original connection information to forward correctly. Therefore, the proxy forwarding module writes the mapping relationship between the original four-tuple information and the target host into a dynamic mapping table. When the proxy forwarding module receives the redirected maintenance traffic, it queries this dynamic mapping table based on the destination address and port of the traffic. If a match is found, a connection is established with the maintained object. Through this closed-loop mechanism of first recording the original information, then modifying the destination address, and finally querying the table to restore the connection, true transparent proxying is achieved: the maintenance terminal can access any maintained object without any configuration, and the connection source address seen by the maintained object is still the real address of the maintenance terminal, completely preserving the integrity of the original session.

[0034] Furthermore, to further improve system performance, this embodiment also uses kernel routing policies to determine the type of traffic processed for the first time, allowing subsequent traffic of the same type to reuse the determination result to optimize the establishment efficiency of the transparent proxy channel. Specifically, when a certain type of operational traffic passes through the aforementioned custom chain for the first time, the Linux kernel automatically adjusts the policy in the broute table at the link layer, directly classifying subsequent traffic with the same characteristics as routed traffic rather than bridging traffic. This means that subsequent connections will skip some of the repetitive processing logic at the bridging layer and directly enter the network layer proxy path. This adaptive routing optimization mechanism enables the system to gradually reduce the single-packet processing overhead as the processed traffic increases under long-term operation and high-concurrency scenarios, achieving a dynamic balance between performance and functionality.

[0035] Example 3: In some embodiments, to achieve deep risk awareness of operational activities, the proxy forwarding module simultaneously parses the remote login protocol packet payload to extract operational instructions while forwarding operational session data; the construction of the instruction sequence is executed synchronously during the forwarding process of the transparent proxy channel. Specifically, this synchronous execution mechanism means that instruction extraction and analysis are not achieved through bypass mirroring or asynchronous log collection, but are directly embedded in the main data processing path of the proxy forwarding module. When the proxy forwarding module moves and forwards data packets in memory, it performs protocol-level decoding on the flowing data in real time. This design ensures absolute consistency between risk detection and business forwarding in time and space, avoiding network latency introduced by additional data collection links and preventing instruction context loss or out-of-order issues caused by asynchronous processing, enabling security control to accompany operational operations imperceptibly and in real time.

[0036] Furthermore, to accurately reconstruct the true operational intent of maintenance personnel from complex network traffic, differentiated parsing is required for different remote management protocols. Specifically, this includes identifying the protocol type of the remote login protocol data packet payload, including SSH and Telnet protocols. Due to the significant differences in encapsulation formats between different protocols, general string matching cannot effectively extract commands. When the protocol type is SSH, the SSH session channel data is parsed to extract the encapsulated operating system commands. This is because SSH traffic is usually encrypted, but within the proxy channel, tp_core, acting as a man-in-the-middle, holds the decryption key, enabling it to decrypt the SSL / TLS layer and penetrate into the SSH application layer, extracting the actual user-inputted shell commands from the SSH Channel Data message body, rather than simply seeing the encrypted ciphertext stream. When the protocol type is Telnet, valid commands are extracted from the Network Virtual Terminal (NVT) command sequence. Although Telnet transmits in plaintext, it contains a large number of control characters used to negotiate terminal attributes, and direct extraction would result in significant noise. Therefore, this embodiment uses a state machine to filter out the NVT negotiation bytes, retaining only the valid data segments carrying user input, thereby cleaning up the clean command text.

[0037] After successfully extracting the instructions, the system also needs to record the instruction content and execution time of each operation and maintenance instruction. This is the basic metadata for constructing a temporal semantic fingerprint. The process of constructing an instruction sequence according to a preset time window specifically includes: tracing back the preset time window from the execution time of the current operation and maintenance instruction as the endpoint, and aggregating the operation and maintenance instructions executed consecutively in chronological order within the window into an instruction sequence. This construction logic reflects the deep understanding of the temporal correlation of operation and maintenance behaviors in this application. Traditional detection methods often examine each instruction in isolation, easily missing individual legitimate instructions that, when combined, form high-risk attack patterns. For example, an operations and maintenance personnel executes three instructions in sequence: "backup config," "deleteconfig," and "restart service." Looking at "delete config" alone, this might seem like a normal cleanup operation; however, when it immediately follows "backup" and forms a close temporal sequence with "restart," it constitutes a typical backup, destruction, and restart attack chain or a high-risk misoperation pattern. By tracing back a preset time window from the current instruction as the anchor point, the system can dynamically chain these discrete instructions into a sequence object with a complete semantic context. It should be understood that the size of the preset time window can be adjusted according to the instruction density of the actual operation and maintenance scenario; a longer window can capture longer behavioral chains, while a shorter window is more sensitive to instantaneous high-frequency operations. This sequence construction method based on sliding time windows provides a structured data foundation for subsequently generating temporal semantic fingerprints that can characterize operational intentions, fundamentally solving the blind spot problem of single instruction detection when facing combined attacks and delayed attacks.

[0038] Example 4: In some embodiments, to transform discrete instruction sequences into computable risk indicators, temporal semantic encoding is performed on the instruction sequences to generate temporal semantic fingerprints, and these fingerprints are matched with a high-risk fingerprint database to determine risk confidence. Specifically, this process first maps each operational instruction in the instruction sequence into a dense semantic vector using an embedding function, resulting in a vector sequence. The embedding function converts textual instructions into a computer-processable numerical representation, bringing semantically similar instructions closer together in the vector space. Subsequently, a temporal encoding model is used to contextually encode the vector sequence, generating a fixed-dimensional overall sequence representation vector as the temporal semantic fingerprint. This step is crucial because a single instruction vector cannot reflect the sequential order and logical dependencies between operations; only by capturing the temporal structure within the sequence through a temporal encoding model can a fingerprint truly representing the operational intent be generated.

[0039] In this embodiment, the generation of temporal semantic fingerprints follows the formula below: ; In the formula, To be within the preset time window A built-in sequence of continuous operation and maintenance instructions; This is a timing coding mapping function used to compress variable-length instruction sequences into fixed-length vectors; This refers to the dimension of the fingerprint vector, and its specific value can be preset and adjusted according to the actual balance requirements of detection accuracy and computing resources. The generated fixed-dimensional global sequence representation vector uniquely represents the instruction sequence. The semantic content and temporal structure. It should be understood that this formula expresses the mapping relationship from discrete symbol sequences to continuous vector spaces, and is the mathematical foundation for realizing semantic-level risk detection.

[0040] Regarding the specific implementation of the temporal coding model, this application supports various architectures with temporal modeling capabilities. As a preferred implementation, the temporal coding model includes a recurrent neural network encoder or a Transformer encoder. When using a recurrent neural network (RNN), the encoding process can be represented as follows: ,in For the first The hidden state of the step, For the first The embedding vector of each instruction, and the hidden state at the final time step. That is, as a temporal semantic fingerprint RNN architectures are naturally well-suited for processing variable-length sequence data, effectively capturing long-range dependencies between instructions. In other embodiments, Transformer encoders can be used, leveraging self-attention mechanisms to process sequence data in parallel, thereby enhancing the ability to capture the correlations between key instruction pairs in long sequences. Regardless of the specific model used, the core objective is to generate feature representations that can distinguish between normal operation and maintenance modes and high-risk attack modes.

[0041] After generating the temporal semantic fingerprint, the similarity between the temporal semantic fingerprint and each high-risk fingerprint in the high-risk fingerprint database is calculated, and the highest similarity is determined as the risk confidence score. The high-risk fingerprint database contains fingerprint vectors corresponding to multiple high-risk operation patterns. These vectors are pre-generated by performing the same encoding process on historical attack samples or expert-annotated data. For example, for the typical breach chain of backup, deletion, and restart, the database stores its corresponding standard fingerprint vectors. Using metrics such as cosine similarity, the degree of proximity between the current operation sequence and known high-risk patterns can be quantified. Risk Confidence Score The value typically ranges from 0 to 1, with higher values ​​indicating a greater likelihood that the current operation belongs to the high-risk mode. This vector similarity-based matching method, compared to traditional string exact matching, has stronger generalization capabilities and can identify various attack variants that vary in parameters but are semantically equivalent.

[0042] Furthermore, to avoid misjudgment by a single similarity index in complex scenarios, this embodiment introduces a multi-factor comprehensive evaluation mechanism. Although risk confidence reflects the inherent danger of the operation mode itself, in actual operation and maintenance, the same operation may be performed by users with different permissions at different times, resulting in different risk levels. Therefore, the system determines the risk detection result based on risk confidence and contextual factors. Specifically, the comprehensive risk score is calculated according to the following formula: ; In the formula, This comprehensive risk score is used to ultimately determine whether to trigger blocking. The risk confidence level obtained from the aforementioned temporal semantic fingerprint matching; To determine the user permission coefficient, the value is usually normalized according to the user role level. For example, the value for the root user is higher than that for ordinary maintenance personnel, reflecting the potential destructive power of high-privilege operations. The time sensitivity coefficient is calculated using the following formula: ,in The standard deviation of the time difference between adjacent instructions in an instruction sequence is given by the expression "When". A smaller value indicates a regular operating rhythm and conforms to the characteristics of manual operation. Approaching 1, while when A larger value indicates drastic fluctuations in the operation time interval, which may be due to automated scripts or abnormal behavior. A value close to 0 may lower the score for that item or be flagged as an anomaly. The historical risk coefficient is defined as the ratio of the number of abnormal operations in a user's history to the total number of operations, and is used to characterize the user's long-term behavioral baseline. These are the weight coefficients for each item, satisfying... These weights can be flexibly configured according to the security policies of specific business scenarios. Through this formula, the system combines static pattern matching with dynamic contextual environments, achieving more accurate and adaptive risk quantification.

[0043] Considering that many operations in the operation and maintenance scenario are routine queries or low-risk maintenance, performing complete deep learning encoding and matching for every instruction sequence would incur unnecessary computational overhead. Therefore, this embodiment also includes a caching acceleration mechanism: generating a sequence digest fingerprint for instruction sequences determined to be low-risk, and storing the sequence digest fingerprint and the corresponding determination result in the cache. The sequence digest fingerprint is calculated as follows: This involves hashing the instruction sequence content, a computationally less complex process than temporal semantic encoding. When a subsequent instruction sequence hits the cache, the judgment result is directly reused, skipping the temporal semantic fingerprint generation and matching steps. This results in an order-of-magnitude improvement in response speed when handling highly repetitive normal operation and maintenance traffic. The cache employs a cache eviction strategy to manage sequence digest fingerprints. For example, a Least Recently Used (LRU) strategy can be used, prioritizing the eviction of the least recently accessed entry when the cache space is full, ensuring that the most active instruction pattern in the current session is always retained in the cache. This layered processing architecture, which emphasizes detection and de-caching, significantly optimizes the system's real-time throughput performance while ensuring that high-risk operations are not missed, making it suitable for deployments in resource-constrained environments such as power operation and maintenance gateways.

[0044] Example 5: This embodiment provides a bridged mode operation and maintenance command risk detection system and a computer-readable storage medium, which aims to provide specific hardware carriers and software delivery forms to support the aforementioned method embodiments.

[0045] Specifically, the bridged-mode operation and maintenance instruction risk detection system includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps of the bridged-mode operation and maintenance instruction risk detection method as described in any one of Embodiments 1 to 4. The memory not only stores the program instructions for implementing the above method but also carries critical status data during system operation, such as a dynamic mapping table recording the mapping relationship between original connection information and target hosts, a pre-set high-risk fingerprint database, and cached data for accelerating judgment. The processor, as the core computing and control unit of the system, coordinates the entire process from bridged traffic hijacking, transparent proxy forwarding, instruction sequence parsing to temporal semantic fingerprint matching and risk handling by executing the program instructions in the memory. It should be understood that the processor here can be a general-purpose processor, an application-specific integrated circuit, a field-programmable gate array, or other programmable logic devices, as long as it has the data processing capabilities and network interface control capabilities required to execute the above method; the memory can include volatile memory (such as RAM) and non-volatile memory (such as ROM, EEPROM, flash memory, etc.) to meet different requirements for program loading and data persistence.

[0046] From a functional module perspective, the system logically includes a bridging traffic redirection module, a proxy forwarding module, an instruction sequence construction module, a TSF detection module, and a risk handling module. These modules collaborate through well-defined data interfaces to jointly implement the method flow described in Example 1. Specifically, the bridging traffic redirection module intervenes in the bridging forwarding path at the operating system kernel level. By loading the bridging network filtering driver and configuring the corresponding rule chain, it captures the original connection information of the maintenance traffic and redirects it to user space. This module communicates with the proxy forwarding module through a local inter-process communication mechanism to transmit the original four-tuple information, ensuring that the proxy forwarding module can know the true access purpose. The proxy forwarding module, as the core hub of the system, restores the connection with the maintained object based on the original connection information to build a transparent proxy channel. Simultaneously, during the forwarding of maintenance session data, it synchronously calls the instruction sequence construction module to perform real-time parsing of the payload. The instruction sequence construction module aggregates the parsed discrete instructions into an ordered instruction sequence according to a preset time window and outputs it to the TSF detection module. The TSF detection module performs temporal semantic encoding on the received instruction sequence to generate a fingerprint vector, and performs similarity matching with a high-risk fingerprint database to determine the risk confidence. Then, it calculates a comprehensive risk score by combining context factors. Finally, the risk handling module executes corresponding handling strategies such as allowing, blocking, or issuing alarms on the current operational traffic based on the risk detection results output by the TSF detection module. This modular system design allows the proxy forwarding function and the risk detection function to be tightly coupled within the same process space, ensuring efficient data flow while avoiding the latency and complexity caused by cross-process or cross-device communication. This achieves truly transparent and real-time security management in bridging mode.

[0047] Furthermore, this embodiment also provides a computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it implements the steps of the bridged-mode operation and maintenance instruction risk detection method as described in any one of embodiments 1 to 4. The computer-readable storage medium can be a tangible, non-transitory storage entity, such as a disk, optical disk, read-only memory, random access memory, flash drive, or solid-state drive. When the computer program stored on this medium is loaded into the processor of an electronic device and executed, the electronic device is configured as a system capable of implementing the aforementioned bridged-mode operation and maintenance instruction risk detection method. This implementation allows the technical solution of this application to be delivered not only as an integrated hardware device but also as a standalone software product or firmware upgrade package for distribution and deployment, thereby adapting to the actual application scenarios and procurement needs of different users.

[0048] Example 6: This embodiment provides a specific application scenario of the bridged mode operation and maintenance command risk detection method in a portable operation and maintenance gateway, aiming to demonstrate the practical value and collaborative working mechanism of the technical solutions described in the foregoing embodiments in a real business environment. It should be understood that the portable operation and maintenance gateway and its supporting security management system described in this embodiment are merely illustrative examples and do not constitute a limitation on the scope of protection of this application. The method of this application is also applicable to other types of operation and maintenance auditing equipment, bastion hosts, or security gateway products.

[0049] Specifically, in on-site operation and maintenance scenarios at power system substations or distribution rooms, maintenance personnel typically carry a portable maintenance gateway in the form of a laptop to connect to the local area network where the equipment being maintained resides. This gateway has a built-in x86 architecture processor running a domestically developed operating system, on which virtual machine software is deployed to provide an isolated maintenance terminal environment. The maintenance terminal virtual machine connects to the gateway's physical network port via bridging mode, thus placing it on the same Layer 2 network as the power monitoring equipment or server being maintained. In this environment, the bridging traffic redirection, transparent proxy channel construction, and TSF detection engine described in the aforementioned embodiments are all integrated within the gateway, enabling end-to-end security control without requiring maintenance personnel to install any clients or modify network configurations in the virtual machine.

[0050] In this application scenario, the TSF detection engine deeply integrates with the gateway's existing three-tiered role system and two-factor authentication mechanism. The three-tiered system separates system management, operation and maintenance, and audit supervision permissions. The system administrator is responsible for configuring TSF detection policies and the high-risk fingerprint database; the work supervisor executes specific operation and maintenance operations; and the auditor independently reviews logs. Before starting the operation and maintenance terminal, personnel must complete two-factor authentication via fingerprint recognition and password input. Only after successful authentication is the TSF detection engine activated and the corresponding user permission coefficient (Auth) loaded, ensuring that subsequent risk scoring calculations accurately reflect the current operator's permission level. This binding mechanism of identity authentication and risk detection effectively prevents unauthorized users from bypassing security checks and directly accessing the maintained equipment.

[0051] To address the diverse operational needs of power system maintenance (S&M) sites, this embodiment supports TSF detection collaboration strategies under various S&M modes. In standard S&M mode, the person in charge must submit a work order beforehand, and the S&M session begins after approval. At this time, the TSF detection engine performs real-time risk scoring on each instruction sequence within the transparent proxy channel. If the overall risk score exceeds a preset threshold, the system immediately blocks the current connection and issues a pop-up alarm, while freezing the session until authorization from a higher authority is obtained. In one-click S&M mode enabled in emergency repair scenarios, although the work order approval process is eliminated to improve response speed, the TSF detection engine remains enabled by default, continuously performing sequence-level risk analysis on traffic within the proxy channel. This is thanks to the seamless nature of the transparent proxy channel; even in emergency mode without configured work orders, the safety baseline is still guaranteed, preventing the sacrifice of safety for efficiency. In authorized penetration testing or red-blue team exercises, the system can switch the TSF detection engine to a recording-only observation state. In this state, all instruction sequences that hit high-risk fingerprints and their risk scores are fully recorded in the audit log, but no actual traffic blocking action is executed, thereby comprehensively assessing the effectiveness and coverage of the existing defense system without affecting the continuity of the exercise.

[0052] Furthermore, the TSF detection results are linked with the gateway's unified approval process and audit log system. When the TSF detection engine determines that a certain instruction sequence is high-risk, in addition to real-time blocking, it automatically generates a detailed alarm record containing the instruction content, temporal semantic fingerprint matching details, risk confidence level, and values ​​of various context factors. This record can serve as the basis for triggering a temporary approval process, which can be reviewed online by an administrator with higher privileges to decide whether to allow the operation. Regardless of whether the final outcome is blocking or allowing the operation, all metadata related to TSF detection is written to an immutable audit log for auditors to trace and analyze afterward. This closed-loop linkage mechanism ensures that risk detection based on temporal semantic fingerprints is not merely an isolated technical module, but a core component integrated into the overall operation and maintenance security management system, significantly improving the security control level and compliance audit capabilities of power operation and maintenance sites.

[0053] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for detecting risks in bridging mode operation and maintenance commands, characterized in that, include: The original connection information of the operation and maintenance traffic sent by the operation and maintenance terminal is obtained in the bridging forwarding path, and the operation and maintenance traffic is redirected to the proxy forwarding module. The proxy forwarding module restores the connection with the operation and maintenance object based on the original connection information to build a transparent proxy channel. During the forwarding of operation and maintenance session data through the transparent proxy channel, the operation and maintenance session payload is parsed to extract operation and maintenance instructions, and the operation and maintenance instructions are constructed into an instruction sequence according to a preset time window; The instruction sequence is subjected to temporal semantic encoding to generate a temporal semantic fingerprint, and the temporal semantic fingerprint is matched with a high-risk fingerprint database to determine the risk confidence level; The risk detection result is determined based on the risk confidence level and context factors, and corresponding risk handling strategies are executed on the operation and maintenance traffic according to the risk detection result.

2. The method for detecting risks in bridging mode operation and maintenance instructions according to claim 1, characterized in that, The step of obtaining the original connection information of the maintenance traffic sent by the maintenance terminal in the bridging forwarding path and redirecting the maintenance traffic to the proxy forwarding module includes: The maintenance traffic in the bridging forwarding path is introduced into the network layer processing path by bridging network filtering driver. Configure the log capture target and destination address translation target in the network filtering rule chain; The original connection information of the operation and maintenance traffic is obtained by using the log capture target and then notified to the proxy forwarding module; The operation and maintenance traffic is redirected to the proxy forwarding module using the destination address translation target; The proxy forwarding module restores the connection with the object under maintenance based on the original destination address contained in the original connection information.

3. The method for detecting risks in bridging mode operation and maintenance instructions according to claim 2, characterized in that, The step of obtaining the original connection information of the operation and maintenance traffic using the log capture target and notifying the proxy forwarding module includes: The log capture target extracts the original four-tuple information of the operation and maintenance traffic based on physical device matching conditions; The original quadruple information is sent to the user space log process via the kernel log channel; The user space log process sends a protocol proxy request carrying the original quadruple information to the proxy forwarding module through local inter-process communication. The proxy forwarding module writes the mapping relationship between the original four-tuple information and the target host into a dynamic mapping table; The proxy forwarding module restores the connection with the object under maintenance based on the original destination address contained in the original connection information, including: The proxy forwarding module queries the dynamic mapping table based on the destination address and port of the redirected maintenance traffic, and establishes a connection with the maintenance object when a match is found.

4. The method for detecting risks in bridging mode operation and maintenance instructions according to claim 2, characterized in that, The step of introducing maintenance traffic in the bridging forwarding path into the network layer processing path through bridging network filtering includes: The maintenance terminal accesses the bridged network through a virtual network card, which is bridged to the physical network card; The bridged network filtering driver intercepts the maintenance traffic flowing in from the virtual network card by registering the bridge subsystem hook function, and marks the intercepted maintenance traffic as data packets that need to be processed by the network layer processing path; The physical device matching criteria are used to distinguish between the traffic flowing into the operation and maintenance terminal from the virtual network card and the traffic of the host machine itself; Based on the kernel routing policy, the first batch of similar traffic is judged, and the judgment result is reused for subsequent similar traffic to optimize the establishment efficiency of the transparent proxy channel.

5. The method for detecting risks in bridging mode operation and maintenance instructions according to claim 1, characterized in that, While forwarding the operation and maintenance session data, the proxy forwarding module simultaneously parses the remote login protocol data packet payload to extract operation and maintenance instructions; The process of constructing the instruction sequence is performed synchronously during the forwarding process of the transparent proxy channel.

6. The method for detecting risks in bridging mode operation and maintenance instructions according to claim 5, characterized in that, The synchronous parsing of remote login protocol data packet payloads to extract operation and maintenance instructions includes: Identify the protocol type to which the remote login protocol data packet payload belongs, including the SSH protocol or the Telnet protocol; When the protocol type is SSH, SSH session channel data is parsed to extract the encapsulated operating system commands; When the protocol type is Telnet, extract the valid instructions from the network virtual terminal command sequence; Record the content and execution time of each operation and maintenance command; The step of constructing the maintenance instructions into an instruction sequence according to a preset time window includes: Starting from the execution time of the current operation and maintenance instruction, the preset time window is traced back, and the operation and maintenance instructions executed consecutively in chronological order within the window are aggregated into the instruction sequence.

7. The method for detecting risks in bridging mode operation and maintenance instructions according to claim 1, characterized in that, The step of performing temporal semantic encoding on the instruction sequence to generate a temporal semantic fingerprint, and matching the temporal semantic fingerprint with a high-risk fingerprint database to determine the risk confidence level, includes: The operation and maintenance instructions in the instruction sequence are mapped into dense semantic vectors by an embedding function to obtain a vector sequence. The vector sequence is context-encoded using a temporal coding model to generate a fixed-dimensional overall sequence representation vector as the temporal semantic fingerprint. Calculate the similarity between the temporal semantic fingerprint and each high-risk fingerprint in the high-risk fingerprint database, and determine the highest similarity as the risk confidence level.

8. The method for detecting risks in bridging mode operation and maintenance instructions according to claim 7, characterized in that, The timing coding model includes a recurrent neural network encoder or a Transformer encoder; The high-risk fingerprint database contains fingerprint vectors corresponding to multiple high-risk operation modes. The method also includes a caching acceleration mechanism: For instruction sequences determined to be low-risk, a sequence digest fingerprint is generated, and the sequence digest fingerprint and the corresponding determination result are stored in a cache; When a subsequent input instruction sequence hits the cache, the determination result is directly reused and the temporal semantic fingerprint generation and matching steps are skipped. The cache employs a cache eviction policy to manage the sequence digest fingerprint.

9. A bridged-mode operation and maintenance command risk detection system, characterized in that, Includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps: The original connection information of the operation and maintenance traffic sent by the operation and maintenance terminal is obtained in the bridging forwarding path, and the operation and maintenance traffic is redirected to the proxy forwarding module. The proxy forwarding module restores the connection with the operation and maintenance object based on the original connection information to build a transparent proxy channel. During the forwarding of operation and maintenance session data through the transparent proxy channel, the operation and maintenance session payload is parsed to extract operation and maintenance instructions, and the operation and maintenance instructions are constructed into an instruction sequence according to a preset time window; The instruction sequence is subjected to temporal semantic encoding to generate a temporal semantic fingerprint, and the temporal semantic fingerprint is matched with a high-risk fingerprint database to determine the risk confidence level; The risk detection result is determined based on the risk confidence level and context factors, and corresponding risk handling strategies are executed on the operation and maintenance traffic according to the risk detection result.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the bridge mode operation and maintenance instruction risk detection method as described in any one of claims 1 to 8.

Images