Design and implementation of a vulnerability mining system for power internet of things terminal based on fuzzy mathematical model simulation platform

Abstract

With the rapid development of the economy, the power supply has also shown an increasing trend year by year, and many loopholes and hidden dangers have emerged during the operation of the power grid. The power grid may be subject to malicious attacks, such as hacker attacks, power theft, etc. This may lead to security risks such as power grid system paralysis and information leakage. In order to ensure the quality of power supply, it is necessary to optimize the distribution of electricity and improve power supply efficiency. This article pointed out the security performance issues of power Internet of Things (IoT) terminals and analyzed the design and implementation of a vulnerability mining system for power IoT terminals based on a fuzzy mathematical model simulation platform. This article used a fuzzy mathematical model to quantitatively evaluate the security performance of power IoT terminals, providing an effective theoretical basis for vulnerability mining. Based on the analysis of vulnerability mining technology classification and vulnerability attack process, this article characterizes vulnerability parameters through fuzzy mapping. Based on the collected vulnerability data and the online and device status of power IoT terminals, fuzzy logic inference is used to determine and mine potential vulnerability issues in power IoT terminals. This article aimed to improve the security performance of power IoT terminals and ensure the safe and stable operation of the power system. By testing the number of system vulnerabilities, vulnerability risk level, and vulnerability mining time of the power IoT terminal vulnerability mining system based on fuzzy mathematical models, it was found that the power IoT simulation platform based on fuzzy mathematical models has fewer terminal vulnerabilities. The fuzzy mathematical model can reduce the vulnerability risk level of the power IoT simulation platform system, and the time required for vulnerability mining was reduced; the time was reduced by 0.48 seconds, and the speed of vulnerability mining was improved. Fuzzy mathematical models can promote the development of the power industry, which provides strong support for the security protection of power IoT terminals.

Keywords

Power simulation platform Internet of Things terminals vulnerability mining systems fuzzy mathematical model fuzz test fuzzy logic

1. Introduction

In recent years, with the continuous progress of science and technology, the power system has played an increasingly important role in the national economy. Due to factors such as the increasing scale of the power grid and the acceleration of technological updates, people’s requirements for power supply quality have also increased. In response to the current situation, it is necessary to establish a system that meets practical needs and has high reliability and stability. The system requires a certain degree of operability, which should be able to meet the personalized needs of users and fully reflect the low complexity and high flexibility of the network structure. It is necessary to study the vulnerability mining system for power IoT terminals on a simulation platform based on fuzzy mathematical models.

The vulnerability mining system is a system based on parameter matching. It can automatically detect potential vulnerabilities and apply them to software management and performance evaluation to prevent or reduce malicious attacks that may exist on certain programs. Every organization deploying IoT devices in a vulnerability mining system needs to consider security risks to ensure that these devices are secure and trustworthy. Among all security risk solutions, firmware security analysis is crucial for fixing software errors, fixing vulnerabilities, or adding new security features to protect users of these vulnerable devices [1]. Sagar Samtani proposed a principled approach. It is possible to systematically identify all monitoring and data collection devices on the Internet, and then use state-of-the-art tools to evaluate their vulnerabilities, making them less vulnerable to network attacks [2]. Ismail Butun reviewed in detail the security attacks against wireless sensor networks and the IoT, as well as the technologies to prevent, mine, detect and mitigate these attacks [3]. Guanjun Lin reviewed the current literature on using deep learning/neural network based methods to detect software vulnerabilities, aiming to investigate how neural technology can be used to learn and understand code semantics to promote vulnerability discovery. This has prompted researchers in software engineering and cybersecurity communities to apply deep learning to learn and understand vulnerable code patterns and semantics [4]. Vulnerability mining can ensure the security of platform systems, but the above research lacks the application of technology. Previous studies have had certain limitations in the reliability and stability of vulnerability mining systems, making it difficult to fully implement the security protection of the power grid.

With the continuous development of power technology, the demand for power quality is becoming increasingly high. In order to solve the problems of complex power grid structure, high operating costs, and high failure rates, this article analyzed the vulnerability mining system for power IoT terminals based on fuzzy mathematical models, and introduced vulnerability mining technology and the application of fuzzy mathematical models in vulnerability mining. By analyzing the process of fuzzy testing, this paper introduced the vulnerability mining system for power IoT terminals, and explained the optimization effect of fuzzy mathematical models on the vulnerability mining system for power IoT terminals. The vulnerability mining system for power IoT terminals based on fuzzy mathematical model simulation platform in this article can not only effectively improve the identification effect of power grid information security risks, reduce vulnerability generation, but also significantly improve the efficiency of vulnerability mining, providing reliable guarantees for the safe operation and development of the power grid.

2. Design of a vulnerability mining system for power IoT terminals on a simulation platform

2.1 Classification of vulnerability mining techniques

Buffer overflow vulnerability: buffer overflow vulnerability is a classic vulnerability. The main reason for this kind of vulnerability is that the program does not perform Bounds checking when processing data. The overflowing data causes the key area of the program’s buffer to be covered, causing the address of the executable to be covered, thus causing security problems and directly causing the system to be damaged by malicious code.

String overflow: Strings in various command line parameters, strings in most software interactions, and strings in console input are increasingly used in application interactions, and errors in string processing and management have led to a wide range of software vulnerabilities.

Format String Vulnerability: Formatting string vulnerabilities are a new type of attack that has recently emerged. The formatting string vulnerability is mainly caused by developers not controlling user input [5]. If an attacker reads a formatted string from an untrusted address, a similar vulnerability can occur.

Pointer coverage vulnerability: For a program, the program data in memory is often execution code or program data. If a program accepts the contents of a memory address as the next execution address, the memory address containing the program execution address is called a function pointer. If a write overflow occurs in the storage process, the function pointer is accidentally overwritten, and the function execution should be changed. If the address being overwritten is carefully designed, it is possible to execute malicious code, causing this vulnerability, which is known as a pointer overwrite vulnerability.

2.2 Vulnerability attack process

Exploiting vulnerabilities can be divided into three stages: vulnerability mining, vulnerability analysis and exploit [6, 7]. Vulnerability mining is a prerequisite and foundation for the other two steps, so it is of great significance for attacking and protecting networks. Vulnerability mining is the search for vulnerabilities, mainly through the comprehensive use of various technologies and tools to understand as many potential software vulnerabilities as possible [8, 9]. However, this is not an easy task, mainly relying on personal experience. According to different analysis objects, vulnerability extraction technology can be divided into source code based vulnerability extraction technology and object code based vulnerability extraction technology.

Source code based vulnerability extraction requires access to the source code. For some open source projects, the existence of vulnerabilities can be discovered by analyzing the published source code, which can be used to extract system vulnerabilities. Source code verification techniques are used to scan software source code for security vulnerabilities and thus semantically check for insecure use of library functions and memory functions, which are usually vulnerability analysis techniques.

However, the source code of most commercial software is difficult to obtain, and only the vulnerability extraction technology based on object code can be used. Object code is difficult to analyze in compiler, instruction set, executable file format and other aspects. For vulnerability extraction based on object code, the first step is to disassemble the target binary code to be analyzed to obtain assembly code. Assembly code needs to be sliced, that is, to merge some important code related to the environment to reduce its complexity [10, 11].

2.3 Application of fuzzy mathematical model in vulnerability mining

The application of fuzzy mathematical models in vulnerability mining is mainly reflected in vulnerability assessment and priority ranking [12, 13]. Due to the involvement of many uncertain and ambiguous information in the process of vulnerability mining, such as the degree of vulnerability impact and difficulty in utilization, traditional evaluation methods may not be able to accurately handle this information. Fuzzy mathematical models can precisely solve this problem and improve the accuracy and reliability of vulnerability mining.

In the process of vulnerability mining, fuzzy mathematical models can be used to evaluate the degree of impact and difficulty in exploiting vulnerabilities. According to the characteristics and influencing factors of vulnerabilities, vulnerabilities are divided into different fuzzy set, such as “high risk”, “medium risk”, etc. After that, fuzzy logic is used to reason and make decisions on these fuzzy set, and the comprehensive evaluation results of vulnerabilities are obtained. This method can more accurately describe the impact of vulnerabilities and avoid the uncertainty and ambiguity issues in traditional evaluation methods.

After scoring vulnerabilities, it is necessary to sort them to determine the priority vulnerabilities to be fixed. To achieve this goal, a fuzzy ranking method can be used to assign a fuzzy priority value to each vulnerability based on its rating. After that, the fuzzy sorting method is used to sort these fuzzy priority values to obtain the priority order of vulnerabilities.

After obtaining the priority order of vulnerabilities, operation and maintenance personnel can develop vulnerability repair strategies based on this order. Specifically, vulnerabilities with higher priority can be prioritized for repair to reduce system risk. At the same time, appropriate repair strategies can be developed based on factors such as the impact of vulnerabilities, difficulty in utilization, and repair costs, in order to improve repair efficiency.

3. Terminal vulnerability mining system based on fuzzy mathematical model

3.1 Fuzzy logic in fuzzy mathematics

As a basic branch of mathematics, mathematical logic is the study of human thinking and its laws, without any intermediate state. From the beginning of studying some problems of formal logic with mathematical methods to the turn of the century, it has evolved into a theoretical and classified calculus system with axiomatic methods [14]. Dual metalogic based on the distinction between “true” and “false” theorem attributes is the pillar of classical mathematics. However, in reality, many phenomena have a large number of intermediate states, which requires the introduction of the concept of many-valued logic. In other words, logic is essentially a continuous logic that not only acknowledges the existence of intermediate states, but also considers the gradual process from “false” to “true” that corresponds to the evolution laws of many things.

In the process of mining loopholes in IoT terminals, many vulnerability parameters need to be characterized through fuzzy mapping, and their data curves often fluctuate continuously within an interval [15]. Classical mathematical logic mathematics is powerless to classify and analyze the size of these data values. Therefore, the concept of fuzzy logic should be introduced in the vulnerability extraction process of IoT terminals to improve the degree of process control.

3.2 Process of fuzzy testing

Fuzzy testing includes generating input data, actually executing the tested program, and checking the output of the tested program [16, 17]. The essence of fuzzy testing is the processing of input data. If the quality of the processed input data is poor, it is difficult to cause unexpected states in the tested program. According to the way data is constructed, fuzzy testing can be divided into two categories: creation based fuzzy testing and change based fuzzy testing [18, 19]. Based on the creation of fuzzy tests, predefined data field definition templates are used to generate test data, while based on changes, fuzzy tests create test data by modifying predefined kernels. Output monitoring is also a key factor in fuzzy testing, as it is directly responsible for identifying vulnerabilities. In practice, the expected and unwanted states of the tested program are not recorded, so the observable output of the program is usually treated as an unwanted state. This simplified processing can also lead to the exposure of false positives and vulnerabilities in fuzzy testing. For example, unobservable and unnecessary states can lead to vulnerabilities, while expected states that may cause program exceptions can lead to false positives.

3.3 Vulnerability diagnosis model

The fuzzy mathematical model is an advantage of the IoT simulation platform. The process of vulnerability mining is basically based on the logical judgment of the human brain, and based on the collected vulnerability data, as well as the online and device status of the power Internet of Things terminals, reasoning is used to determine potential vulnerability issues [20]. The faults inferred from vulnerabilities are called diagnostic problems. Based on logical reasoning, a diagnostic vulnerability model is established using logic.

${X}=\left\{{{x}_{1,}{x}_{2,}...{x}_{m}}\right\}$ represents the complete risk set, and ${x}_{i}$ represents the $i$ -th group of risks; ${Y}=\left\{{{y}_{1},{y}_{2},\ldots,{y}_{m}}\right\}$ represents the complete vulnerability set, and ${y}_{j}$ represents the $j$ -th vulnerability.

$P_{i}$ represents the occurrence of the $i$ -th risk $x_{i}$ , and the allocation of $P_{i}$ to $\left|{P_{i}}\right|$ is explained as the degree of occurrence of $x_{i}$ .

$Q_{j}$ represents the occurrence of the $j$ -th vulnerability $y_{j}$ , and the allocation of $Q_{j}$ to $\left|{Q_{j}}\right|$ is interpreted as the degree of occurrence of $y_{j}$ .

$R_{ij}$ indicates whether there is a causal relationship between the $i$ -th risk ${x}_{i}$ and the $j$ -th vulnerability $y_{j}$ . $\left|{R_{ij}}\right|$ only takes values of 0 or 1; $\left|{R_{ij}}\right|=$ 1 is interpreted as a causal relationship between ${x}_{i}$ and $y_{j}$ ; $\left|{R_{ij}}\right|=$ 0 is interpreted as having no causal relationship between ${x}_{i}$ and $y_{j}$ .

$Q_{j}\to\left({P_{i}\Lambda P_{ij}}\right)$ means that if there is vulnerability $y_{j}$ , there is a risk ${x}_{i}$ , and when C $y_{j}$ completely present, there is an effective implication. Additionally, if $\left|{Q_{j}}\right|=$ 1 and $\left|{R_{ij}}\right|=$ 1, then $\left|{Q_{j}\to\left({P_{i}\Lambda R_{ij}}\right)}\right|=r_{ij}>0$ . If $\left|{Q_{j}}\right|=$ 1 but $\left|{R_{ij}}\right|=$ 0, then $\left|{Q_{j}\to\left({P_{i}\Lambda R_{ij}}\right)}\right|=r_{ij}=0$ . Therefore, interpreting matrix ${R}=\left({{r}_{{ij}}}\right)_{{m}\times{n}}$ as the measure of risk $x_{i}$ occurring when vulnerability $y_{j}$ is completely present can yield $r_{ij}$ . Represented by $j_{i}=\left\{{j\left|{r_{ij}}\right\rangle 0}\right\}$ , then $j_{i}$ is the footnote to risk $x_{i}$ . If all vulnerabilities ${y}_{j}$ that have a causal relationship with $x_{i}$ are causal, then risk $x_{i}$ would definitely occur. There must be ${\begin{array}[]{*{20}c}\bot\hfill\\ {{jej}_{i}}\hfill\\ \end{array}}r_{ij}=$ 1, where ${R}=\left({r_{ij}}\right)_{{m}\times{n}}$ is derived from the experience of the foreman or the analysis and processing of the dataset [21].

$P_{i}\to Q_{j}$ means that if risk $x_{i}$ occurs, vulnerability $y_{j}$ occurs, and matrix ${S}=\left({{s}_{ij}}\right)_{{m}\times{n}}$ is derived by $\left|{P_{i}-Q_{j}}\right|=s_{ij}$ . Among them, $s_{ij}$ is the percentage of risk $x_{i}$ that meets the following rules if all vulnerabilities $y_{j}$ occur [22]:

1)
$s_{ij}\geqslant N\left({s_{ij}}\right)$ indicates that ${P}_{i}\to Q_{j}$ is a partial true proposition and only if $\left|{R_{ij}}\right|=$ 1.
2)
$s_{ij}\leqslant N\left({s_{ij}}\right)$ indicates that ${P}_{i}\to Q_{j}$ is a partial false proposition and only if $\left|{R_{ij}}\right|=$ 0.

The diagnosis of fault types can be divided into the following steps:

Given any ${j}\in{j}_{i}$ , according to the definition of ${j}_{i}$ , it is known that $\left|{Q_{j}}\right|=0$ recorded the position $Q_{j}$ as $Q_{j}^{\ast}$ . Since $P_{i}\to Q_{j}$ is a valid suggestion, when $\left|{P_{i}-Q_{j}}\right|=s_{ij}$ , according to the inference rules, there are:

$\displaystyle\left|{\neg P_{i}}\right|=\left|{\neg Q_{j}^{\ast}\wedge\left({P_% {i}\to Q_{j}}\right)}\right|=N\left({\left|{Q_{j}^{\ast}}\right|}\right)\top{s% }_{ij}$ (1)

For the gap value $S_{i}^{\left(0\right)}$ , it indicates that if none of the vulnerabilities with a causal relationship with fault $x_{i}$ have occurred to a greater extent than $S_{i}^{\left(0\right)}$ , then $x_{i}$ would not have occurred.

$\displaystyle{I}_{0}=\left\{{{i}\left|{{\begin{array}[]{{20}c}\vee\hfill\\ {{j}\in{j}_{i}}\hfill\\ \end{array}}{N}\left({{s}_{{ij}}}\right)}\right\rangle{s}_{i}^{\left(0\right)}% }\right\}$ (2)

According to the definition of ${I}_{0}$ , if ${i}\in{I}_{0}$ , then $x_{i}$ is a possible fault. In the specific case of IoT network terminal vulnerability mining, $S_{i}^{\left(0\right)}$ is always within a certain range, while the existence of ${I}_{0}\neq\emptyset$ and {1,2, …, $n$ ) real subsets limit fault search.

For taking any ${j}\in{j}_{2}$ , according to definitions $\left|{Q_{j}=q_{j}}\right|$ and $0<q_{j}<N\left({q_{j}}\right)$ , note that what actually happens at this point is $Q_{j}$ being $Q_{j}^{\ast}$ . Since $Q_{j}\to\left({P_{i}\wedge R_{ij}}\right)$ is an effective implication and $Q_{j}\to\left({P_{i}\wedge R_{ij}}\right)=r_{ij}$ is known, there are [23]:

$\displaystyle\left|{P_{i}}\right|=\left|{Q_{j}^{\ast}\wedge\left({Q_{j}\to% \left({P_{i}\wedge R_{ij}}\right)}\right)}\right|=q_{j}\top\ r_{ij},j\in j_{2}$ (3)

If there are:

$\displaystyle{I}_{1}=\left\{i|{\begin{array}[]{{20}c}\vee\hfill\\ {{j}\in{j}_{2}}\hfill\\ \end{array}}({q}_{j}{Tr}_{{ij}})>{s}_{i}^{\left(0\right)}\right\}$ (4) $\displaystyle j^{\ast}=\{j|R_{ij}=1,i\in I_{0}\mathop{\cap}\nolimits^{I}_{1}\}$ (5)

$j^{\ast}$ is the set of indicators for the symptoms to be tested. If it is $j^{\ast}\neq\emptyset$ , symptom ${j}\in j^{\ast}$ must be observed, measured, and tested to determine whether and to what extent it already exists. After the above process is completed, all symptoms should be reclassified and the first and second steps repeated until it $\in j^{\ast}\neq\emptyset$ .

If ${j}\in{j}_{3}$ is given, then $\left|{Q_{j}}\right|=q_{j}\geqslant N\left({q_{j}}\right)$ . Note that the real number $Q_{j}$ appearing at this point is $Q_{j}^{\ast}$ . When $\left|{Q_{j}}\right|=$ 1 is used, $Q_{j}\to\left({P_{i}\wedge R_{ij}}\right)$ is the property of the effective implication and $\left|{Q_{j}\to\left({P_{i}\wedge R_{ij}}\right)}\right|={r}_{{ij}}$ . According to the inference rules, there are:

$\displaystyle\left|{Q_{j}^{\ast}\wedge\left({Q_{j}\to\left({P_{i}\wedge R_{ij}% }\right)}\right)}\right|={q}_{j}\top r_{ij},j\in{j}_{3}$ (6)

If ${j}_{1}=\left\{{{j}\left|{r_{ij}}\right\rangle 0}\right\}$ , then there are:

$\displaystyle{I}=\left\{{i}|{\begin{array}[]{*{20}c}\bot\hfill\\ {{j}\in{j}_{1}}\hfill\\ \end{array}}({q}_{j}\textit{Tr}_{{ij}})=1\right\}$ (7)

${I}$ is the set of indicators that have already discovered vulnerabilities.
3.4 Simulation platform power IoT terminal vulnerability mining system

3.4.1 Simulation platform architecture

The simulation platform architecture should clarify the goal of the simulation platform, which is to achieve vulnerability mining for power IoT terminals based on fuzzy mathematical models. User interface layer: By providing a friendly user interface, it is convenient for users to input parameters, view simulation results, and conduct real-time monitoring. Simulation control layer: It is responsible for managing and scheduling simulation tasks, including task creation, execution, pause, and termination functions. Power IoT terminal data storage model layer: It contains models of various power IoT terminal devices, which are used to simulate the behavior and status of devices during the simulation process, and store terminal data. Vulnerability mining layer: Its a fuzzy mathematical model-based implementation of vulnerability mining algorithms, which are used to analyze device behavior and state data to mine potential vulnerabilities. Data storage layer: It is responsible for storing data generated during the simulation process, including device status data, vulnerability mining results, etc. The simulation control layer is shown in Fig. 1.

Figure 1.

Simulation platform architecture simulation control layer interface.

In the simulation control layer of Fig. 1, the control objects mainly include system hardware, software, corresponding authorization of the system, and management of security policies. In the simulation control layer, vulnerability detection frequency analysis and vulnerability detection time analysis can be achieved.

3.4.2 Power IoT Terminal Vulnerability Mining System

The Power IoT Terminal Vulnerability Mining System is a security assessment tool for power IoT devices, aimed at discovering and repairing potential security vulnerabilities, thereby improving the overall security of the power IoT. The Power IoT Terminal Vulnerability Mining System mainly has the following functions, and the interface of the Power IoT Terminal Vulnerability Mining System is shown in Fig. 2.

Figure 2.

Interface of the vulnerability mining system for power IoT terminals.

Vulnerability scanning and identification: The system can automatically identify potential security vulnerabilities by conducting a comprehensive scan of power IoT terminal devices. These vulnerabilities may include software defects, hardware failures, configuration errors, etc. Through real-time monitoring and regular inspections of equipment, the system can timely discover new vulnerabilities and provide a foundation for subsequent repair work.

Vulnerability assessment: Based on a fuzzy mathematical model, the system evaluates the identified vulnerabilities and determines their impact on the security of the power IoT. Fuzzy mathematical models can handle uncertainty and ambiguity information, making vulnerability assessment results more accurate and reliable. In addition, the system can also classify and sort vulnerabilities, helping operation and maintenance personnel determine the priority vulnerabilities to be fixed.

Vulnerability repair suggestions: The system provides targeted repair suggestions for operation and maintenance personnel based on the type and impact of vulnerabilities [24]. These suggestions may include software upgrades, configuration adjustments, hardware replacements, etc. By implementing these repair measures, operation and maintenance personnel can reduce the security risks of power IoT terminal equipment.

Vulnerability repair verification: After fixing the vulnerability, the system would scan the device again to verify the effectiveness of the repair measures. If the vulnerability still exists, the system would continue to provide repair suggestions until the vulnerability is completely fixed.

Security report and statistics: The system would regularly generate security reports and summarize relevant information such as vulnerability scanning, evaluation, and repair. The report includes statistical data on the security status, vulnerability type distribution, and repair progress of the equipment, which can help operation and maintenance personnel understand the overall security status of power IoT terminal equipment and provide a basis for security management decisions.

Real time monitoring and early warning: The system has real-time monitoring function, which can continuously monitor the operation status of power IoT terminal equipment. Once abnormal behavior or potential threats are detected, the system would immediately issue a warning to remind operation and maintenance personnel to take corresponding measures.

4. Impact of fuzzy mathematical models on terminal vulnerability mining systems

This article selected the traditional power simulation platform IoT terminal vulnerability mining system and the power simulation platform IoT terminal vulnerability mining system based on fuzzy mathematical models for simulation experiments, and tested the number of system vulnerabilities, vulnerability risk level, and vulnerability mining time of the system. Any changes before and after optimization were observed and analyzed. Simulation testing is conducted on the Matlab platform, which is a powerful numerical calculation software. This article writes corresponding test scripts based on the characteristics of the target system and possible types of vulnerabilities. Simulate various vulnerability scenarios.

System vulnerabilities are errors or defects in the logical structure of application software or operating system software. It can be used by criminals to attack or control the entire computer, or steal important data and information from the computer, or even install trojans or viruses through the network to disrupt the system. The more system vulnerabilities there are, the greater their security risks, which may lead to abnormal functionality or unstable operation of power IoT terminals. This not only affects the user experience, but also poses a threat to the security of power supply and operation. The number of vulnerabilities in the two power IoT simulation platform systems was tested, and the hardware, software, protocols and system security policies of the two systems were checked for vulnerabilities. The number of vulnerabilities in the two systems and how different the number of vulnerabilities in the two systems were observed. The experimental results were recorded and analyzed. The specific results are shown in Fig. 3.

Figure 3.

Testing the number of vulnerabilities in the system.

It can be seen from Fig. 3 that the number of vulnerabilities of the two power IoT simulation platform systems was different. The vulnerability of the traditional power IoT simulation platform system was more than that of the power IoT simulation platform system based on fuzzy mathematical model, and the difference in the number of vulnerabilities between software and protocol was the largest. Among them, the number of vulnerabilities on traditional system software was 25, and the number of vulnerabilities on optimized system software was 15; the number of vulnerabilities on traditional system protocols was 76, while the number of vulnerabilities on optimized system protocols was 58. It can be seen that the number of terminal vulnerabilities in the power IoT simulation platform based on fuzzy mathematical models was fewer.

Vulnerabilities can easily bring risks to platform systems and reduce platform security. A risk level assessment was conducted on the vulnerabilities identified above, with levels ranging from I to V. The evaluation of system vulnerability risk level mainly relies on factors such as the severity, exploitability, impact range, and attack complexity of vulnerabilities. Among them, Level I has the highest proven vulnerability risk, while Level V has the lowest proven vulnerability risk. For the convenience of recording, the traditional power IoT simulation platform system was recorded as System A, and the power IoT simulation platform system based on fuzzy mathematical models was recorded as System B. The test results are shown in Table 1.

Table 1

Vulnerability risk level test for the power IoT simulation platform system

	Hardware		Software		Agreement		System security policy
	System A	System B	System A	System B	System A	System B	System A	System B
Level I	0	0	1	0	10	0	0	0
Level II	1	0	5	0	15	0	0	0
Level III	1	0	6	1	15	0	2	0
Level IV	2	1	6	4	17	13	3	1
Level V	2	2	7	10	19	45	4	4
Total	6	3	25	15	76	58	9	5

Figure 4.

System vulnerability mining time test.

From Table 1, it can be seen that both traditional power IoT simulation platform systems and power IoT simulation platform systems based on fuzzy mathematical models had the lowest proportion of Level I vulnerabilities among all vulnerabilities. It can be clearly seen that there were more low-level vulnerabilities in system hardware, software, protocols, and system security strategies, and fewer high-level vulnerabilities. However, it was evident that the vulnerability level in traditional systems was higher than that in optimized systems. Taking vulnerabilities in hardware as an example, there was one level II vulnerability and one level III vulnerability in traditional systems; there were no level II or III vulnerabilities in the optimization system, only one level IV vulnerability and two level V vulnerabilities. From this, it can be seen that the fuzzy mathematical model can reduce the vulnerability risk level of the power IoT simulation platform system.

The mining time for vulnerabilities was tested. To ensure the accuracy of testing, 10 Level V vulnerabilities were identified from the traditional power IoT simulation platform system and the power IoT simulation platform system based on fuzzy mathematical models. The time taken for the vulnerability to be mined was tested and recorded. By comparing two systems, the impact of fuzzy mathematical models on system vulnerability mining was observed. The experimental results were recorded and analyzed. The specific results are shown in Fig. 4.

From Fig. 4, it can be seen that the vulnerability mining time of traditional power IoT simulation platform systems was higher than that of power IoT simulation platform systems based on fuzzy mathematical models. Among them, the vulnerability mining time of traditional power IoT simulation platform systems ranged from 4.5 to 5.2 seconds, with an average vulnerability mining time of 4.77 seconds; the vulnerability mining time of the power IoT simulation platform system based on fuzzy mathematical models was between 4.1 to 4.4 seconds, with an average vulnerability mining time of 4.29 seconds. After optimizing the power IoT simulation platform system using fuzzy mathematical models, the time for vulnerability mining was reduced by 0.48 seconds, which improved the speed of vulnerability mining.

5. Conclusion

With the rapid development of power IoT technology, the security and stability of power systems are facing increasingly serious challenges. As a key device, the security performance of power IoT terminals is crucial for the safety of the entire system. However, existing vulnerability mining methods often cannot meet the security performance requirements of power IoT terminals. This article aimed to analyze a simulation platform based on fuzzy mathematical models for vulnerability mining of power IoT terminals, in order to improve the security performance of power IoT terminals and ensure the safe and stable operation of the power system.

This article provided a detailed analysis of the security of power IoT terminals and pointed out the main security threats and challenges that power IoT terminals currently face. To address these issues, a vulnerability mining system based on fuzzy mathematical models was developed. This system utilized simulation platform technology to simulate power IoT terminals, thereby achieving real-time monitoring and evaluation of the security performance of power IoT terminals. By analyzing real-time data from simulation platforms, potential vulnerabilities in power IoT terminals can be quickly identified and located, providing strong support for the security protection of power IoT terminals.

In the experimental section, a detailed verification was conducted on the vulnerability mining method based on fuzzy mathematical models and the vulnerability mining system for power IoT terminals on the simulation platform. The experimental results show that the simulation platform based on fuzzy mathematical models for vulnerability mining of power IoT terminals can effectively mine vulnerabilities on power platforms, and the speed of vulnerability mining has also been improved, effectively improving the security performance of power IoT terminals. The design and implementation of a vulnerability mining system for power IoT terminals based on a fuzzy mathematical model simulation platform in this article may have a certain guiding role in improving the security of the power grid. However, during the research process, there are still many limitations in this article. In the design of the vulnerability mining system in this article, the scalability design of the system was not fully considered. In addition, in the experimental section, this paper did not fully consider other factors that affect system security. In the future research process, this paper will improve the system’s scalable design and fully consider the factors that affect system security.

References

Feng

. Detecting vulnerability on IoT device firmware: A survey. IEEE/CAA Journal of Automatica Sinica.2022; 10(1): 25-41.

Sagar

Zhu

Mark

John

Chen

. Identifying SCADA systems and their vulnerabilities on the internet of things: A text-mining approach. IEEE Intelligent Systems.2018; 33(2): 63-73.

Ismail

Patrik

Song

. Security of the Internet of Things: Vulnerabilities, attacks, and countermeasures. IEEE Communications Surveys & Tutorials.2019; 22(1): 616-644.

Lin

Wen

Han

Zhang

Xiang

. Software vulnerability detection using deep neural networks: a survey. Proceedings of the IEEE.2020; 108(10): 1825-1848.

Yin

Gao

Zhang

. A Novel Mathematical Model and Multi-Objective Method for the Low-Carbon Flexible Job Shop Scheduling Problem. Sustainable Computing: Informatics and Systems.2017; 13(3): 15-30.

Chen

Marcus

Laurent

. A survey on ethereum systems security: Vulnerabilities, attacks, and defenses. ACM Computing Surveys (CSUR).2020; 53(3): 1-43.

Tahreem

Haider

Mohammed

. Security vulnerabilities, attacks, countermeasures, and regulations of networked medical devices – A review. IEEE Communications Surveys & Tutorials.2019; 21(4): 3723-3768.

Yun

Chen-Lin

Zhong-Feng

Xiao-Chuan

. Survey of software vulnerability mining methods based on machine learning. Journal of Software.2020; 31(7): 2040-2061.

Akashdeep

Manoj

Thompson

Achyut

Muhammad

Sheikh

. IAF: IoT Attack Framework and Unique Taxonomy. J. Circuits Syst. Comput.2022; 31(2): 22500291-2250029:24.

10.

Guo

Wei

Zhang

. A Risk Analysis Framework for Social Engineering Attack Based on User Profiling. Journal of Organizational and End User Computing (JOEUC).2020; 32(3): 37-49. doi: 10.4018/JOEUC.2020070104.

11.

Meng

Zheng

Wang

Chu

. Modeling and Solution Algorithm for Optimization Integration of Express Terminal Nodes with a Joint Distribution Mode. Journal of Organizational and End User Computing (JOEUC).2021; 33(4): 142-166. doi: 10.4018/JOEUC.20210701.oa7.

12.

Sergiy

Vitalii

Iryna

Valerii

. The Mathematical Modeling Stages of Combining the Carriage of Goods for Indefinite, Fuzzy and Stochastic Parameters. International Journal of Integrated Engineering.2020; 12(7): 173-180.

13.

Shubham

Ahmed

. Mathematical modelling, analysis and design of fuzzy logic controller for the control of ventilation systems using MATLAB fuzzy logic toolbox. Journal of Interdisciplinary Mathematics.2020; 23(4): 843-849.

14.

Migdal

. Construction of Environmental Economic Dispatching Model Based on Electricity Market Environment. Academic Journal of Environmental Biology.2021; 2(4): 1-9. doi: 10.38007/AJEB.2021.020401.

15.

Sitton

. Reactive Power Optimization of Power System Based on Distributed Cooperative Particle Swarm Optimization Algorithm. Distributed Processing System.2020; 1(2): 46-53. doi: 10.38007/DPS.2020.010206.

16.

Ozlem

Ezgi

. Fuzzy FMEA in risk assessment for test and calibration laboratories. Quality and Reliability Engineering International.2023; 39(2): 575-589.

17.

Jiang

Chen

. Fuzzy clustering of crowdsourced test reports for apps. ACM Transactions on Internet Technology (TOIT).2018; 18(2): 1-28.

18.

Ajay

Kumar

Muhammad

Achyut

Cheng

. Intrusion detection and prevention system for an IoT environment. Digit. Commun. Networks.2022; 8(4): 540-551.

19.

Muhammad

Vandi

Andik

. Design and realization of fuzzy logic control for Ebb and flow hydroponic system. International Journal of Scientific and Technology Research.2018; 7(9): 138-144.

20.

Zhao

Kok

. Predicting electrical power output of combined cycle power plants using a novel artificial neural network optimized by electrostatic discharge algorithm. Measurement.2022; 198: 111405. doi: 10.1016/j.measurement.2022.111405.

21.

Garud

Simon

Moo

. A review on modeling of solar photovoltaic systems using artificial neural networks, fuzzy logic, genetic algorithm and hybrid models. International Journal of Energy Research.2021; 45(1): 6-35.

22.

Chesalin

Grodzenskiy

Pham

Nilov

. Agafonov. Technology for risk assessment at product lifecycle stages using fuzzy logic. Russian Technological Journal.2020; 8(5): 167-183.

23.

You

Zhou

Jiao

, et al. Fuzzy logic and neural network-based risk assessment model for import and export enterprises: A review. Journal of Data Science and Intelligent Systems.2023; 1(1): 2-11.

24.

Janaka

Harsha

Mhd

Andrei

Luca

. Android source code vulnerability detection: a systematic literature review. ACM Computing Surveys.2023; 55(9): 1-37.