A nc file security detection method and system based on semantic analysis

Abstract

The application relates to the technical field of safety detection control, and discloses an NC file safety detection method and system based on semantic analysis, wherein the method comprises the following steps: acquiring an NC file detection data set; training a semantic prediction model; determining parameters for judging abnormalities based on Ledoit-Wolf shrink estimation, Mahalanobis distance and Soft-DTW calibration; evaluating the NC file to be detected by using the Mahalanobis distance and the Soft-DTW to generate a comprehensive risk index; and outputting a hierarchical disposal instruction through a finite state machine. Compared with the prior art which depends on feature matching and is difficult to capture long-distance dependence between instructions and implicit malicious semantics, especially under the condition that slight instruction tampering can lead to dangerous consequences such as tool collision and overspeed, the technical problem that sequence semantic abnormalities are difficult to identify is solved by the application, the instruction semantics, physical effects and sequence logic are associated, and slight parameter tampering and instruction combination abnormalities can be identified.

Description

Technical Field

[0001] This invention relates to the field of security detection and control technology, and in particular to a method and system for security detection of NC files based on semantic analysis. Background Technology

[0002] Currently, CNC machine tools are performing Before code processing, NC files are typically obtained from local storage or transmitted over the network, and security checks are performed using rule-based feature matching, instruction whitelisting, and syntax verification. These methods scan instruction codes and parameters line by line to determine whether they exceed the legal range or contain prohibited combinations. While they can intercept obvious syntax errors, they cannot model the semantic relationships and processing logic in the instruction sequence, making it difficult to characterize the dynamic context of normal processing behavior.

[0003] For example, attackers can launch attacks by making minor, grammatically compliant modifications to legitimate machining programs, such as fine-tuning the feed rate during continuous linear interpolation, momentarily changing the spindle speed before tool change, or inserting redundant empty cutting paths. Individually, these modifications may not violate safety rules, but their combination can lead to abnormal tool wear or serious accidents such as tool collisions or spindle overspeed. Traditional feature matching methods suffer from high false positive rates because they cannot capture long-distance dependencies between instructions and implicit malicious semantics, and they have almost no ability to detect unknown attacks.

[0004] Therefore, there is an urgent need for a method in NC instruction sequence semantic analysis that can train an LSTM model to generate instruction semantic vectors and define normal processing semantic envelopes. This would enable the identification of anomalies by constructing a normal semantic deviation metric, even when faced with minor instruction tampering that could lead to dangerous consequences such as tool collisions or overspeeding. This would improve the detection rate of distorted malicious instructions and reduce the false alarm rate. Summary of the Invention

[0005] To address the aforementioned technical shortcomings, the present invention aims to propose a semantic analysis-based NC file security detection method. This method addresses the technical problem in existing technologies where feature matching is insufficient to capture long-distance dependencies between instructions and hidden malicious semantics, especially when minor instruction tampering can lead to dangerous consequences such as collisions or overspeeding, thus failing to identify sequence semantic anomalies.

[0006] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: The present invention provides a method for security detection of NC files based on semantic analysis.

[0007] The semantic analysis-based NC file security detection method includes: Step S10: Obtain the NC file detection dataset. Based on the NC file detection dataset, use the instruction vectorization mechanism that combines MurmurHash3 feature hashing and Min-Max normalization to perform the instruction vectorization task and output the instruction joint input vector dataset. Step S20: Based on the instruction joint input vector dataset, a bidirectional long short-term memory network and Bahdanau additive attention fusion mechanism are used to perform the instruction semantic prediction model training task, and the model training result data is output. Step S30: Based on the model training result data, perform the anomaly determination parameter calibration task using the joint calibration mechanism of Mahalanobis distance based on Ledoit-Wolf shrinkage estimation and Soft-DTW, and output the anomaly calibration result data; Step S40: Based on the anomaly calibration results data, perform an online risk assessment task for NC files using the Mahalanobis distance and Soft-DTW joint risk assessment mechanism, and output a comprehensive risk index; Step S50: Based on the comprehensive risk index, a finite state machine hierarchical disposal mechanism is used to execute the risk level disposal task and output disposal operation instructions.

[0008] Preferably, in step S10, the steps of obtaining the NC file detection dataset, and based on the NC file detection dataset, performing the instruction vectorization task using an instruction vectorization mechanism combining MurmurHash3 feature hashing and Min-Max normalization, and outputting the instruction joint input vector dataset, specifically include: Step S101: Extract historical safe NC files, NC files to be detected, and device configuration parameters from the NC file detection dataset. Use regular expressions to remove comments, program segment numbers, blank lines, and redundant spaces from each NC file. Expand each subroutine according to the subroutine call order. Unify the measurement units of each instruction parameter according to the device configuration parameters and output a standardized instruction sequence set. Step S102: Based on the standardized instruction sequence set, divide the instruction code, axis identifier and numerical parameters according to the instruction line, use MurmurHash3 feature hashing to map the instruction code and the axis identifier to a fixed-dimensional encoding space, and retain the numerical parameters and the corresponding parameter identifiers, and output the instruction parsing feature sequence set; Step S103: Based on the instruction parsing feature sequence set, determine the instruction semantic code, spatial composite displacement, feed rate, spindle speed, cutting feed state, rapid traverse state, and process state vector corresponding to each instruction line. Use Min-Max normalization to normalize the spatial composite displacement, feed rate, and spindle speed. Concatenate the normalization result, cutting feed state, rapid traverse state, process state vector, and instruction semantic code to output the instruction joint input vector dataset. The process state vector includes tool number, coordinate system number, machining plane identifier, spindle start / stop identifier, and coolant start / stop identifier; the instruction joint input vector dataset includes a training joint input vector sequence and a calibration joint input vector sequence formed by the historical safety NC file, as well as a test instruction joint input vector sequence formed by the NC file to be tested.

[0009] Preferably, step S20, which involves training an instruction semantic prediction model based on the instruction joint input vector dataset using a bidirectional long short-term memory network and a Bahdanau additive attention fusion mechanism, and outputting the model training result data, specifically includes: Step S201: Extract the training joint input vector sequence from the instruction joint input vector dataset, map the instruction semantic encoding corresponding to each instruction line to instruction semantic embedding vector, map the normalized spatial synthetic displacement, normalized feed rate, normalized spindle speed, cutting feed state and rapid traverse state corresponding to each instruction line to physical effect embedding vector, and concatenate the instruction semantic embedding vector, physical effect embedding vector and process state vector corresponding to the same instruction line to output the training fusion representation sequence set; Step S202: Based on the training fusion representation sequence set, a bidirectional long short-term memory network is used to extract the bidirectional temporal hidden state of each instruction line. Bahdanau additive attention is used to calculate the attention weight of the bidirectional temporal hidden state of each historical moment relative to the current process state vector. The bidirectional temporal hidden state of each historical moment is weighted and aggregated according to the attention weight, and the fusion context sequence set is output. Step S203: Based on the fusion context sequence set, predict the physical effect vector corresponding to the next instruction line. The first three dimensions of the physical effect vector are normalized spatial synthetic displacement, normalized feed rate, and normalized spindle speed, respectively, and the last two dimensions are cutting feed state and rapid traverse state, respectively. Update the model parameters of the bidirectional long short-term memory network and the Bahdanau additive attention using a training loss combining continuous physical quantity prediction error and binary cross-entropy, until a preset training termination condition is met, to obtain the instruction semantic prediction model to be calibrated. Combine the instruction semantic prediction model to be calibrated, the calibration joint input vector sequence, and the detection instruction joint input vector sequence into the model training result data. The preset training termination condition is that the number of training rounds reaches the preset number of training rounds, or the difference in training loss between adjacent training rounds is less than the preset loss difference threshold.

[0010] Preferably, in step S203, the model parameters of the bidirectional long short-term memory network and the Bahdanau additive attention are updated using a training loss combining the prediction error of continuous physical quantities and binary cross-entropy, specifically as follows: ; ; in, For training loss, The number of valid instruction lines in the training joint input vector sequence and Greater than 1, The instruction line time number. is the dimension index of the physical effect vector. The predicted physical effect vector corresponding to the next instruction line is in the th order. Predicted values ​​for each dimension The actual physical effect vector corresponding to the next instruction line is in the th order. The actual value of each dimension; when When the values ​​are 1 to 3, the corresponding dimensions are, in order, the normalized spatial composite displacement, the normalized feed rate, and the normalized spindle speed. When 4 or 5 is selected, the corresponding dimensions are cutting feed state and rapid traverse state, respectively. For the first Each dimension corresponds to a preset dimension weight coefficient, and all preset dimension weight coefficients are non-negative and their sum is 1. It is a binary cross-entropy function. This is the predicted probability of the state occurring. The actual state value is either 0 or 1. As a preset positive number, This represents the natural logarithm function.

[0011] Preferably, step S30, based on the model training result data, employs a joint calibration mechanism of Mahalanobis distance based on Ledoit-Wolf shrinkage estimation and Soft-DTW to perform anomaly determination parameter calibration tasks and output anomaly calibration result data, specifically includes: Step S301: Extract the semantic prediction model of the instruction to be calibrated and the joint input vector sequence of calibration from the model training result data. Use the semantic prediction model of the instruction to be calibrated to obtain the predicted physical effect vector corresponding to the joint input vector sequence of calibration at each time step. Determine the calibration residual vector between each predicted physical effect vector and the corresponding actual physical effect vector. Determine the absolute value of the first-order difference of the feed rate between adjacent time steps. Combine the predicted physical effect vector sequence and the actual physical effect vector sequence according to each historical safety NC file to output the calibration deviation dataset. Step S302: Based on the calibration deviation dataset, the Ledoit-Wolf contraction estimation is used to determine the residual covariance matrix, the Mahalanobis distance is used to determine the multivariate deviation of each calibration residual vector, the 99.9th quantile of each multivariate deviation is determined as the upper limit of the command physical effect residual envelope, and the 99.5th quantile of the absolute value of the first difference of each feed rate is determined as the upper limit of the feed trend continuity envelope; the Soft-DTW is used to determine the sequence alignment distance between each predicted physical effect vector sequence and the corresponding actual physical effect vector sequence, and the maximum value of each sequence alignment distance is determined as the upper limit of the sequence logical alignment envelope, and the anomaly judgment parameter set is output. Step S303: Based on the anomaly determination parameter set, the residual covariance matrix, the upper limit of the residual envelope of the instruction physical effect, the upper limit of the feed trend continuity envelope, and the upper limit of the sequence logical alignment envelope are written into the semantic prediction model of the instruction to be calibrated, and the written instruction semantic prediction model, the anomaly determination parameter set, and the joint input vector sequence of the instruction to be detected are combined into the anomaly calibration result data.

[0012] Preferably, step S40, which involves performing an online risk assessment of NC files based on the anomaly calibration results data using a joint risk assessment mechanism of Mahalanobis distance and Soft-DTW, and outputting a comprehensive risk index, specifically includes: Step S401: Extract the written instruction semantic prediction model and the joint input vector sequence of the instruction to be detected from the anomaly calibration result data. Use the written instruction semantic prediction model to obtain the predicted physical effect vector corresponding to the joint input vector sequence of the instruction to be detected at each time step. Determine the residual vector to be detected between each predicted physical effect vector and the corresponding actual physical effect vector. Determine the absolute value of the first-order difference of the feed rate to be detected between adjacent time steps. Combine the predicted physical effect vector sequence and the actual physical effect vector sequence corresponding to the NC file to be detected to output the deviation dataset to be detected. Step S402: Based on the dataset of deviations to be detected and the set of anomaly judgment parameters, the degree of deviation of each residual vector to be detected is determined by the residual covariance matrix and Mahalanobis distance. Soft-DTW is used to determine the alignment distance of the detected sequence between the predicted physical effect vector sequence and the actual physical effect vector sequence. The degree of deviation of the detected multivariate, the absolute value of the first difference of the detected feed rate, and the alignment distance of the detected sequence are combined into a risk component dataset. Step S403: Based on the risk component dataset, calculate the physical effect deviation score, feed trend mutation score, and sequence logic mismatch score according to the following formula, and then sum the scores by weight to obtain the comprehensive risk index: ; ; ; ; in, The score is based on the deviation of the physical effect. To score the sudden change in the feed trend, The score is given for logical mismatch of the sequence. As a comprehensive risk index, To pre-set the physical effect deviation weighting coefficient, To preset the feed trend change weighting coefficient, The preset sequence logical mismatch weighting coefficient is used, and , and All three are non-negative and their sum is 1; The number of valid time points in the joint input vector sequence of the instruction to be detected and Greater than 1, For time sequence number, For the first The degree of deviation of the multivariate to be detected at each time point The upper limit of the residual envelope of the physical effect of the instruction. For the first The absolute value of the first-order difference of the feed rate to be detected at each time step. The upper limit of the continuity envelope of the feed trend. Let be the alignment distance of the sequence to be detected. The upper bound of the logical alignment envelope of the sequence. As a preset positive number, Represents the natural logarithm function. This indicates the operation of finding the maximum value.

[0013] Preferably, step S50, which involves executing risk level handling tasks using a finite state machine hierarchical handling mechanism based on the comprehensive risk index and outputting handling operation instructions, specifically includes: Step S501: Compare the comprehensive risk index with preset high-risk threshold, preset medium-risk threshold, and preset low-risk threshold respectively; when the comprehensive risk index is greater than or equal to the preset high-risk threshold, determine a high-risk level; when the comprehensive risk index is less than the preset high-risk threshold but greater than or equal to the preset medium-risk threshold, determine a medium-risk level; when the comprehensive risk index is less than the preset medium-risk threshold but greater than or equal to the preset low-risk threshold, determine a low-risk level; when the comprehensive risk index is less than the preset low-risk threshold, determine a safety level and output a risk level identifier. Step S502: Based on the risk level identifier, map the high-risk level to the prohibited loading state, the medium-risk level to the isolated audit state, the low-risk level to the record confirmation state, and the security level to the normal loading state, and output the target handling state; Step S503: Generate the handling operation instruction according to the target handling state; in the prohibited loading state, generate a program prohibited loading instruction and trigger an alarm; in the isolation audit state, generate a program isolation instruction and send an audit request to the manufacturing execution system; in the record confirmation state, generate an abnormal record instruction, and generate a controlled loading instruction after receiving a confirmation signal from the operator; in the normal loading state, generate a normal loading instruction. Among them, the preset high-risk threshold is greater than the preset medium-risk threshold, and the preset medium-risk threshold is greater than the preset low-risk threshold.

[0014] This invention also provides a semantic analysis-based NC file security detection system, the semantic analysis-based NC file security detection system comprising: The instruction vectorization module is used to acquire the NC file detection dataset. Based on the NC file detection dataset, the instruction vectorization task is performed using an instruction vectorization mechanism that combines MurmurHash3 feature hashing and Min-Max normalization, and the instruction joint input vector dataset is output. The model training module is used to perform instruction semantic prediction model training tasks based on the instruction joint input vector dataset, using a bidirectional long short-term memory network and a Bahdanau additive attention fusion mechanism, and output model training result data. The parameter calibration module is used to perform anomaly detection parameter calibration tasks based on the model training result data, using a joint calibration mechanism of Mahalanobis distance based on Ledoit-Wolf shrinkage estimation and Soft-DTW, and output anomaly calibration result data. The risk assessment module is used to perform online risk assessment of NC files based on the anomaly calibration results data, using a joint risk assessment mechanism of Mahalanobis distance and Soft-DTW, and output a comprehensive risk index. The graded handling module is used to execute risk level handling tasks based on the comprehensive risk index using a finite state machine graded handling mechanism, and output handling operation instructions.

[0015] The present invention also provides a semantic analysis-based NC file security detection device, the semantic analysis-based NC file security detection device comprising: a memory, a processor, and a semantic analysis-based NC file security detection program stored in the memory and executable on the processor, wherein the semantic analysis-based NC file security detection program implements the above method when executed by the processor.

[0016] The present invention also provides a computer program product, the computer program product including a semantic analysis-based NC file security detection program, which implements the above method when executed by a processor.

[0017] The beneficial effects of this invention are as follows: 1. This invention standardizes historical safety NC files, NC files to be tested, and equipment configuration parameters, reconstructs the actual instruction flow according to the subroutine call order, and uses MurmurHash3 feature hashing to map instruction codes and axis identifiers to a fixed-dimensional encoding space, while retaining numerical parameters and their identifiers. Based on this, it further determines the spatially synthesized displacement, feed rate, spindle speed, cutting feed state, rapid traverse state, and process state vectors, and performs Min-Max normalization on continuous physical quantities to form a joint instruction input vector dataset. This compresses irrelevant differences caused by comments, program segment numbers, writing formats, and units of measurement, while preserving the textual semantics, physical intensity, and process state of each instruction. This allows minor parameter modifications that remain within the legal range but are inconsistent with previous and subsequent processing stages to form identifiable differences on a unified feature scale.

[0018] 2. This invention utilizes a bidirectional long short-term memory network to extract the bidirectional temporal hidden states of the instruction sequence. Bahdanau additive attention is then used to weight and aggregate historical hidden states based on the current process state. This allows the model to select historical instruction information relevant to the current machining stage by considering tool, coordinate system, machining plane, spindle, and coolant conditions, improving the prediction of the physical effects of the next instruction under long-distance instruction dependencies and process state switching conditions. After model training, Ledoit-Wolf contraction estimation is further employed to obtain a stable residual covariance matrix. The upper limit of the instruction physical effect residual envelope is determined by the 99.9th quantile of the Mahalanobis distance, the upper limit of the feed trend continuity envelope is determined by the 99.5th quantile of the absolute value of the first-order difference of the feed rate, and the upper limit of the sequence logic alignment envelope is determined by the maximum Soft-DTW sequence alignment distance of the safe program. This ensures that the normal machining boundary simultaneously reflects the correlation of multivariate physical effects, local speed changes, and complete program logic, reducing false alarms and false negatives caused by a single fixed threshold.

[0019] 3. In the online detection phase, this invention calculates physical effect deviation scores, feed trend mutation scores, and sequence logic mismatch scores based on Mahalanobis distance, the absolute value of the first-order difference of feed speed, and Soft-DTW sequence alignment distance, respectively. These scores are then combined into a comprehensive risk index according to preset non-negative weights, enabling single-line parameter deviations, continuous speed anomalies, and program rhythm mismatches scattered across multiple instructions to be evaluated collaboratively on the same risk scale. Subsequently, a finite state machine is used to sequentially map the comprehensive risk index to states of prohibited loading, isolation audit, record confirmation, and normal loading, generating program prohibited loading instructions, program isolation instructions, anomaly records, and controlled loading instructions or normal loading instructions, respectively. This ensures that the detection results generate clear control actions before the NC file enters the CNC machine's execution queue. Attached Figure Description

[0020] Figure 1 This is a flowchart illustrating the first embodiment of a semantic analysis-based NC file security detection method of the present invention. Detailed Implementation

[0021] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0022] Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] Example 1: As Figure 1The diagram shown is a flowchart of a first embodiment of a semantic analysis-based NC file security detection method according to the present invention, which presents a first embodiment of the semantic analysis-based NC file security detection method of the present invention.

[0024] In the first embodiment, the NC file security detection method based on semantic analysis includes: Step S10: Obtain the NC file detection dataset. Based on the NC file detection dataset, use the instruction vectorization mechanism that combines MurmurHash3 feature hashing and Min-Max normalization to perform the instruction vectorization task and output the instruction joint input vector dataset. The NC file detection dataset is a collection of three types of data inputs used for training, parameter calibration, and online detection. It includes historical safe NC files, NC files to be detected, and equipment configuration parameters. Historical safe NC files provide the instruction sequence and physical effect changes under known normal machining conditions. NC files to be detected are target programs for which risk assessment needs to be completed before loading them onto the CNC machine. Equipment configuration parameters are used to standardize the units of measurement and processing scale for parameters such as coordinates, displacement, feed rate, and spindle speed. The files in the dataset are not directly input into the model as raw text. Instead, the actual execution order is first restored according to the subroutine call relationships, and then the text features, continuous physical quantities, and discrete process states are converted into a joint input vector that can be matched line by line.

[0025] Standardization first uses regular expressions to remove comments, program segment numbers, blank lines, and redundant spaces, ensuring that the same instructions do not appear differently due to different writing formats. Then, it expands each subroutine according to the subroutine call order, preventing the separation of the call location in the main program from the actual machining instructions in the subroutine. Next, it standardizes the units of measurement for each numerical parameter based on the equipment configuration parameters, ensuring that millimeters and inches, feed per minute, and other settings are semantically consistent before entering feature processing. The standardized instruction sequence is still arranged according to the actual execution order of the NC program, so the subsequently generated vector sequence can retain the timing relationship between tool change, positioning, cutting, tool retraction, and spindle state switching.

[0026] Each standardized instruction is divided into instruction code, axis identifier, and numerical parameters. MurmurHash3 feature hashing maps the instruction code and axis identifier to a fixed-dimensional encoding space, ensuring consistent encoding of similar instructions and axis identifiers across different files under the same hashing rules, while avoiding the need to build an ever-expanding vocabulary for all possible instruction combinations. Numerical parameters and their identifiers remain independent and are not irreversibly compressed along with the instruction code, allowing the model to still distinguish the meaning and values ​​of parameters such as the X-axis coordinate, F-feed rate, and S-spindle speed. After processing, each instruction line forms an instruction parsing feature containing discrete semantic encoding and the original numerical semantics.

[0027] The system further determines the spatial composite displacement, feed rate, spindle speed, cutting feed state, rapid traverse state, and process state vector for each instruction. The process state vector records the tool number, coordinate system number, machining plane identifier, spindle start / stop identifier, and coolant start / stop identifier, used to describe the field conditions at different machining stages for the same instruction code. The spatial composite displacement, feed rate, and spindle speed are normalized using Min-Max and then concatenated with the two state identifiers, the process state vector, and the instruction semantic code in a preset order. The vector sequence formed from historical safety files is used for model training and parameter calibration, respectively, while the vector sequence formed from the file to be tested is retained until S40 for online evaluation.

[0028] Line-by-line syntax checking can only determine whether the instruction format and individual parameters exceed static boundaries, making it difficult to identify modifications that are still within the legal range but inconsistent with the preceding and following processing stages. Directly providing the original characters or absolute values ​​to the model renders comments, program segment numbers, units, and file arrangement irrelevant differences. This step unifies execution order recovery, feature hashing, continuous quantity normalization, and process state encoding into the same data chain, compressing textual differences while preserving actual displacement, speed, rotational speed, and cutting state differences. Therefore, S20 can learn the correspondence between instruction semantics and physical effects in the safety file, and S30 and S40 can compare predicted results with actual results on the same dimension and scale.

[0029] For example, a program segment for a vertical machining center contains "G01 X125.000 Y60.000 F800 S6000 M08", where the coordinates of the previous program segment are X120.000 and Y60.000. After standardization, G01, X, Y, F, S, and M08 are entered into fixed-dimensional encoding positions according to predetermined hash rules. The X-axis and Y-axis values ​​are used to determine the composite displacement in the current row of space. F800 and S6000 are used as the feed rate and spindle speed, respectively. The cutting feed state is set to active, the rapid traverse state is set to inactive, and the coolant start / stop flag is set to active. If the file to be tested is only modified by changing F800 to F1800, the instruction code and axis identifier encoding remain unchanged, but the normalized feed rate and subsequent physical effect vectors change. This difference will be transmitted to the model along with the current tool, coordinate system, and spindle state.

[0030] Step S20: Based on the instruction joint input vector dataset, a bidirectional long short-term memory network and Bahdanau additive attention fusion mechanism are used to perform the instruction semantic prediction model training task, and the model training result data is output. The model training result data is a dataset consisting of the instruction semantic prediction model to be calibrated, the calibration joint input vector sequence, and the instruction joint input vector sequence to be detected. During the training phase, the training joint input vector sequence corresponding to the historical safety NC file is extracted from the S10 output. The instruction semantic encoding of each instruction is mapped into a dense instruction semantic embedding vector. The normalized spatial synthetic displacement, normalized feed rate, normalized spindle speed, cutting feed state, and rapid traverse state are mapped into physical effect embedding vectors, which are then concatenated with the process state vector. The resulting training fusion representation describes not only what the current instruction is, but also its effect on the machine tool motion state and the process environment during execution.

[0031] A bidirectional long short-term memory network extracts hidden states along the forward and backward directions of the instruction sequence. The forward state preserves the machining progress preceding the current instruction, while the backward state supplements the context of the current instruction within the complete safety program structure. The combination of these two states forms the bidirectional temporal hidden state for each instruction line. For the current process state vector, Bahdanau additive attention evaluates the correlation between the hidden states at each historical moment and the current tool, coordinate system, machining plane, spindle, and coolant states. Then, attention weights are used to weight and aggregate the historical hidden states. The model can thus select historical segments that are actually relevant to the current process stage in a long program, rather than relying solely on the few instructions closest to the current position.

[0032] The fused context sequence is used to predict the physical effect vector for the next instruction line. The first three dimensions of this vector correspond to the normalized spatial composite displacement, normalized feed rate, and normalized spindle speed, respectively, while the last two dimensions correspond to the cutting feed state and rapid traverse state, respectively. Continuous physical quantities are constrained by the error between predicted and actual values, while the two state quantities are constrained by binary cross-entropy, and combined according to preset dimensional weights to form the training loss. This loss organization ensures that the model not only predicts the numerical changes in displacement, velocity, and spindle speed, but also determines whether the next line is in cutting feed or rapid traverse, avoiding correct prediction of continuous parameters but incorrect determination of the machining state.

[0033] The training loss is used to jointly update the model parameters of the bidirectional long short-term memory network and Bahdanau additive attention. Training ends when the preset number of training epochs is reached, or the loss difference between adjacent training epochs is less than a preset threshold, resulting in the semantic prediction model for the instruction to be calibrated. The calibration joint input vector sequence does not participate in model parameter learning but is used in S30 to determine the normal deviation boundary; the joint input vector sequence for the instruction to be detected also remains independent and enters S40 only after the model has been calibrated. The uses of training, calibration, and detection data are clearly distinguished, which can reduce the possibility of the detection file negatively influencing the normal model and the abnormal threshold.

[0034] Ordinary unidirectional recurrent networks tend to base predictions on the most recent instructions. When tool changes, coordinate system switching, or subroutine recursions cause relevant information to become distant, early states may weaken in continuous recursion. Predicting directly based solely on hidden states also fails to utilize historical information selected from the current process state. By combining bidirectional temporal representation with additive attention, the model can redistribute the contribution of historical information based on the current process state. Thus, a speed decrease after a normal tool change can be explained by historical fragments under the same tool and machining conditions, while a sudden speed increase when the tool and cutting state remain unchanged is less likely to be absorbed as a normal stage transition, thereby forming a discriminative residual distribution for S30.

[0035] For example, a mold program first uses tool T01 at a high feed rate to roughen the cavity, then performs a tool change and uses tool T08 for finishing. When the model processes the first G01 instruction after T08, the current process state vector shows that the tool number has changed to T08, the spindle is on, the coolant is on, and it is in a cutting feed state. Bahdanau additive attention can increase the weight of the T08 finishing segment in the historical safety file and reduce the influence of the T01 roughing segment, thereby predicting that the next line should have a smaller displacement and a lower feed rate. If the file to be inspected continues to use the roughing speed in the T08 stage, a persistent residual will form between the actual physical effect and this prediction, and will be identified in subsequent calibration scales.

[0036] Step S30: Based on the model training result data, perform the anomaly determination parameter calibration task using the joint calibration mechanism of Mahalanobis distance based on Ledoit-Wolf shrinkage estimation and Soft-DTW, and output the anomaly calibration result data; The abnormal calibration result data is a dataset formed by writing the multivariate residual range, feed rate variation range, and complete sequence alignment range under normal processing conditions into the model to be calibrated. The system reads the semantic prediction model of the instruction to be calibrated and the joint input vector sequence of calibration from the model training result data, predicts the physical effect vector of the calibration sequence time-by-time, and compares it with the corresponding actual physical effect vector to obtain the calibration residual vector; simultaneously, it obtains the absolute value of the first-order difference of the normalized feed rate at adjacent time points, and saves the predicted physical effect vector sequence and the actual physical effect vector sequence separately for each historical safety NC file. These three types of data respectively describe the single-line multivariate deviation, critical speed variation, and the sequence logic difference of the entire program.

[0037] Ledoit-Wolf contraction estimation is used to determine the residual covariance matrix from the calibration residual vector. Displacement, feed rate, spindle speed, and the two state dimensions may be correlated. When the sample size is limited or some dimensions have small fluctuations, the directly calculated empirical covariance matrix is ​​prone to instability. Contraction estimation stabilizes the matrix during inversion and subsequent distance calculations by adjusting between the sample covariance and the structured objective. The Mahalanobis distance is then used to evaluate the multivariate deviation of each residual vector from the normal residual distribution based on this covariance matrix, allowing the normal correlation between multiple dimensions to participate in the determination of anomalous scales, rather than comparing five independent errors separately.

[0038] Among the multivariate deviations of each calibration residual vector, the 99.9th percentile was determined as the upper limit of the command physical effect residual envelope; among the absolute values ​​of the first-order differences of each feed rate, the 99.5th percentile was determined as the upper limit of the feed trend continuity envelope. The former retains most normal single-line prediction deviations, while the latter retains speed changes during normal acceleration, deceleration, and stage switching. Soft-DTW is used to compare the predicted physical effect vector sequence and the actual physical effect vector sequence of each safe NC file, allowing smooth alignment of the two sequences when there is a small misalignment in local beats, and using the maximum value of the alignment distance of the calibration sequence as the upper limit of the sequence logical alignment envelope.

[0039] After determining the three types of parameters, the system writes the residual covariance matrix, the upper limit of the residual envelope of the instruction physical effect, the upper limit of the envelope of the feed trend continuity, and the upper limit of the envelope of the sequence logical alignment into the model to be calibrated, and then combines them with the anomaly judgment parameter set and the joint input vector sequence of the instruction to be detected. S40 can therefore use normal calibration data separated from the model training data to determine which deviations still belong to acceptable processing fluctuations, and calculate the three types of risk components for the file to be detected on the same calibration scale. Encapsulating the parameters along with the model also avoids temporarily selecting thresholds during online detection, reducing result drift caused by using different judgment benchmarks for different files.

[0040] Using fixed Euclidean distances or manually given single-dimensional thresholds can easily lead to the separation of interrelated normal changes for judgment. For example, a synchronous adjustment of feed rate when displacement increases may be normal, while a significant increase in feed rate when displacement remains almost constant may pose a higher risk; simply looking at each value individually as not exceeding its limit does not reflect this combined relationship. Empirical covariance may also approach singularity under high-correlation dimensions and limited calibration samples, causing the distance results to be overly sensitive to a small number of samples. This step uses covariance contraction to support Mahalanobis distance, and then supplements the single-row residuals with independent feed trends and Soft-DTW sequence scales, so that the normal envelope simultaneously covers the three levels of multivariates, local trends, and the entire sequence.

[0041] For example, 120 confirmed safe milling, drilling, and tapping programs were selected as calibration data for a machining center. After line-by-line prediction by the model, the multivariate deviations of most residuals were concentrated within the normal range, and the 99.9th percentile was recorded as the upper limit of the physical effect residual envelope. Speed ​​changes caused by normal tool changes and feed / retraction were included in the first-order difference sample, and its 99.5th percentile formed the upper limit of the feed trend continuity envelope. After Soft-DTW alignment of the predicted and actual sequences of each safe program, the largest normal distance was taken as the upper limit of the sequence logical alignment envelope. A safe program that is one line off due to communication sampling can still be kept within the envelope through local alignment, while files with multiple consecutive lines of rewritten speed and displacement relationships will produce significantly higher alignment distances in S40.

[0042] Step S40: Based on the anomaly calibration results data, perform an online risk assessment task for NC files using the Mahalanobis distance and Soft-DTW joint risk assessment mechanism, and output a comprehensive risk index; The comprehensive risk index is the result obtained by aggregating the anomalies of the NC file to be detected in three aspects—physical effect deviation, feed trend mutation, and sequence logic mismatch—onto the same numerical scale. The system reads the instruction semantic prediction model with written parameters and the joint input vector sequence of the instruction to be detected from the anomaly calibration result data, obtains the predicted physical effect vector at each time step, and forms the detection residual vector with the actual physical effect vector corresponding to the file to be detected. Simultaneously, it calculates the absolute value of the first-order difference of the feed rate to be detected at adjacent time steps, and combines the predicted physical effect vector sequence and the actual physical effect vector sequence of the entire file to form the detection deviation dataset.

[0043] The physical effect deviation component uses the residual covariance matrix stored in S30 to determine the multivariate deviation degree of each detected residual vector through Mahalanobis distance, and compares it with the upper limit of the command physical effect residual envelope. The feed trend mutation component compares the absolute value of the first-order difference of each detected feed rate with the upper limit of the feed trend continuity envelope. The sequence logic mismatch component uses Soft-DTW to calculate the detection sequence alignment distance between the entire predicted sequence and the actual sequence, and then compares it with the upper limit of the sequence logic alignment envelope. All three comparisons are based on the boundaries obtained from the safety calibration data in S30, so the score means the relative degree of deviation from the normal envelope, rather than the absolute parameter value.

[0044] When calculating each risk score, portions below the corresponding envelope upper limit do not constitute positive outliers. Portions exceeding the upper limit are transformed according to the logarithmic and maximum value rules defined in the claims, thus distinguishing between minor and significant outliers on the scoring scale and reducing the direct dominance of extreme single points in the overall results. The physical effect deviation score aggregates the multivariate residuals at each time step, the feed trend mutation score aggregates the velocity changes at adjacent time steps, and the sequence logic mismatch score reflects the alignment deviation of the entire document. Subsequently, a weighted sum is calculated according to preset weights for physical effect deviation, feed trend mutation, and sequence logic mismatch, with all three weights being non-negative and summing to 1.

[0045] The three risk components are complementary. When the speed of a single instruction is suddenly increased, the Mahalanobis distance and feed trend score can respond quickly; if an attacker spreads large modifications across multiple lines, causing only small deviations in each line, the Soft-DTW distance of the entire program can still reflect the continuous mismatch between the predicted and actual paces; when legitimate process switching occasionally causes large single-line residuals, as long as the speed change and the complete sequence still conform to the safety calibration mode, other components can avoid single-point errors being directly equated to high risk. The output comprehensive risk index retains the contributions of all three detection scales, allowing the S50 to implement stable graded handling accordingly.

[0046] When only checking disabled commands or the upper limit of a single parameter, incremental tampering within the legal range will not trigger rules; when only calculating the average prediction error of the entire file, a small number of consecutive anomalies may be diluted by a large number of normal lines; and using only sequence distance is insufficient to promptly identify local dangers such as sudden changes in velocity. This step utilizes multivariate residuals, key parameter trends, and sequence alignment relationships in parallel, and then synthesizes them into a single risk index according to preset weights, so that different types of anomalies do not have to share the same observation method. This can reduce the direct release of syntactically valid files with inconsistent physical effects, and also reduce the possibility of occasional sampling fluctuations in normal procedures causing an overall high-risk judgment.

[0047] For example, in a safe sample, the feed rate normalization value of a precision milling program remained around 0.12 for an extended period. The version under test gradually increased the feed rate to 0.35 for 50 consecutive cutting commands and inserted two short-distance redundant arcs. Initially, the single-step deviation in the first few lines might still be close to the physical effect residual envelope, but as the actual speed continuously deviated from the model prediction, the multivariate deviation score gradually accumulated. The speed changes in adjacent lines repeatedly exceeded the feed trend continuity envelope, causing the trend score to rise synchronously. The redundant arcs altered the overall program rhythm, causing the Soft-DTW distance to exceed the sequence logic alignment envelope. The three types of scores were combined according to set weights to form a comprehensive risk index significantly higher than that of normal files, extending the evaluation from single-line parameter changes to the entire machining logic.

[0048] Step S50: Based on the comprehensive risk index, a finite state machine hierarchical disposal mechanism is used to execute the risk level disposal task and output disposal operation instructions.

[0049] Operation instructions are control information output by the finite state machine (FSM) to the CNC system, manufacturing execution system, audit records, or operators after determining the target handling state based on the comprehensive risk index. The FSM pre-determines four risk levels: high risk, medium risk, low risk, and safe. The high-risk threshold is higher than the medium-risk threshold, and the medium-risk threshold is higher than the low-risk threshold. A high-risk level is determined when the comprehensive risk index reaches the high-risk threshold; a medium-risk level is determined when it is below the high-risk threshold but reaches the medium-risk threshold; a low-risk level is determined when it is below the medium-risk threshold but reaches the low-risk threshold; and a safe level is determined when it is below the low-risk threshold. The boundaries of each interval are clearly defined and do not overlap, ensuring that any index can only enter one risk state.

[0050] The risk level indicators are mapped to four states: prohibited loading, isolated audit, recorded confirmation, and normal loading. High risk corresponds to the prohibited loading state, indicating that the NC file must not enter the CNC system's execution queue; medium risk corresponds to the isolated audit state, indicating that the file is temporarily separated from the automatic loading process and awaits review by the manufacturing execution system; low risk corresponds to the recorded confirmation state, indicating that abnormal information needs to be retained and must be confirmed by the operator before controlled loading; and the safe level corresponds to the normal loading state, indicating that the file can enter the equipment according to the normal process. This state mapping converts continuous risk indices into discrete processes that can be executed by the production control system.

[0051] In the prohibited loading state, the system generates a program prohibition loading instruction and triggers an alarm; in the isolation audit state, it generates a program isolation instruction and sends an audit request to the manufacturing execution system; in the record confirmation state, it generates an exception record instruction, and only generates a controlled loading instruction after receiving a confirmation signal from the operator; in the normal loading state, it directly generates a normal loading instruction. The handling results not only provide a risk label, but also clearly define the control object and subsequent actions, enabling the detection results to change the equipment execution process before the actual loading of the NC file, avoiding the risk score remaining on the prompt interface without forming control constraints.

[0052] Tiered handling allows for different treatment of false alarm costs and safety consequences. High-risk documents are directly blocked, preventing programs suspected of collisions, overspeeding, or abnormal paths from entering the machine tool; medium-risk documents retain the opportunity for manual review, suitable for handling new processes not fully covered by the model; low-risk documents require recording and confirmation, allowing minor anomalies to be traced without immediately causing production line downtime; safety documents maintain normal loading efficiency. Therefore, the continuous risk index of S40 is no longer compressed into a single pass or reject conclusion, but rather transformed into a control status and responsibility confirmation chain commensurate with the risk intensity.

[0053] Traditional binary detection typically allows or blocks processes directly at either end of the same threshold. A threshold that is too low can cause frequent shutdowns of new processes, and operators may gradually ignore alarms; a threshold that is too high can allow incremental modifications to continue until they accumulate to a dangerous level. Finite state machines (FSMs) set three progressively decreasing risk thresholds and incorporate review, recording, and confirmation into low-to-medium risk states, preserving human judgment and audit evidence without sacrificing safety controls. The states are driven by a comprehensive risk index and confirmation signals, avoiding the output of vague "suspicious" alerts without corresponding actions.

[0054] For example, a production line sets the high-risk threshold to 12, the medium-risk threshold to 5, and the low-risk threshold to 1.5. A document to be inspected has a comprehensive risk index of 13.4, causing the finite state machine to enter a prohibited loading state, the CNC system to refuse loading, and trigger an alarm. Another new process document has an index of 7.2, entering an isolated review state; the document is transferred to the manufacturing execution system for review but not automatically executed. A third document has an index of 3.1; the system records the abnormal instruction line and waits for operator confirmation before outputting a controlled loading instruction. A regular document has an index of 0.8, below the low-risk threshold, and directly enters the normal loading state. These four results are determined by the same set of interval relationships, avoiding inconsistent handling of the same index at different terminals.

[0055] Example 2: Furthermore, the present invention provides a semantic analysis-based NC file security detection system, which employs a semantic analysis-based NC file security detection method from the above embodiments, and can solve a technical problem related to semantic analysis-based NC file security detection. The beneficial effects of the semantic analysis-based NC file security detection system provided by the present invention are the same as those of the semantic analysis-based NC file security detection method provided in the above embodiments, and other technical features of the semantic analysis-based NC file security detection system are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0056] Example 3: This invention provides a semantic analysis-based NC file security detection device. The device includes at least one processor and a memory communicatively connected to the processor. The memory stores instructions executable by the processor, which are then executed to enable the processor to perform the semantic analysis-based NC file security detection method described in Example 1. This semantic analysis-based NC file security detection device can include, but is not limited to, mobile terminals such as mobile phones, laptops, digital radio receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. This semantic analysis-based NC file security detection device is merely an example and should not limit the functionality or scope of the invention. The device may also include a processing unit (e.g., a central processing unit, a graphics processing unit), which can perform various appropriate actions and processes based on a program stored in a read-only memory or a program loaded from a storage device into a random access memory. The random access memory also stores various programs and data required for the operation of a semantic analysis-based NC file security inspection device. The processing unit, read-only memory, and random access memory are interconnected via a bus. The I / O interface is also connected to the bus. Typically, the following systems can be connected to the I / O interface: input devices including touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices including liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices including magnetic tapes, hard disks, etc.; and communication devices. The communication device allows the semantic analysis-based NC file security inspection device to communicate wirelessly or wiredly with other devices to exchange data. While a semantic analysis-based NC file security inspection device with various systems has been described, it should be understood that implementing or possessing all the described systems is not required. Alternatively, more or fewer systems can be implemented.

[0057] Example 4: This invention also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the semantic analysis-based NC file security detection method described above. The computer program product provided by this invention can solve a technical problem related to semantic analysis-based NC file security detection. Compared with the prior art, the beneficial effects of the computer program product provided by this invention are the same as those of the semantic analysis-based NC file security detection method provided in the above embodiments, and will not be repeated here.

[0058] In particular, according to the embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from a read-only memory. When the computer program is executed by a processing device, it performs the functions defined in the methods of the embodiments disclosed in this invention.

[0059] It should be understood that the various parts disclosed in this invention can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics may be combined in any suitable manner in one or more embodiments or examples.

[0060] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the present invention and its equivalents, the present invention also intends to include these modifications and variations.

Claims

1. A method for security detection of NC files based on semantic analysis, characterized in that, The method includes: Step S10: Obtain the NC file detection dataset. Based on the NC file detection dataset, use the instruction vectorization mechanism that combines MurmurHash3 feature hashing and Min-Max normalization to perform the instruction vectorization task and output the instruction joint input vector dataset. Step S20: Based on the instruction joint input vector dataset, a bidirectional long short-term memory network and Bahdanau additive attention fusion mechanism are used to perform the instruction semantic prediction model training task, and the model training result data is output. Step S30: Based on the model training result data, perform the anomaly determination parameter calibration task using the joint calibration mechanism of Mahalanobis distance based on Ledoit-Wolf shrinkage estimation and Soft-DTW, and output the anomaly calibration result data; Step S40: Based on the anomaly calibration results data, perform an online risk assessment task for NC files using the Mahalanobis distance and Soft-DTW joint risk assessment mechanism, and output a comprehensive risk index; Step S50: Based on the comprehensive risk index, a finite state machine hierarchical disposal mechanism is used to execute the risk level disposal task and output disposal operation instructions.

2. The NC file security detection method based on semantic analysis as described in claim 1, characterized in that, In step S10, the steps of obtaining the NC file detection dataset, and based on the NC file detection dataset, performing the instruction vectorization task using an instruction vectorization mechanism combining MurmurHash3 feature hashing and Min-Max normalization, and outputting the instruction joint input vector dataset, specifically include: Step S101: Extract historical safe NC files, NC files to be detected, and device configuration parameters from the NC file detection dataset. Use regular expressions to remove comments, program segment numbers, blank lines, and redundant spaces from each NC file. Expand each subroutine according to the subroutine call order. Unify the measurement units of each instruction parameter according to the device configuration parameters and output a standardized instruction sequence set. Step S102: Based on the standardized instruction sequence set, divide the instruction code, axis identifier and numerical parameters according to the instruction line, use MurmurHash3 feature hashing to map the instruction code and the axis identifier to a fixed-dimensional encoding space, and retain the numerical parameters and the corresponding parameter identifiers, and output the instruction parsing feature sequence set; Step S103: Based on the instruction parsing feature sequence set, determine the instruction semantic code, spatial composite displacement, feed rate, spindle speed, cutting feed state, rapid traverse state, and process state vector corresponding to each instruction line. Use Min-Max normalization to normalize the spatial composite displacement, feed rate, and spindle speed. Concatenate the normalization result, cutting feed state, rapid traverse state, process state vector, and instruction semantic code to output the instruction joint input vector dataset. The process state vector includes tool number, coordinate system number, machining plane identifier, spindle start / stop identifier, and coolant start / stop identifier; the instruction joint input vector dataset includes a training joint input vector sequence and a calibration joint input vector sequence formed by the historical safety NC file, as well as a test instruction joint input vector sequence formed by the NC file to be tested.

3. The NC file security detection method based on semantic analysis as described in claim 2, characterized in that, Step S20, which involves training an instruction semantic prediction model based on the instruction joint input vector dataset using a bidirectional long short-term memory network and a Bahdanau additive attention fusion mechanism, and outputting the model training results, specifically includes: Step S201: Extract the training joint input vector sequence from the instruction joint input vector dataset, map the instruction semantic encoding corresponding to each instruction line to instruction semantic embedding vector, map the normalized spatial synthetic displacement, normalized feed rate, normalized spindle speed, cutting feed state and rapid traverse state corresponding to each instruction line to physical effect embedding vector, and concatenate the instruction semantic embedding vector, physical effect embedding vector and process state vector corresponding to the same instruction line to output the training fusion representation sequence set; Step S202: Based on the training fusion representation sequence set, a bidirectional long short-term memory network is used to extract the bidirectional temporal hidden state of each instruction line. Bahdanau additive attention is used to calculate the attention weight of the bidirectional temporal hidden state of each historical moment relative to the current process state vector. The bidirectional temporal hidden state of each historical moment is weighted and aggregated according to the attention weight, and the fusion context sequence set is output. Step S203: Based on the fusion context sequence set, predict the physical effect vector corresponding to the next instruction line. The first three dimensions of the physical effect vector are normalized spatial synthetic displacement, normalized feed rate, and normalized spindle speed, respectively, and the last two dimensions are cutting feed state and rapid traverse state, respectively. Update the model parameters of the bidirectional long short-term memory network and the Bahdanau additive attention using a training loss combining continuous physical quantity prediction error and binary cross-entropy, until a preset training termination condition is met, to obtain the instruction semantic prediction model to be calibrated. Combine the instruction semantic prediction model to be calibrated, the calibration joint input vector sequence, and the detection instruction joint input vector sequence into the model training result data. The preset training termination condition is that the number of training rounds reaches the preset number of training rounds, or the difference in training loss between adjacent training rounds is less than the preset loss difference threshold.

4. The NC file security detection method based on semantic analysis as described in claim 3, characterized in that, In step S203, the model parameters of the bidirectional long short-term memory network and the Bahdanau additive attention are updated using a training loss combining the prediction error of continuous physical quantities and binary cross-entropy. Specifically: ； ； in, For training loss, The number of valid instruction lines in the training joint input vector sequence and Greater than 1, The instruction line time number. is the dimension index of the physical effect vector. The predicted physical effect vector corresponding to the next instruction line is in the th order. Predicted values ​​for each dimension The actual physical effect vector corresponding to the next instruction line is in the th order. The actual value of each dimension; when When the values ​​are 1 to 3, the corresponding dimensions are, in order, the normalized spatial composite displacement, the normalized feed rate, and the normalized spindle speed. When 4 or 5 is selected, the corresponding dimensions are cutting feed state and rapid traverse state, respectively. For the first Each dimension corresponds to a preset dimension weight coefficient, and all preset dimension weight coefficients are non-negative and their sum is 1. It is a binary cross-entropy function. This is the predicted probability of the state occurring. The actual state value is either 0 or 1. As a preset positive number, This represents the natural logarithm function.

5. The NC file security detection method based on semantic analysis as described in claim 3, characterized in that, Step S30, based on the model training result data, employs a joint calibration mechanism of Mahalanobis distance based on Ledoit-Wolf shrinkage estimation and Soft-DTW to perform anomaly determination parameter calibration, and outputs anomaly calibration result data. This step specifically includes: Step S301: Extract the semantic prediction model of the instruction to be calibrated and the joint input vector sequence of calibration from the model training result data. Use the semantic prediction model of the instruction to be calibrated to obtain the predicted physical effect vector corresponding to the joint input vector sequence of calibration at each time step. Determine the calibration residual vector between each predicted physical effect vector and the corresponding actual physical effect vector. Determine the absolute value of the first-order difference of the feed rate between adjacent time steps. Combine the predicted physical effect vector sequence and the actual physical effect vector sequence according to each historical safety NC file to output the calibration deviation dataset. Step S302: Based on the calibration deviation dataset, the Ledoit-Wolf contraction estimation is used to determine the residual covariance matrix, the Mahalanobis distance is used to determine the multivariate deviation of each calibration residual vector, the 99.9th quantile of each multivariate deviation is determined as the upper limit of the command physical effect residual envelope, and the 99.5th quantile of the absolute value of the first difference of each feed rate is determined as the upper limit of the feed trend continuity envelope; the Soft-DTW is used to determine the sequence alignment distance between each predicted physical effect vector sequence and the corresponding actual physical effect vector sequence, and the maximum value of each sequence alignment distance is determined as the upper limit of the sequence logical alignment envelope, and the anomaly judgment parameter set is output. Step S303: Based on the anomaly determination parameter set, the residual covariance matrix, the upper limit of the residual envelope of the instruction physical effect, the upper limit of the feed trend continuity envelope, and the upper limit of the sequence logical alignment envelope are written into the semantic prediction model of the instruction to be calibrated, and the written instruction semantic prediction model, the anomaly determination parameter set, and the joint input vector sequence of the instruction to be detected are combined into the anomaly calibration result data.

6. The NC file security detection method based on semantic analysis as described in claim 5, characterized in that, Step S40, based on the anomaly calibration results data, involves performing an online risk assessment task for NC files using a joint risk assessment mechanism of Mahalanobis distance and Soft-DTW, and outputting a comprehensive risk index. This step specifically includes: Step S401: Extract the written instruction semantic prediction model and the joint input vector sequence of the instruction to be detected from the anomaly calibration result data. Use the written instruction semantic prediction model to obtain the predicted physical effect vector corresponding to the joint input vector sequence of the instruction to be detected at each time step. Determine the residual vector to be detected between each predicted physical effect vector and the corresponding actual physical effect vector. Determine the absolute value of the first-order difference of the feed rate to be detected between adjacent time steps. Combine the predicted physical effect vector sequence and the actual physical effect vector sequence corresponding to the NC file to be detected to output the deviation dataset to be detected. Step S402: Based on the dataset of deviations to be detected and the set of anomaly judgment parameters, the degree of deviation of each residual vector to be detected is determined by the residual covariance matrix and Mahalanobis distance. Soft-DTW is used to determine the alignment distance of the detected sequence between the predicted physical effect vector sequence and the actual physical effect vector sequence. The degree of deviation of the detected multivariate, the absolute value of the first difference of the detected feed rate, and the alignment distance of the detected sequence are combined into a risk component dataset. Step S403: Based on the risk component dataset, calculate the physical effect deviation score, feed trend mutation score, and sequence logic mismatch score according to the following formula, and then sum the scores by weight to obtain the comprehensive risk index: ； ； ； ； in, The score is based on the deviation of the physical effect. To score the sudden change in the feed trend, The score is given for logical mismatch of the sequence. As a comprehensive risk index, To pre-set the physical effect deviation weighting coefficient, To preset the feed trend change weighting coefficient, The preset sequence logical mismatch weighting coefficient is used, and , and All three are non-negative and their sum is 1; The number of valid time points in the joint input vector sequence of the instruction to be detected and Greater than 1, For time sequence number, For the first The degree of deviation of the multivariate to be detected at each time point The upper limit of the residual envelope of the physical effect of the instruction. For the first The absolute value of the first-order difference of the feed rate to be detected at each time step. The upper limit of the continuity envelope of the feed trend. Let be the alignment distance of the sequence to be detected. The upper bound of the logical alignment envelope of the sequence. As a preset positive number, Represents the natural logarithm function. This indicates the operation of finding the maximum value.

7. The NC file security detection method based on semantic analysis as described in claim 6, characterized in that, Step S50, which involves executing risk level handling tasks using a finite state machine hierarchical handling mechanism based on the comprehensive risk index and outputting handling operation instructions, specifically includes: Step S501: Compare the comprehensive risk index with preset high-risk threshold, preset medium-risk threshold, and preset low-risk threshold respectively; when the comprehensive risk index is greater than or equal to the preset high-risk threshold, determine a high-risk level; when the comprehensive risk index is less than the preset high-risk threshold but greater than or equal to the preset medium-risk threshold, determine a medium-risk level; when the comprehensive risk index is less than the preset medium-risk threshold but greater than or equal to the preset low-risk threshold, determine a low-risk level; when the comprehensive risk index is less than the preset low-risk threshold, determine a safety level and output a risk level identifier. Step S502: Based on the risk level identifier, map the high-risk level to the prohibited loading state, the medium-risk level to the isolated audit state, the low-risk level to the record confirmation state, and the security level to the normal loading state, and output the target handling state; Step S503: Generate the handling operation instruction according to the target handling state; in the prohibited loading state, generate a program prohibited loading instruction and trigger an alarm; in the isolation audit state, generate a program isolation instruction and send an audit request to the manufacturing execution system; in the record confirmation state, generate an abnormal record instruction, and generate a controlled loading instruction after receiving a confirmation signal from the operator; in the normal loading state, generate a normal loading instruction. Among them, the preset high-risk threshold is greater than the preset medium-risk threshold, and the preset medium-risk threshold is greater than the preset low-risk threshold.

8. A semantic analysis-based NC file security detection system, applied to the semantic analysis-based NC file security detection method according to any one of claims 1 to 7, characterized in that, The semantic analysis-based NC file security detection system includes: The instruction vectorization module is used to acquire the NC file detection dataset. Based on the NC file detection dataset, the instruction vectorization task is performed using an instruction vectorization mechanism that combines MurmurHash3 feature hashing and Min-Max normalization, and the instruction joint input vector dataset is output. The model training module is used to perform instruction semantic prediction model training tasks based on the instruction joint input vector dataset, using a bidirectional long short-term memory network and a Bahdanau additive attention fusion mechanism, and output model training result data. The parameter calibration module is used to perform anomaly detection parameter calibration tasks based on the model training result data, using a joint calibration mechanism of Mahalanobis distance based on Ledoit-Wolf shrinkage estimation and Soft-DTW, and output anomaly calibration result data. The risk assessment module is used to perform online risk assessment of NC files based on the anomaly calibration results data, using a joint risk assessment mechanism of Mahalanobis distance and Soft-DTW, and output a comprehensive risk index. The graded handling module is used to execute risk level handling tasks based on the comprehensive risk index using a finite state machine graded handling mechanism, and output handling operation instructions.

9. A semantic analysis-based NC file security detection device, characterized in that, The semantic analysis-based NC file security detection device includes: a memory, a processor, and a semantic analysis-based NC file security detection program stored in the memory and executable on the processor. When the semantic analysis-based NC file security detection program is executed by the processor, it implements the semantic analysis-based NC file security detection method according to any one of claims 1 to 7.

10. A computer program product, characterized in that, The computer program product includes a semantic analysis-based NC file security detection program, which, when executed by a processor, implements a semantic analysis-based NC file security detection method according to any one of claims 1 to 7.

Images