Power monitoring network security intelligent inspection reinforcement method

Abstract

The application discloses a power monitoring network security intelligent inspection reinforcement method and relates to the technical field of power monitoring. The method comprises the following steps: for the power monitoring network, the control logic and the security attribute are called, the intelligent inspection module is constructed and embedded in the network control; the state space is traversed based on the time automatic machine in the module, the security of the reachable state is verified, the rule violation generates the vulnerability counterexample path, and the inspection result is formed after multiple rounds of traversal; the targeted attack graph is constructed according to the second type of result, the attack test and the cross verification of the security attribute are carried out, and the reinforcement target is determined; the reinforcement plan is generated and automatically issued, and the network reinforcement is executed. The technical problem that the traditional power monitoring network relies on the function test and cannot exhaust the multi-device linkage state combination, so that it is difficult to find the deep logical vulnerability and unknown logical risk of the control logic is solved, the technical effects of the cross closed loop of the formal verification and the targeted attack are achieved, the automatic exhaustive discovery of the control logic vulnerability, the attack path reproduction and the one-key security reinforcement are realized.

Description

Technical Field

[0001] This invention relates to the field of power monitoring technology, specifically to a method for intelligent inspection and reinforcement of power monitoring network security. Background Technology

[0002] As power monitoring networks evolve towards intelligence and networking, control logic, such as remote control and protection setting modification, is becoming increasingly complex. In scenarios involving multi-level substation linkage and distributed energy regulation, the number of system states increases exponentially. Traditional functional testing, relying on manual methods or scripts, can only verify a limited set of pre-set test cases and cannot exhaustively enumerate all state combinations and timing logic when devices are linked. This limitation leads to hidden "logic vulnerabilities" or "logic bombs" within the control logic. Attackers may exploit specific timing sequences or abnormal state combinations to trigger dangerous actions beyond pre-set rules, such as unauthorized circuit breaking or accidental blocking. Conventional intrusion detection systems, lacking logical criteria, struggle to detect such malicious sequences disguised as legitimate ones. Therefore, there is an urgent need for an intelligent inspection method that can formally model power monitoring networks, exhaustively enumerate the state space, automatically discover unknown logical vulnerabilities, and link targeted attack verification and closed-loop reinforcement to improve the ability of power monitoring networks to identify and handle deep logical vulnerabilities, unknown attack paths, and risks associated with multi-device linkage. Summary of the Invention

[0003] This application provides a method for intelligent inspection and reinforcement of power monitoring network security, which solves the technical problem that traditional power monitoring networks rely on functional testing, which cannot exhaustively list the combinations of multiple device linkage states, making it difficult to discover deep vulnerabilities in control logic and unknown logical risks.

[0004] This application provides a method for intelligent inspection and reinforcement of power monitoring network security, the method comprising: For power monitoring networks, control logic and security attributes are retrieved to construct an intelligent inspection module, which is embedded in the network control center. Within this intelligent inspection module, a state space traversal based on a time-based automaton is performed. Determined state combinations are imported into a judgment component to verify whether all reachable states satisfy security attributes. When a reachable state violates a security attribute, a generation component is activated to generate vulnerability counterexample paths. Through multiple rounds of traversal, the inspection results are determined. These results include a first-type inspection result based on formal security proofs and a second-type inspection result based on vulnerability counterexample paths. Based on the second-type inspection results, an attack graph based on targeted attacks is determined. Attack testing and cross-validation based on security attributes are performed on the power monitoring network to obtain hardening targets. A hardening plan is generated based on these targets and automatically distributed to perform hardening processing on the power monitoring network.

[0005] One or more technical solutions provided in this application have at least the following technical effects or advantages: First, control logic and security attributes are extracted from the power monitoring network and integrated into an intelligent inspection module, which is then deployed at the network control center for continuous monitoring. During the inspection, a time automaton is used to traverse the state space of equipment status, control commands, timing conditions, and linkage relationships. The module verifies whether each reachable state meets preset security attributes by judging components. If a state that does not meet security requirements is found, a corresponding vulnerability counterexample path is generated, forming an inspection result containing security proof results and vulnerability path results. Next, a targeted attack graph is constructed for the vulnerability path, and attack testing and cross-validation of security attributes are conducted in the actual network environment to locate risk points requiring hardening. Finally, a hardening plan is automatically generated and issued based on the hardening target, achieving targeted security hardening of the power monitoring network. Attached Figure Description

[0006] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0007] Figure 1 This is a schematic diagram of the intelligent inspection and reinforcement method for power monitoring network security provided in an embodiment of this application.

[0008] Figure 2 This is a schematic diagram illustrating the process of constructing an intelligent inspection module for the power monitoring network security intelligent inspection and reinforcement method provided in this application embodiment.

[0009] Figure 3 This is a schematic diagram illustrating the changes in the test results of the verification attack path provided in the embodiments of this application. Detailed Implementation

[0010] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description of the specific implementation methods, structures, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided below.

[0011] Examples, such as Figure 1 As shown, this application provides a method for intelligent inspection and reinforcement of power monitoring network security, the method including: For power monitoring networks, control logic and security attributes are retrieved to build an intelligent inspection module and embed it into the network control center.

[0012] In this embodiment, the system first acquires operational control-related information about the power monitoring network to be inspected, including its control logic and security attributes, such as remote switching control logic, protection device setting modification logic, equipment interlocking logic, prohibition of unauthorized remote switching, and the requirement for authentication and approval conditions for protection setting modifications. After obtaining the control logic and security attributes, the system converts the control logic into a time automaton and the security attributes into linear time-series logic formulas through modeling. These two are then combined with a generation component based on vulnerability counterexample path decision deployment to form an intelligent inspection module. This module enables the intelligent inspection module to model, analyze, judge, and provide early warnings about the power monitoring network control process. Subsequently, the intelligent inspection module is embedded into the network control center of the power monitoring network, allowing it to continuously acquire network operating status, control commands, device feedback, and security policy information without affecting existing monitoring operations. This information serves as the basis for subsequent state traversal, security verification, vulnerability identification, and hardening decisions.

[0013] Furthermore, such as Figure 2 As shown, the control logic and security attributes are retrieved to construct an intelligent inspection module, including: The control logic of the power monitoring network is obtained and modeled as a time automaton; the security attributes of the power monitoring network are obtained and encoded as linear time-series logic formulas; state combination recognition is performed using the time automaton; judgment components are deployed using the linear time-series logic formulas; and a generation component is deployed using the decision-making of vulnerability counterexample paths, thus forming an intelligent inspection module.

[0014] Preferably, the network control unit pre-establishes data acquisition connections with the monitoring host, protection devices, measurement and control devices, and communication gateways in the power monitoring network, and reads the control logic configuration table from the network control unit's configuration database. This control logic configuration table includes at least the controlled object identifier, control command type, pre-state, target state, trigger event, allowed execution time window, feedback waiting time limit, interlock flag, and abnormal handling flag. After reading the control logic configuration table, a state transition rule is generated for each control logic record, and a time automaton is constructed based on the state transition rules. When constructing the time automaton, the operating phase of the controlled object is divided into discrete operating modes, forming a finite set of states, such as initial state, command pending verification state, command allowed state, command execution state, feedback confirmation state, interlocking state, and dangerous state. Taking remote gate opening and closing control as an example, when the network central control receives the gate opening and closing command, the time automaton enters the command waiting verification state from the initial state and starts the first clock variable; when both the identity verification result and the permission verification result are passed, and the first clock variable does not exceed the feedback waiting threshold, the time automaton transitions to the command allowing state; when the controlled object is not in the locked state, and the control command is within the allowed execution time window, the time automaton transitions to the command execution state and resets the second clock variable; when a successful execution feedback is received within the feedback waiting time limit, the time automaton transitions to the feedback confirmation state; when a successful execution feedback is not received after the feedback waiting time limit has expired, or when a command execution event occurs while the lockout flag is valid, the time automaton transitions to the dangerous state. Thus, the execution sequence, time window, feedback time limit, and lockout condition in the control logic are uniformly expressed as state nodes, transition edges, clock variables, and clock constraints, constituting a time automaton.

[0015] For the security attributes of the power monitoring network, the controlled object state, permission verification state, interlock flag, execution feedback state, and dangerous state are defined as atomic propositions in linear sequential logic formulas, and security attribute formulas are generated according to preset templates. Specifically, a first security attribute formula is set to constrain unauthorized entry into the instruction execution state; a second security attribute formula is set to constrain entry into the instruction execution state when the interlock flag is valid; a third security attribute formula is set to constrain that after instruction execution, the system must enter the feedback confirmation state within the feedback waiting time limit; and a fourth security attribute formula is set to constrain the system from entering the dangerous state on any reachable path. These security attribute formulas are written into the formula library of the judgment component and bound to the corresponding controlled object identifier.

[0016] Within the intelligent inspection module, a pre-built time automaton is used as input to progressively transition from the initial state. Each transition involves the state combination identification unit recording the current state node, trigger event, clock variable value, latch flag, permission verification result, and feedback status, forming a reachable state combination. Upon receiving the reachable state combination, the judgment component calls the linear timing logic formula bound to the controlled object for matching and judgment. If the current reachable state combination satisfies all security attributes, it continues traversing the next transition branch; if the current reachable state combination violates any security attribute, it sends a counterexample generation instruction to the generation component. The generation component automatically generates vulnerability counterexample paths when the judgment component detects a reachable state violating security attributes. The generation component is constructed within the intelligent inspection module according to a fixed data processing chain, including a state transition record table, a violation attribute parsing unit, a reverse backtracking unit, a path assembly unit, and a counterexample path output unit. The state transition record table synchronously records the source state, target state, triggering event, controlled object identifier, clock variable value, clock constraint, permission verification result, latch flag, and feedback status for each state transition during state space traversal. The violation attribute parsing unit receives the violation security attribute identifier output by the judgment component and determines the corresponding dangerous state type. The reverse backtracking unit searches for the previous state level by level in the state transition record table, starting from the dangerous state, until it backtracks to the initial state. The path assembly unit rearranges the state nodes, triggering events, and clock constraints in a forward direction according to the backtracked state transition order, forming a complete event sequence from the initial state to the dangerous state. The counterexample path output unit converts the complete event sequence into a vulnerability counterexample path and outputs it. During the construction process, a unique state number is assigned to each reachable state, and a corresponding transition number is generated when a state transition occurs, ensuring that each record in the state transition record table contains the current state number, the predecessor state number, the transition number, and the triggering condition. When the judgment component determines that a reachable state violates a linear timing logic formula, it sends the state number of the reachable state, the violation formula number, and the controlled object identifier to the generation component. The generation component reads the violation formula number through the violation attribute parsing unit and determines that the violation belongs to one of the following types: unauthorized execution, lockout bypass, feedback timeout, time window out of bounds, or dangerous state arrival. Next, the reverse backtracking unit uses the violation state number as the query entry point to look up the corresponding predecessor state number in the state transition record table and continues to perform predecessor state queries until the initial state number is found. The path assembly unit then reorders the multiple transition records obtained from the backtracking according to the direction from the initial state to the violation state, and extracts the triggering event, clock variable value, clock constraint condition, and state change result from each transition record to generate a vulnerability counterexample path, including the initial state, instruction generation event, verification result, execution event, feedback event, time constraint violation location, and final dangerous state.Ultimately, an intelligent inspection module is formed by a state combination recognition unit, a judgment component, and a generation component, and is embedded in the network control system. This intelligent inspection module reads the control logic configuration table in the network control system, generates a deterministic time automaton, judges the reachable state through the security attribute formula library, and outputs vulnerability counterexample paths through the generation component, thereby realizing automatic inspection of timing disorder, interlocking bypass, unauthorized execution, and feedback anomaly risks in the power monitoring network control logic.

[0017] Furthermore, the control logic of the power monitoring network is modeled as a time-based automaton, including: Define a finite set of states, where each state corresponds to a discrete operating mode of the power monitoring equipment; define a finite set of clock variables, where each clock variable represents a clock constraint; define state transition relationships, where the state transition relationships are determined by clock constraints, event tags, and a set of clock reset actions; by scanning the power communication protocol, identify the logic node definitions and control block parameters, and encode them one by one into state nodes and transition edges to form a time automaton, where state nodes are associated with the finite set of states, and transition edges represent trigger conditions and are associated with state transition relationships and a finite set of clock variables.

[0018] Optionally, when acquiring the control logic of the power monitoring network and modeling it as a time automaton, the power communication protocol configuration file and real-time communication messages stored in the network central control system are used as input objects. A protocol scan is performed on the monitoring host, protection devices, measurement and control devices, and communication gateways in the power monitoring network according to a preset protocol parsing template. This protocol parsing template uses fixed parsing rules corresponding to the power communication protocol fields to identify device identifiers, logical node names, data object names, control block identifiers, control types, control enable conditions, feedback confirmation fields, interlocking fields, and time parameter fields. After completing the protocol scan, the device operation meaning corresponding to each logical node is extracted and converted into states in a finite state set. For example, the activation, deactivation, interlocking, waiting for execution, execution, feedback confirmation, and abnormal alarm of the protection device are defined as discrete states, so that each state corresponds to a specific operating mode of the power monitoring equipment during the control process. Subsequently, a finite set of clock variables is established based on the time parameter fields in the protocol configuration file. For example, the feedback waiting time after the control command is issued is defined as the first clock variable, the authorization validity time after the permission verification is passed is defined as the second clock variable, and the allowed control time after the interlock is released is defined as the third clock variable. Each clock variable is bound to a specific clock constraint, which limits the control operation to completion within a corresponding time range. For example, after a control command is issued, the first clock variable starts timing. If the first clock variable does not exceed the feedback waiting threshold and receives successful execution feedback, the state transitions to the feedback confirmation state; if the first clock variable exceeds the feedback waiting threshold and still does not receive successful execution feedback, the state transitions to the abnormal state. Thus, the feedback time limit, authorization time limit, and latch-off release time limit in the control process are converted into clock variables and their constraints in the time automaton.

[0019] When defining state transition relationships, based on the control block parameters obtained from the scan, a corresponding transition edge is generated for each control logic record. These control block parameters include the controlled object, control command, trigger condition, execution condition, feedback condition, and time constraint. For each transition edge, the source state, target state, event label, clock constraint, and clock reset action set are recorded. The event label represents the specific event triggering the state change, such as receiving a remote control command, passing permission verification, releasing the lockout flag, executing a control action, or receiving execution feedback. The clock constraint determines whether the transition is within the allowed time range. The clock reset action set restarts the corresponding clock variable after a specific transition occurs. For example, when the state transitions from the instruction-allowed state to the instruction-executed state, the control action execution is used as the event label, and the feedback waiting clock is reset to zero, allowing subsequent feedback confirmation processes to be judged based on this clock variable.

[0020] During the encoding process, the logical node definitions and control block parameters in the protocol scan results are read one by one. The device operation mode corresponding to the logical node is encoded as a state node, and the trigger conditions corresponding to the control block parameters are encoded as migration edges. For each migration edge, if the control block parameters contain a time limit, the corresponding clock constraint is written into the migration edge; if the control block parameters contain a requirement to reset the timer after execution, the corresponding clock variable is written into the clock reset action set. Taking remote control of gate opening and closing as an example, the standby state is encoded as the first state node, the command verification state as the second state node, the control execution state as the third state node, the feedback confirmation state as the fourth state node, and the danger state as the fifth state node. When a remote control command trigger field is detected in the gate opening and closing control block, a transition edge from the first state node to the second state node is generated. When a permission verification pass field and an authorization validity time field are detected, a transition edge from the second state node to the third state node is generated, and an authorization validity time constraint is written on this transition edge. When an execution feedback field is detected, a transition edge from the third state node to the fourth state node is generated, and a feedback waiting time constraint is written on this transition edge. When a feedback timeout field or a combination of fields where the interlock is valid but the control action is still executed is detected, a transition edge pointing to the fifth state node is generated. After completing the above encoding, a time automaton is generated by combining the finite set of states, the finite set of clock variables, and the state transition relationships. Each state node in this time automaton is associated with a discrete operating mode in the finite set of states, and each transition edge is associated with a corresponding event label, clock constraint, and clock reset action set. Through this time automaton, the control logic in the power monitoring network, which was originally scattered in communication protocols, equipment configurations, and control block parameters, is transformed into a computationally computable, traversable, and verifiable formal model. This allows subsequent state space traversal to unfold according to defined state nodes and transition edges, and enables the identification of logical risks that violate timing constraints, such as control commands being executed outside the time window, continuing control after feedback timeout, and executing actions without lockout release. This improves the completeness of subsequent state space traversal and the accuracy of identifying hidden timing logic vulnerabilities.

[0021] In the intelligent inspection module, a state space traversal based on a time automaton is performed, and the determined state combinations are imported into the judgment component to verify whether all reachable states satisfy the security attributes. When there is a reachable state that violates the security attributes, the generation component is activated to generate vulnerability counterexample paths. Through multiple rounds of traversal processing, the inspection results are determined. The inspection results include a first type of inspection results based on formal security proof and a second type of inspection results based on vulnerability counterexample paths.

[0022] In one embodiment, after the intelligent inspection module is deployed, it starts from the initial operating state and, according to the state nodes, transition edges, event triggering conditions, and clock constraints defined in the time automaton, obtains the first state combinations formed between devices in scenarios such as single-point control, multi-level linkage, anomaly feedback, and timeout response through traversal identification. After determining the state combinations, they are input into the judgment component, which calls the linear time-series logic formula to match and verify each reachable state and its corresponding state transition process. If all reachable states satisfy the corresponding security attributes, it means that the current control logic has not found any state violating security requirements within the scope of this round of traversal. The intelligent inspection module generates a type of inspection result based on formal security proof and continues to the next round of traversal or completes the corresponding inspection task. If any reachable state does not satisfy the security attributes, the judgment component marks the state as an abnormal reachable state and triggers the generation component to trace back to generate a vulnerability counterexample path from the initial state to the dangerous state. By performing multiple rounds of traversal processing on different initial states, different device combinations, different control command sequences, and different time constraints, the intelligent inspection module ultimately generates inspection results, including two types: Type I and Type II. Type I results characterize the control logic and state combinations that satisfy security attributes after formal verification. Type II results characterize vulnerability counterexample paths and their corresponding risk scenarios where security attributes are violated. This enables full-state verification of the power monitoring network control logic and deep logic vulnerability localization, improving the completeness and accuracy of unknown risk discovery.

[0023] Furthermore, a state space traversal based on a time automaton is performed, and the determined combinations of states are imported into the judgment component to verify whether all reachable states satisfy the safety properties, including: Based on the time automaton, a first state combination is determined by traversal recognition; the first state combination is input into the judgment component, and the matching activation of the linear time-series logic formula is executed to verify whether all reachable states satisfy the security attribute, and a first judgment result is determined; if the first judgment result is satisfied, a first formal security proof and loop instruction are generated.

[0024] Optionally, the state combination identification unit uses the initial state node of the time automaton as the starting point for traversal, reads the device operating mode, controlled object identifier, current clock variable value, permission verification status, latch flag, feedback status, and exception flag associated with the initial state node, and combines the above data to form an initial state combination. Subsequently, it queries the migration edges in the time automaton that originate from the initial state node, and sequentially reads the event label, clock constraint, and clock reset action bound to each migration edge. When the event label corresponding to the migration edge meets the trigger condition, and the current clock variable value meets the clock constraint condition of the migration edge, the migration edge is executed, updating the current state node to the target state node, and the corresponding clock variable is cleared or restarted according to the clock reset action bound to the migration edge, thereby generating a new reachable state combination. The state combination identification unit determines the first newly generated reachable state combination as the first state combination and simultaneously records the predecessor state number and migration trigger condition of the first state combination.

[0025] After determining the first state combination, it is input into the judgment component. Based on the control object identifier in the first state combination, the judgment component reads the linear sequential logic formula bound to that control object from the security attribute formula library, and maps the state nodes, permission verification states, latch flags, feedback states, exception flags, and clock variable values ​​in the first state combination to the atomic proposition values ​​in the linear sequential logic formula. After mapping, the judgment component activates the corresponding linear sequential logic formula and performs matching verification item by item according to a preset judgment order. For example, the judgment component verifies whether the first state combination satisfies the security attribute of "unauthorized entry into the instruction execution state is prohibited," whether it satisfies the security attribute of "entry into the instruction execution state is prohibited when the latch flag is valid," whether it satisfies the security attribute of "entering the feedback confirmation state within the feedback waiting time limit after the control instruction is executed," and whether it satisfies the security attribute of "no reachable path can enter a dangerous state." If the first state combination matches all the above linear sequential logic formulas successfully, the judgment component determines that the first state combination satisfies the security attributes; if any formula fails to match, the judgment component determines that the first state combination does not satisfy the security attributes.

[0026] After the judgment component completes the verification of the first state combination, if the first state combination satisfies all security attributes and no reachable state violating the security attributes is found in the current traversal branch, the judgment component generates a first judgment result defined as satisfied. The intelligent inspection module reads the state number, predecessor state number, migration edge number, security attribute formula number, and formula matching result corresponding to the first state combination based on the first judgment result, and writes them into the security proof record table. Then, based on the security proof record table, a first formal security proof is generated. This first formal security proof includes at least the controlled object being verified, the first state combination, the corresponding reachable migration path, the linear sequential logic formulas involved in the verification, the matching result of each formula, and the proof conclusion that no dangerous state has been entered. After generating the first formal security proof, a loop instruction is generated simultaneously. This loop instruction instructs the state combination identification unit to use the first state combination as the new current state combination, continue querying the next migration edge in the time automaton with the state node corresponding to the first state combination as the source state, and repeatedly execute the migration condition judgment, reachable state combination generation, and security attribute verification process until the state space traversal of the current control logic branch is completed. This enables automatic identification of the first reachable state combination, formal verification of security attributes, and retention of security proofs, and provides a basis for cyclic execution for the continuous traversal of subsequent reachable states.

[0027] Furthermore, if the first judgment result is not satisfied, the generation component is activated; based on the first judgment result, the reachable state that does not satisfy the security attribute is determined, and the generation component is input to determine the first vulnerability counterexample path, wherein the first vulnerability counterexample path is the event sequence from the initial state to the dangerous state and the corresponding clock constraint.

[0028] Optionally, after the judgment component performs linear sequential logic formula matching on the first state combination, if any security attribute formula fails to match, the judgment component generates a first judgment result defined as not satisfied, and extracts the state number, control object identifier, current state node, predecessor state number, trigger event, clock variable value, clock constraint judgment result, and the security attribute formula number of the failed match for the first state combination. This data is then encapsulated into a violation state record. Subsequently, the judgment component sends an activation command to the generation component, causing the generation component to enter the vulnerability counterexample path generation process. After receiving the activation command, the generation component determines the violation type based on the security attribute formula number of the failed match. For example, if the failed match formula is "the instruction execution state must not be entered when the latch flag is valid," the violation type is determined to be latch bypass; if the failed match formula is "the control action must not be executed outside the authorized valid time window," the violation type is determined to be time window out of bounds; if the failed match formula is "the feedback confirmation state must be entered within the feedback waiting time limit after the control instruction is executed," the violation type is determined to be feedback timeout. The generation component then identifies the first state combination as a reachable state that does not satisfy the security property and uses this reachable state as the endpoint state of the counterexample path. If the reachable state has already entered a dangerous state node, it is directly marked as a dangerous state. If the reachable state has not yet been marked as a dangerous state, but its triggering event or clock variable value has violated the security property, the generation component maps it to the corresponding dangerous state according to the violation type.

[0029] After identifying a dangerous state, the generation component calls the state transition record table, using the state number of the first state combination as the query entry point, to read the predecessor state number, transition edge number, triggering event, clock variable value, clock constraint condition, and state change result corresponding to that state number. Next, the generation component continues to use the predecessor state number as a new query entry point, querying the previous state level by level in the state transition record table until the initial state number is found. During the backtracking process, the generation component temporarily stores the transition records obtained from each query in the backtracking order. After completing the backtracking, the generation component reorders the temporarily stored transition records according to the direction from the initial state to the dangerous state, forming a complete state transition chain. Then, it extracts the event sequence and clock constraint sequence from the state transition chain. The event sequence is arranged in the order in which the state transitions occur, including control instruction generation events, permission verification events, latching state judgment events, control action execution events, feedback reception events, and exception triggering events. The clock constraint sequence corresponds one-to-one with the event sequence, including authorization validity time constraints, allowed execution time window constraints, feedback waiting time limit constraints, and clock constraints violated when a dangerous state is triggered. The generation component combines event sequences, clock constraint sequences, state transition links, violation security attribute formula numbers, and dangerous state identifiers to generate the first vulnerability counterexample path, which describes the complete triggering process from the initial state to the dangerous state and clarifies the key conditions for the occurrence of the dangerous state.

[0030] Taking remote gate opening control as an example, if the first judgment result shows that the first state combination violates the security attribute of "not entering the command execution state when the interlock flag is valid", the generation component determines the current first state combination entering the command execution state as a dangerous state. It then traces back from this dangerous state to obtain the initial state, the command pending verification state, the command allowed state, and the command execution state. The generation component then extracts the corresponding event sequence as "receive gate opening command, permission verification passed, interlock flag valid, execute gate opening action", and extracts the corresponding clock constraints as "authorization validity time not exceeded, allowed execution time window satisfied, interlock constraint not satisfied". The final generated first vulnerability counterexample path shows that even when the interlock flag is still valid, the control logic still allows the gate opening action to enter the execution state, thus locating the interlock bypass vulnerability. Therefore, when the first judgment result does not meet the security attribute, it automatically locates the unlawful reachable state, traces back the formation process of the dangerous state, and generates a first vulnerability counterexample path containing the event sequence and clock constraints, providing a traceable basis for subsequent attack graph construction and targeted hardening.

[0031] Based on the two types of inspection results in the inspection results, an attack graph based on targeted attacks is determined, and attack testing and cross-validation based on security attributes are performed on the power monitoring network to obtain the hardening target.

[0032] In one embodiment, after obtaining the inspection results, two types of inspection results are selected. Since these two types of inspection results indicate that the power monitoring network may enter a dangerous state under specific state combinations, event sequences, and time constraints, the vulnerability counterexample paths within them are used as the basis for subsequent attack analysis. Combining the actual topology of the power monitoring network, device vulnerabilities, service openness, and access control policies, the entry nodes, lateral movement paths, privilege escalation steps, and key control nodes that attackers may exploit are deduced. This constructs a targeted attack graph for specific risk scenarios. This attack graph represents the reachable path from the initial intrusion point to the dangerous control state, as well as the dependencies between each attack step. After the attack graph is determined, controlled attack tests are conducted on the power monitoring network according to the attack paths in the attack graph. This verifies whether the attacker can trigger the dangerous behavior indicated by the vulnerability counterexample paths under the corresponding conditions. Simultaneously, the attack test results are cross-validated with preset security attributes to determine whether unauthorized control, abnormal opening and closing, unauthorized setting modifications, linkage interlock failures, timeout execution, or failure to promptly block dangerous states occur during the test. If both the attack test results and the security attribute verification results indicate that a certain attack path can lead to the destruction of security attributes, then the attack path and its associated device nodes, communication links, service ports, control rules, permission policies or timing constraints are identified as reinforcement targets, providing a basis for the subsequent generation of reinforcement plans.

[0033] Furthermore, by determining the attack graph based on targeted attacks, attack testing and cross-validation based on security attributes are conducted on the power monitoring network to obtain the hardening targets, including: The system identifies two types of detection results and uses each vulnerability counterexample path as an initial attack seed. Based on the power monitoring network topology, device vulnerabilities, service openness, and access control policies, an attack graph is generated according to the initial attack seed. The attack graph contains at least one attack path, which can be a single-step attack sequence or a multi-step attack sequence. The power monitoring network is then tested based on the attack graph to determine the hardening target. The hardening target is a mapping sequence representing the attack path map, risk level ranking, and defense blind spot coordinates.

[0034] Preferably, after completing the state space traversal, the inspection results are first read, and the results are filtered into two categories according to the result type field. For each category two detection result, the vulnerability counterexample path is extracted and registered as the initial attack seed, representing the dangerous control triggering link that has been formally verified. Subsequently, the dangerous state in the initial attack seed is used as the attack target node, and the triggering event in the vulnerability counterexample path is used as the target attack step. The power monitoring network topology table, device vulnerability table, service exposure table, and access control policy table are read from the network control center. The network topology table is used to determine the communication connection relationship between devices; the device vulnerability table is used to determine the exploitable defects of each device; the service exposure table is used to determine the communication services and control interfaces exposed by the devices; and the access control policy table is used to determine whether access is allowed between different devices and the scope of access permissions. The above data is uniformly written into the attack element table, and an attack graph is generated according to the preset path derivation rules. Specifically, if the device vulnerability table shows that device A has a vulnerability that can affect control privileges, and the network topology table shows that device A can access the control object in the vulnerability counterexample path, then a first attack path is generated, starting with "device A vulnerability triggering", with "obtaining device A's control channel" as the intermediate node, and "triggering the control event in the vulnerability counterexample path" as the target node. If the access control policy table shows that there is a trust relationship between device B and the target control object, and device B can forward control commands to the target control object, then a second attack path is generated, starting with "obtaining device B's trusted access location", with "using device B's trust relationship to enter the target control link" as the intermediate node, and "triggering a dangerous state" as the target node. If the service openness table shows that device C has open login services, and the device vulnerability table records that device C has a weak password risk, and device C and the target control object are in the same control business link, then a third attack path is generated, starting with "establishing an access session through device C's weak authentication risk", with "entering the control business link" as the intermediate node, and "triggering a dangerous event sequence in the vulnerability counterexample path" as the target node. Thus, the same vulnerability counterexample path can give rise to multiple different attack paths based on device vulnerabilities, device trust relationships, and weak password risks, demonstrating different ways to reach this dangerous state in a real network environment.

[0035] When generating the attack graph, each device, service, permission state, control event, and dangerous state is encoded as an attack graph node. The connectivity conditions, permission conditions, service conditions, vulnerability conditions, and clock conditions between nodes are encoded as directed edges. Each directed edge records its preconditions and execution result. If an attack path can reach a dangerous state from its starting point with only one attack step, it is marked as a single-step attack sequence; if an attack path requires passing through multiple intermediate nodes to reach a dangerous state, it is marked as a multi-step attack sequence. After the attack graph is constructed, targeted tests are performed on the power monitoring network according to the attack path numbers, and the verified security attributes are determined based on a type of inspection result. By cross-validating the verified security attributes with the targeted test results, and determining the hardening targets based on the validation results, clear and executable hardening targets are provided for the subsequent generation of hardening plans.

[0036] Furthermore, the power monitoring network is tested to determine reinforcement targets, including: Based on the first attack path in the attack graph, a targeted test is performed on the power monitoring network to obtain a first test result; based on a type of inspection result based on formal security proof, a verified security attribute is determined; the first test result and the verified security attribute are cross-validated to determine a first verification result, wherein if the verified security attribute is violated, the first verification result is a high-risk path; based on the first test result and the first verification result, a first hardening target is generated.

[0037] Preferably, the first attack path is read from the attack graph, and the attack starting point node, intermediate nodes, target danger state nodes, and triggering conditions between each node are parsed. Then, targeted testing is performed in an authorized testing environment according to the node order of the first attack path. During testing, the reachability of the attack starting point of the first attack path is first verified to determine whether the attack starting point can establish a communication connection with the next node. If the communication connection is satisfied, the access control policy corresponding to that node is further verified to allow entry into the next control link. If the access control conditions are satisfied, the service open state, device vulnerability state, and trust relationship state recorded in the first attack path are further verified to support the continued advancement of the attack path. When the attack path advances to the controlled object node, based on the triggering events and clock constraints recorded in the first attack path, it is verified whether the path can trigger a control event sequence consistent with the vulnerability counterexample path, and whether the corresponding danger state has been reached. After completing the above tests, a first test result is generated. This first test result includes at least the first attack path number, the nodes passed, the blocked nodes, the successfully triggered control events, the satisfied clock constraints, the final state reached, and the path advancement conclusion.

[0038] Next, a set of inspection results based on formal security proofs is read, and verified security attributes are extracted from these results to form a set of verified security attributes. This set includes security attributes such as: no unauthorized control actions can be executed; no entry into execution state when the lockout flag is valid; a feedback confirmation state must be entered within the feedback waiting time limit after the control command is executed; no setting modifications can be performed outside the authorized time window; and no reachable path can enter a dangerous state. The path progression conclusion, control event, permission state, lockout state, feedback state, clock variable value, and final state from the first test result are mapped item by item to the set of verified security attributes, and it is determined whether the first test result violates any of the security attributes that have been formally proven to be achievable.

[0039] If the first test result shows that the first attack path triggers a control execution event without meeting the authorization conditions, enters the control execution state while the latch flag is valid, completes the setting modification after the authorized time window has expired, or ultimately reaches a dangerous state, then the first test result is determined to violate the verification passed security attribute, and the first verification result is identified as a high-risk path. If the first test result does not violate the verification passed security attribute but can advance to a critical control node, then the first verification result is identified as a medium-risk path; if the first test result is blocked at an access control node, service node, or trust boundary, and no control event violating security attributes is triggered, then the first verification result is identified as a low-risk path. After determining the first verification result, a first hardening target is generated based on the first test result and the first verification result. If the first verification result indicates a high-risk path, the critical nodes in the first attack path that cause security attributes to be violated are identified as priority hardening targets. The corresponding device identifiers, service identifiers, access control policy identifiers, trust relationship identifiers, control logic rule identifiers, and clock constraint parameters are extracted to form the first hardening target. This first hardening target includes access control policies that need to be modified, open services that need to be closed or restricted, device vulnerabilities that need to be eliminated, trust relationships that need to be tightened, locking judgment conditions that need to be supplemented, and authorization time windows that need to be adjusted. Therefore, by cross-validating the targeted test results of the first attack path with formally proven security attributes, it is possible to accurately determine whether the attack path constitutes a high-risk path, and transform the protection gaps exposed in the test into clear hardening targets, improving the accuracy of hardening positioning and the reliability of priority ranking.

[0040] Based on the stated reinforcement objectives, a reinforcement plan is generated and automatically distributed to perform reinforcement processing on the power monitoring network.

[0041] In one embodiment, after obtaining the reinforcement target, targeted reinforcement analysis is performed according to the target, converting the target into a reinforcement plan. If the reinforcement target corresponds to an access control defect, an access policy tightening action is generated; if it corresponds to an abnormally open service, a service shutdown or access restriction action is generated; if it corresponds to a control logic defect, a rule correction action to supplement permission verification, latch verification, and time window verification is generated; if it corresponds to a timing constraint defect, a parameter correction action to adjust the authorization validity time and feedback waiting time limit is generated. After the reinforcement plan is generated, it is sent to the corresponding reinforcement component through the policy distribution interface of the network central control. The reinforcement component completes the configuration modification according to the execution order and sends the execution result back to the intelligent inspection module. Thus, the automatic conversion and execution of reinforcement targets into reinforcement actions are realized, improving the targeting and closed-loop efficiency of power monitoring network reinforcement processing.

[0042] Furthermore, targeted reinforcement analysis is performed based on the reinforcement objectives to determine reinforcement plans; the reinforcement plans are then automatically distributed to the reinforcement components via the infrastructure to perform security reinforcement processing on the power monitoring network.

[0043] Preferably, after determining the hardening target, targeted hardening analysis is performed according to a preset hardening rule mapping table. Different types of hardening targets are converted into corresponding hardening actions. Specifically, access control vulnerabilities correspond to access control list update actions; service openness vulnerabilities correspond to port closure actions; switching link vulnerabilities correspond to switch port isolation actions; control logic vulnerabilities correspond to device configuration rule update actions; and clock constraint vulnerabilities correspond to control parameter modification actions. Subsequently, a hardening plan is generated based on the hardening actions. This plan includes the device to be hardened, the type of the hardened object, the original configuration value, the target configuration value, the execution command, the execution order, the verification rules, and the rollback command. To achieve automated deployment, the network control center pre-deploys infrastructure, such as a code execution engine, and stores firewall configuration templates, switch configuration templates, and device configuration templates within this engine. The hardening plan is converted into code scripts for the infrastructure, enabling firewalls, switches, and device configuration terminals to be automatically configured according to the same hardening plan. In practice, if the target of hardening is a firewall access control vulnerability, the script writes the source address, destination address, service port, and allow status into the firewall configuration template, modifies the abnormal allow policy to a deny policy, and retains the necessary access policies for authorized monitoring hosts to the target device. If the target of hardening is a blind spot on the switch side, the script writes the target port number, its security domain, and port isolation parameters into the switch configuration template, adjusts unnecessary interconnected ports to an isolated state, and restricts abnormal devices from forwarding data to the control service link. If the target of hardening is a control logic vulnerability on the device configuration side, the script writes the rule number, interlock verification field, permission verification field, authorization time window field, and feedback timeout field of the corresponding control object into the device configuration template, ensuring that remote opening and closing, protection setting modification, and linkage control actions must complete the corresponding security verification before entering the execution state. Before distribution, the infrastructure performs syntax checks, device identifier matching checks, and configuration conflict checks on the scripts. After passing these checks, the firewall configuration script is distributed to the firewall management interface, the switch configuration script to the switch management interface, and the device configuration script to the device configuration interface, following the execution order in the hardening plan. Each hardening component receives its corresponding script, executes the configuration changes, and sends the execution results, the changed configuration values, the execution time, and error information back to the network control center. The intelligent inspection module marks the status of the hardening plan based on the returned results. If all configuration items execute successfully, the corresponding hardening target is marked as hardened; if any configuration item fails to execute, a rollback command is invoked to restore the original configuration value of that item, and the hardening target is marked as needing re-hardening. This automatically converts hardening targets into deployable, executable, verifiable, and rollback-capable infrastructure-as-code configurations, enabling targeted hardening optimization of firewalls, switches, and device configuration interfaces, and improving the automation and closed-loop reliability of power monitoring network security hardening processes.

[0044] Furthermore, after hardening the power monitoring network, the following measures are taken: Based on the attack graph, a verification attack path is generated; in the hardened power monitoring network, a test based on the verification attack path is performed, and a verification test result is generated; if the verification test result indicates that the attack path is blocked, a hardening termination command is generated.

[0045] Preferably, after completing the security hardening of the power monitoring network, the attack graph generated before hardening is read, and the attack path corresponding to the hardening target is extracted from the attack graph as the verification attack path. When generating the verification attack path, attack paths marked as high-risk paths before hardening are selected first, and the original triggering order and key conditions in the attack path are retained to verify whether the hardening measures truly block the original risky links. Subsequently, in the security-hardened power monitoring network, verification tests are performed according to the node order of the verification attack path. During the test, it is first verified whether the attack starting point can still access the next device node. If the access is blocked by firewall policies or access control policies, the blocking location and blocking reason are recorded; if the access is still reachable, the service port, trust relationship, and control link of the next node are further verified to ensure that the attack path progression conditions are still met. When the verification attack path progresses to the controlled object, it is further checked whether the hardened control logic rules have added permission verification, latch verification, and time window verification, and it is determined whether the control command can still enter the execution state even if the security attributes are violated. If any critical node is blocked during the verification process, or if the control command cannot trigger the dangerous state due to insufficient permissions, effective locking, time window exceeding the limit, or feedback timeout, a verification test result defined as attack path blocking is generated. When the verification test result is attack path blocking, the corresponding verification attack path number, blocking node, blocking policy, hardening configuration items, and test time are written into the hardening verification record, and the hardening target is marked as verified as passed. If all verification attack paths corresponding to the same hardening target are blocked, and no path that can bypass the hardening policy to continue to the dangerous state is found, a hardening termination command is generated to end the processing flow of the current hardening target, instruct the network control to retain the current hardening configuration, stop repeated hardening operations on the target, and output the hardening completion result. Thus, the original attack path can be retested and verified after hardening to confirm that the hardening measures have cut off the dangerous state triggering link, realizing a closed-loop process for power monitoring network security inspection, hardening, and verification.

[0046] Furthermore, if the verification test result shows that the attack path is not blocked, an iterative reinforcement loop is entered until all security attributes are satisfied and the verification attack path cannot be bypassed.

[0047] Optionally, if the intelligent inspection module determines in the verification test after security hardening that the verification attack path can still continue to advance to the target controlled object, or can still trigger control events that violate security attributes, then the verification test result is determined to be that the attack path is not blocked. At this time, the iterative hardening loop is entered. That is, firstly, the unblocked path number, bypass node, bypass condition, hardening configuration already executed, and security attribute violations still triggered in the verification test result are read, and the above content is compared with the original attack graph to determine the reason why the attack path is not blocked. If the reason for not blocking is that the access control policy still has abnormal allowance relationships, then the access rules from the corresponding source device to the target device are readjusted; if the reason for not blocking is that the switching link still allows unnecessary devices to enter the control service link, then the switch port isolation or forwarding relationship is readjusted; if the reason for not blocking is that the device configuration still allows control actions to be executed when the latch is valid, the permissions are insufficient, or the time window is out of bounds, then the corresponding control logic rules are revised, and latch verification, permission verification, and clock constraint judgment conditions are added. After identifying the cause of the non-blocking attack, the hardening target is updated based on the new bypass location, and a new hardening plan is generated. The updated hardening plan is then automatically distributed to the corresponding hardening components via the network control center for execution. After the hardening components complete the configuration change, a new verification attack path is generated again based on the attack graph, and the verification test is repeated in the hardened power monitoring network. The above process of identifying the cause of non-blocking, updating the hardening target, distributing the hardening plan, and retesting the verification attack path continues to loop until the state space traversal results show that all reachable states meet the security attributes, and the verification attack path is blocked at the access boundary, switching link, control logic, or clock constraint location, preventing it from reaching the dangerous state through bypass. Thus, supplementary hardening and retesting can be automatically performed when the risk is not completely eliminated in one hardening, ensuring that the hardening result of the power monitoring network not only blocks the original attack path but also suppresses bypass paths, improving the integrity and reliability of the security hardening closed loop.

[0048] like Figure 3 As shown, the changes in attack path blocking rate, bypass path discovery rate, and verification pass rate are illustrated as the number of verification test rounds increases. With continuous iterative verification and hardening, the attack path blocking rate gradually approaches 100% from 46%, and the verification pass rate also approaches 100% simultaneously. Meanwhile, the bypass path discovery rate approaches 0% from 31%, indicating that the hardening measures can gradually block the original attack paths and their bypass methods, verifying that the method has a good closed-loop hardening effect.

[0049] In summary, the embodiments of this application have at least the following technical effects: First, for the power monitoring network, control logic and security attributes are retrieved to construct an intelligent inspection module, which is then embedded and deployed in the network control center. Next, within the intelligent inspection module, a state space traversal based on a time automaton is performed. The determined state combinations are imported into a judgment component to verify whether all reachable states satisfy security attributes. When a reachable state violating security attributes exists, a generation component is activated to generate vulnerability counterexample paths. Through multiple rounds of traversal processing, inspection results are determined. These results include a first-type inspection result based on formal security proofs and a second-type inspection result based on vulnerability counterexample paths. Then, based on the second-type inspection results, an attack graph based on targeted attacks is determined. Attack testing and cross-validation based on security attributes are performed on the power monitoring network to obtain hardening targets. Finally, a hardening plan is generated based on the hardening targets and automatically distributed to perform hardening processing on the power monitoring network. This solution addresses the technical problem that traditional power monitoring networks rely on functional testing, which cannot exhaustively enumerate the combinations of multiple device linkage states, making it difficult to discover deep vulnerabilities in control logic and unknown logical risks. It achieves the technical effect of automated exhaustive discovery of control logic vulnerabilities, reproduction of attack paths, and one-click security hardening through a closed loop of formal verification and targeted attacks.

[0050] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A method for intelligent inspection and reinforcement of power monitoring network security, characterized in that, The method includes: For power monitoring networks, control logic and security attributes are retrieved to build an intelligent inspection module and embed it into the network control center; In the intelligent inspection module, a state space traversal based on a time automaton is performed, the determined state combinations are imported into the judgment component, and all reachable states are verified to satisfy the security attributes. When there are reachable states that violate the security attributes, the generation component is activated to generate vulnerability counterexample paths. Through multiple rounds of traversal processing, the inspection result is determined. The inspection results include a first type of inspection results based on formal security proofs and a second type of inspection results based on vulnerability counterexample paths. Based on the second type of inspection results in the inspection results, an attack graph based on targeted attacks is determined, and attack testing and cross-validation based on security attributes are performed on the power monitoring network to obtain the hardening target. Based on the stated reinforcement objectives, a reinforcement plan is generated and automatically distributed to perform reinforcement processing on the power monitoring network.

2. The intelligent inspection and reinforcement method for power monitoring network security as described in claim 1, characterized in that, Retrieve control logic and security attributes to construct an intelligent inspection module, including: The control logic of the power monitoring network is obtained and modeled as a time-based automaton. Obtain the security attributes of the power monitoring network and encode them as linear time-series logic formulas; A state combination recognition is performed using a time automaton, a judgment component is deployed using the linear time sequence logic formula, and a generation component is deployed using the decision of vulnerability counterexample paths, thus forming an intelligent inspection module.

3. The intelligent inspection and reinforcement method for power monitoring network security as described in claim 2, characterized in that, The control logic of the power monitoring network is acquired and modeled as a time-based automaton, including: Define a finite set of states, where each state corresponds to a discrete operating mode of the power monitoring equipment; Define a finite set of clock variables, where each clock variable represents a clock constraint condition; Define state transition relationships, wherein the state transition relationships are determined by clock constraints, event labels, and a set of clock reset actions; By scanning the power communication protocol, the logical node definitions and control block parameters are identified and encoded one by one into state nodes and transition edges, forming a time automaton. The state nodes are associated with the finite set of states, and the transition edges represent the triggering conditions and are associated with state transition relationships and a finite set of clock variables.

4. The intelligent inspection and reinforcement method for power monitoring network security as described in claim 3, characterized in that, Perform a state space traversal based on a time-based automaton, import the determined state combinations into the judgment component, and verify whether all reachable states satisfy the safety properties, including: Based on the aforementioned time automaton, the first state combination is determined through a traversal recognition method; The first state combination is input into the judgment component, the matching activation of the linear sequential logic formula is executed, and it is verified whether all reachable states satisfy the security attributes to determine the first judgment result. If the first judgment result is satisfied, generate the first formal security proof and loop instruction.

5. The intelligent inspection and reinforcement method for power monitoring network security as described in claim 4, characterized in that, If the first judgment result is not satisfied, activate the generation component; Based on the first judgment result, a reachable state that does not meet the security attributes is determined, and the generation component is input to determine the first vulnerability counterexample path, wherein the first vulnerability counterexample path is an event sequence from the initial state to the dangerous state and the corresponding clock constraint.

6. The intelligent inspection and reinforcement method for power monitoring network security as described in claim 1, characterized in that, The attack graph based on targeted attacks is determined, and attack testing and cross-validation based on security attributes are performed on the power monitoring network to obtain the hardening targets, including: Identify the two types of detection results and use the counterexample paths of each vulnerability as the initial attack seeds; Based on the power monitoring network topology, equipment vulnerabilities, service openness, and access control policies, an attack graph is generated according to the initial attack seed. The attack graph contains at least one attack path, which can be a single-step attack sequence or a multi-step attack sequence. Based on the attack graph, the power monitoring network is tested to determine the hardening targets, where the hardening targets are a mapping sequence representing the attack path map, risk level ranking, and defense blind zone coordinates.

7. The intelligent inspection and reinforcement method for power monitoring network security as described in claim 1, characterized in that, Test the power monitoring network to determine reinforcement targets, including: Based on the first attack path in the attack graph, a targeted test is performed on the power monitoring network to obtain the first test result. Based on the inspection results of a class of inspections using formal security proofs, the verified security attributes are determined. The first test result is cross-validated with the security attribute that passes verification to determine the first verification result. If the security attribute that passes verification is violated, the first verification result is a high-risk path. Based on the first test result and the first verification result, a first reinforcement target is generated.

8. The intelligent inspection and reinforcement method for power monitoring network security as described in claim 1, characterized in that, Based on the stated reinforcement objectives, a targeted reinforcement analysis is conducted to determine the reinforcement plan. The reinforcement plan is automatically distributed to the reinforcement components through the infrastructure to perform security reinforcement processing on the power monitoring network.

9. The intelligent inspection and reinforcement method for power monitoring network security as described in claim 1, characterized in that, After hardening the power monitoring network, the following steps are taken: Based on the attack graph, a verification attack path is generated; In the hardened power monitoring network, a test based on the aforementioned verification attack path is performed, and verification test results are generated. If the verification test result indicates that the attack path is blocked, a hardening termination command is generated.

10. The intelligent inspection and reinforcement method for power monitoring network security as described in claim 9, characterized in that, If the verification test result shows that the attack path is not blocked, the iterative reinforcement loop continues until all security attributes are satisfied and the verification attack path cannot be bypassed.

Images