Railway data asset safety monitoring and risk early warning method and system

Abstract

The invention relates to the technical field of railway data security, and provides a railway data asset security monitoring and risk early warning method and system, and the method comprises the steps: collecting multi-dimensional feature data of railway data assets, including equipment operation state data, network communication data, data access logs and environment perception data; performing heterogeneous data fusion preprocessing on the multi-dimensional feature data to generate a standardized feature vector; calculating security evaluation indexes of the standardized feature vector based on a dynamic weight distribution algorithm, wherein the security evaluation indexes comprise an integrity evaluation value, an availability evaluation value and a confidentiality evaluation value; generating a multi-level risk early warning signal according to the deviation degree of the safety evaluation index and the dynamic threshold value; and triggering dynamic control of a data asset protection strategy based on the risk early warning signal, wherein the dynamic control comprises access permission adjustment, data encryption strength grading and flow limitation. According to the invention, the safety and reliability of railway data assets can be improved, and data leakage and system fault risks are reduced.

Description

Technical Field

[0001] The present invention relates to the field of railway data security technology, and more specifically, to a railway data asset security monitoring and risk early warning method and system. Background Art

[0002] With the rapid development of railway informatization, the scale of railway data assets continues to expand, and data security faces many challenges. Existing railway data security monitoring technologies mainly focus on single-dimensional data analysis, such as equipment operation status monitoring or network communication data monitoring. Although these methods can discover some security issues to a certain extent, they cannot fully cover the multi-dimensional risks of railway data assets. For example, relying solely on equipment operation status monitoring cannot timely discover network-level attack behaviors, and simply analyzing network communication data is difficult to detect data integrity problems caused by equipment failures. In addition, most existing technologies use static thresholds for risk warnings, which are difficult to adapt to the complex and changeable operating environment of the railway system, resulting in low warning accuracy and prone to false alarms or omissions. In terms of data protection strategies, traditional methods lack a dynamic adjustment mechanism, and cannot flexibly adjust access rights, encryption strength, and flow control according to real-time risk levels, making it difficult to effectively respond to sudden security threats.

[0003] In the process of implementing the embodiments of the present invention, the inventors found that there are at least the following problems or defects in the prior art: the prior art is unable to comprehensively monitor the multi-dimensional characteristics of railway data assets, and is difficult to adapt to the dynamically changing railway operating environment, resulting in inaccurate risk warnings, lack of flexibility in data protection strategies, and inability to effectively ensure the security and reliability of railway data assets. Summary of the invention

[0004] The present invention provides a railway data asset security monitoring and risk early warning method and system.

[0005] In a first aspect of the present invention, a railway data asset security monitoring and risk early warning method is provided, comprising: S1. Collect multi-dimensional feature data of railway data assets, the multi-dimensional feature data including equipment operation status data, network communication data, data access log and environmental perception data; S2. Perform heterogeneous data fusion preprocessing on the multi-dimensional feature data to generate a standardized feature vector; S3. Calculate the security evaluation index of the standardized feature vector based on a dynamic weight allocation algorithm, wherein the security evaluation index includes an integrity evaluation value, an availability evaluation value, and a confidentiality evaluation value; S4. Generate multi-level risk warning signals based on the deviation between the safety assessment indicators and the dynamic threshold; S5. Trigger dynamic control of data asset protection strategies based on risk warning signals, including access permission adjustment, data encryption strength classification and traffic restriction.

[0006] Furthermore, the step S1 specifically includes: S11. Collecting equipment operation status data through multi-source heterogeneous sensors deployed on railway equipment nodes, wherein the multi-source heterogeneous sensors include vibration sensors, temperature sensors and current sensors; S12. Capturing network communication data based on a network probe, wherein the network communication data includes a protocol type, a packet size, and a transmission delay; S13. Extracting the spatiotemporal characteristics of data access logs through the log analysis engine, the spatiotemporal characteristics include access timestamps, access frequencies, and geographic locations of access sources; S14. Collect environmental parameters using environmental sensing equipment, where the environmental parameters include humidity, electromagnetic interference intensity, and physical protection status.

[0007] Furthermore, the heterogeneous data fusion preprocessing in step S2 includes: S21. Perform wavelet threshold denoising on the equipment operation status data to generate a denoised equipment status sequence; S22. Perform a standardized mapping operation on the network communication data, and the calculation formula is: in, is the original network communication data, is the mean of historical data, is the standard deviation of historical data; S23. Using an adaptive interpolation algorithm to fill in missing values ​​in the data access log, the adaptive interpolation algorithm is based on a time series autoregressive model; S24. Generate a standardized feature vector through the dynamic feature fusion formula: in, is the device state feature vector, is the network communication feature vector, is the log eigenvector, , , is the dynamic weight coefficient and satisfies .

[0008] Furthermore, the dynamic weight allocation algorithm in step S3 includes: S31. Calculate integrity assessment value : in, is the number of data blocks that failed verification, is the total number of data blocks; S32. Calculate availability evaluation value : in, is the average response time, is the preset response threshold, is the availability attenuation factor; S33. Calculate confidentiality assessment value , the confidentiality evaluation value is based on the joint calculation of the encryption strength classification matrix and the number of unauthorized accesses; S34. Integrity assessment based on dynamic environmental factors , Availability Evaluation Value and confidentiality assessment value Perform weighted fusion to generate comprehensive security assessment indicators : in, , , is the dynamic weight coefficient and satisfies The dynamic weight coefficient is based on the real-time load rate of the equipment and environmental risk level calculate: in, is the real-time load rate of the equipment, It is the environmental risk level.

[0009] Furthermore, the method for generating the dynamic threshold includes: S41. Constructing a time series prediction model based on historical safety assessment data, wherein the model adopts an improved exponential smoothing algorithm; S42. Calculate the threshold fluctuation interval through the Markov chain state transfer matrix; S43. According to the current equipment load factor Dynamically adjust the threshold base value: in, is the baseline threshold, is the load influence factor, is the equipment load factor.

[0010] Furthermore, the generation of the multi-level risk warning signal in step S4 includes: S44. When the deviation exceeds the first-level threshold, a yellow warning signal is generated and in-depth log analysis is initiated; S45. When the deviation exceeds the secondary threshold, an orange warning signal is generated and the data backup mechanism is triggered; S46. When the deviation exceeds the third-level threshold, a red warning signal is generated and the high-risk data link is cut off.

[0011] Furthermore, the dynamic control of step S5 includes: S51. Adjust the access control strategy based on the risk warning signal level. The calculation formula is: in, is the base access permission. is the risk attenuation coefficient, is the warning signal level; S52. Evaluate value based on confidentiality Dynamically select encryption algorithm. Enable quantum encryption channel at the same time; S53. Implement traffic shaping control based on the token bucket algorithm for high-risk data flows.

[0012] Furthermore, the dynamic weight coefficient , , Methods for determining include: S241. Through the equipment health index calculate : in, is the network health index, is the log health index; S242. , With dynamic weight coefficient , Association calculation:

[0013] S243. Use a sliding window mechanism to update the health index, and the window size is synchronized with the data collection cycle.

[0014] Furthermore, the model optimization step is also included: S6. Update the security assessment model parameters based on an online learning mechanism, wherein the online learning mechanism uses an incremental random forest algorithm; S7. Enhance the robustness of the model through an adversarial sample generator, which is based on a generative adversarial network framework and specifically includes: S71. The generator generates a simulated abnormal feature vector based on historical attack data; S72. The discriminator calculates adversarial loss for real data and simulated data: in, is the discriminator, For the generator, For real data, is the noise vector.

[0015] In a second aspect of the present invention, a railway data asset security monitoring and risk early warning system is provided, comprising: Data collection module, including multi-source heterogeneous sensor unit, network probe unit and log collection unit; Preprocessing module, including data cleaning unit, standardization mapping unit and feature fusion unit; Security assessment module, including integrity calculation unit, availability analysis unit, confidentiality assessment unit and dynamic weight fusion unit; The early warning generation module includes a threshold dynamic calculation unit, a deviation analysis unit and a multi-level signal generation unit; A dynamic control module, including an access policy adjustment unit, an encryption strength selection unit, and a flow control unit; The output of the data acquisition module is connected to the input of the preprocessing module, the output of the preprocessing module is connected to the input of the safety assessment module, the output of the safety assessment module is connected to the input of the early warning generation module, and the output of the early warning generation module is connected to the input of the dynamic control module.

[0016] According to the above-mentioned embodiments of the present invention, at least the following beneficial effects are achieved: the invention can generate standardized feature vectors by collecting multi-dimensional feature data of railway data assets and performing heterogeneous data fusion preprocessing, thereby realizing comprehensive monitoring of railway data assets. By calculating security assessment indicators based on a dynamic weight allocation algorithm, the integrity, availability and confidentiality of data assets can be accurately assessed, providing a scientific basis for risk warning. By generating multi-level risk warning signals based on the deviation between security assessment indicators and dynamic thresholds, potential security threats can be discovered in a timely manner, improving the accuracy and timeliness of warnings. In addition, through the dynamic control module, access control strategies, encryption algorithms and flow control strategies can be dynamically adjusted according to the level of risk warning signals, effectively responding to different levels of security risks and enhancing the security protection capabilities of railway data assets.

[0017] The invention also updates the parameters of the security assessment model through an online learning mechanism and uses an adversarial sample generator to enhance the robustness of the model, which can further improve the model's ability to identify unknown attacks and adapt to the complex and changing operating environment of the railway system. Overall, the invention can effectively improve the security and reliability of railway data assets, reduce risks such as data leakage and system failures, and ensure the stable operation of the railway information system. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The above and other objects, features and advantages of the exemplary embodiments of the present invention will become readily understood by reading the detailed description below with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present invention are shown in an exemplary and non-limiting manner, in which: Figure 1 A schematic diagram of a flow chart of a railway data asset security monitoring and risk early warning method provided by an embodiment of the present invention; Figure 2 A schematic diagram of the structure of a railway data asset security monitoring and risk early warning system provided by an embodiment of the present invention; Figure 3 The schematic diagram schematically shows the structure of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0019] The principles and spirit of the present invention will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement the present invention, and are not intended to limit the scope of the present invention in any way. On the contrary, these embodiments are provided to make the present invention more thorough and complete, and to fully convey the scope of the present invention to those skilled in the art.

[0020] Those skilled in the art know that the embodiments of the present invention can be implemented as a system, device, apparatus, method or computer program product. Therefore, the present invention can be specifically implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0021] It should be noted that any number of elements in the drawings is for illustration rather than limitation, and any naming is only for distinction and does not have any limiting meaning.

[0022] Reference below Figure 1 , Figure 1 The following is a flow chart of a railway data asset security monitoring and risk warning method provided by an embodiment of the present invention. Figure 1 As shown, a railway data asset security monitoring and risk warning method 100 includes: S1. Collect multi-dimensional feature data of railway data assets, the multi-dimensional feature data including equipment operation status data, network communication data, data access log and environmental perception data; S2. Perform heterogeneous data fusion preprocessing on the multi-dimensional feature data to generate a standardized feature vector; S3. Calculate the security evaluation index of the standardized feature vector based on a dynamic weight allocation algorithm, wherein the security evaluation index includes an integrity evaluation value, an availability evaluation value, and a confidentiality evaluation value; S4. Generate multi-level risk warning signals based on the deviation between the safety assessment indicators and the dynamic threshold; S5. Trigger dynamic control of data asset protection strategies based on risk warning signals, including access permission adjustment, data encryption strength classification and traffic restriction.

[0023] It should be noted that the present invention first collects multi-dimensional feature data of railway data assets, which include equipment operation status data, network communication data, data access logs and environmental perception data. Equipment operation status data refers to data collected by multi-source heterogeneous sensors deployed on railway equipment nodes. These sensors include vibration sensors, temperature sensors and current sensors, etc., which are used to monitor the operation of the equipment. Network communication data is captured by network probes, including information such as protocol type, data packet size and transmission delay, which is used to analyze whether network communication is normal or not. Data access logs are extracted by log analysis engines, and their spatiotemporal characteristics include access timestamps, access frequencies and access source geographic locations, etc., which are used to monitor whether data access behavior is abnormal. Environmental perception data is collected using environmental perception devices, including humidity, electromagnetic interference intensity and physical protection status, etc., which are used to evaluate the impact of the external environment on the security of data assets. The purpose of collecting these multi-dimensional data is to comprehensively monitor the security status of railway data assets and provide rich data support for subsequent security assessments.

[0024] Specifically, the collection of equipment operation status data is achieved by deploying a variety of sensors at key nodes of railway equipment. For example, vibration sensors can monitor the mechanical vibration of equipment. When the vibration exceeds the normal range, it may indicate that the equipment is faulty or disturbed by external forces; temperature sensors are used to measure the operating temperature of equipment. Abnormal temperature changes may indicate overheating of the equipment or failure of the cooling system; current sensors monitor the current changes of equipment. Abnormal fluctuations in current may mean that there is a problem with the electrical system of the equipment. The capture of network communication data is completed by deploying network probes at key nodes of the network. These probes can monitor network traffic in real time, analyze protocol types to determine the legitimacy of communication, monitor data packet size to determine whether there is abnormal data transmission, and measure transmission delay to evaluate network performance. The extraction of data access logs is completed by a log analysis engine, which can parse log files, extract access timestamps to determine the time sequence of access, analyze access frequency to identify abnormal access patterns, and track the geographic location of access sources to determine whether the access source is suspicious. Environmental perception data is collected through environmental perception devices installed around the equipment. These devices can monitor the humidity of the environment in real time to prevent the equipment from getting damp due to excessive humidity; monitor the intensity of electromagnetic interference to prevent external electromagnetic interference from affecting the normal operation of the equipment; and evaluate the physical protection status to ensure the physical safety of the equipment. The collection and analysis of these data provide a comprehensive perspective for the security monitoring of railway data assets.

[0025] Preferably, when collecting equipment operation status data, the threshold range of the vibration sensor can be set. For example, when the vibration amplitude exceeds the set upper threshold, an alarm is triggered to indicate that the equipment may have a mechanical failure. For the capture of network communication data, different protocol type priorities can be set according to the actual situation of the railway network, such as giving priority to monitoring protocols related to the railway signal system to ensure the normal operation of critical communications. In the extraction of data access logs, a more detailed analysis of the access frequency can be performed, such as setting a time window, and marking it as abnormal access behavior if the access frequency exceeds a certain number of times within the window. For the collection of environmental perception data, the early warning thresholds of humidity and electromagnetic interference intensity can be set in combination with the actual operating environment of the railway equipment. When these thresholds are exceeded, timely measures can be taken, such as starting the dehumidification equipment or the electromagnetic shielding device, to protect the safe operation of the equipment. In addition, machine learning algorithms can be introduced to analyze the collected multi-dimensional data, automatically identify abnormal patterns in the data, and further improve the safety monitoring capabilities of railway data assets.

[0026] In some embodiments, step S1 specifically includes: S11. Collecting equipment operation status data through multi-source heterogeneous sensors deployed on railway equipment nodes, wherein the multi-source heterogeneous sensors include vibration sensors, temperature sensors and current sensors; S12. Capturing network communication data based on a network probe, wherein the network communication data includes a protocol type, a packet size, and a transmission delay; S13. Extracting the spatiotemporal characteristics of data access logs through the log analysis engine, the spatiotemporal characteristics include access timestamps, access frequencies, and geographic locations of access sources; S14. Collect environmental parameters using environmental sensing equipment, where the environmental parameters include humidity, electromagnetic interference intensity, and physical protection status.

[0027] It should be noted that collecting multi-dimensional feature data is a basic step of the present invention, which specifically includes equipment operation status data, network communication data, data access logs and environmental perception data. Equipment operation status data is collected by multi-source heterogeneous sensors deployed on railway equipment nodes. These sensors can sense the physical operation status of the equipment. For example, vibration sensors are used to detect the vibration of the equipment, temperature sensors are used to measure the temperature change of the equipment, and current sensors are used to monitor the current status of the equipment. Network communication data is captured by network probes, which contains various information transmitted in the railway network, such as protocol type, data packet size and transmission delay, etc., which can reflect the normality of network communication. Data access logs are extracted by log analysis engines, which record the time stamps, access frequency and access source geographic location of the data being accessed, and other spatiotemporal characteristics. These characteristics help to discover abnormal access behaviors. Environmental perception data is collected using environmental perception devices, including environmental parameters such as humidity, electromagnetic interference intensity and physical protection status, which can reflect the safety of the equipment operation environment. By collecting these multi-dimensional data, the security status of railway data assets can be fully monitored.

[0028] Specifically, the collection of equipment operation status data is achieved by deploying a variety of sensors at key nodes of railway equipment. Vibration sensors can set thresholds for vibration amplitude. When the vibration exceeds the normal range, it may indicate that the equipment is faulty or disturbed by external forces. Temperature sensors can measure the operating temperature of the equipment. When the temperature exceeds the preset upper threshold, it may indicate that the equipment is overheating or the cooling system is faulty. Current sensors can monitor the current changes of the equipment. When the current fluctuates abnormally, it may mean that there is a problem with the electrical system of the equipment. The capture of network communication data is completed by deploying network probes at key nodes of the network. These probes can monitor network traffic in real time, analyze protocol types to determine the legitimacy of communication, monitor data packet size to determine whether there is abnormal data transmission, and measure transmission delay to evaluate network performance. The extraction of data access logs is completed by the log analysis engine, which can parse log files, extract access timestamps to determine the time sequence of access, analyze access frequency to identify abnormal access patterns, and track the geographic location of access sources to determine whether the access source is suspicious. The collection of environmental perception data is achieved through environmental perception devices installed around the equipment. These devices can monitor the humidity of the environment in real time to prevent the equipment from getting damp due to excessive humidity; monitor the intensity of electromagnetic interference to prevent external electromagnetic interference from affecting the normal operation of the equipment; and evaluate the physical protection status to ensure the physical safety of the equipment.

[0029] Preferably, when collecting equipment operation status data, the vibration sensor can be set more carefully, for example, different vibration frequency and amplitude thresholds can be set according to the type of equipment and the operating environment to more accurately detect the operating status of the equipment. For the capture of network communication data, different protocol priorities can be set according to the actual needs of the railway network, such as giving priority to monitoring protocols related to the railway signal system to ensure the normal operation of critical communications. In the extraction of data access logs, the access frequency can be analyzed more carefully, such as setting a time window, and marking it as abnormal access behavior if the access frequency exceeds a certain number of times within the window. For the collection of environmental perception data, the early warning thresholds of humidity and electromagnetic interference intensity can be set in combination with the actual operating environment of railway equipment. When these thresholds are exceeded, timely measures can be taken, such as starting dehumidification equipment or electromagnetic shielding devices, to protect the safe operation of the equipment. In addition, machine learning algorithms can be introduced to analyze the collected multi-dimensional data, automatically identify abnormal patterns in the data, and further improve the safety monitoring capabilities of railway data assets.

[0030] In some embodiments, the heterogeneous data fusion preprocessing in step S2 includes: S21. Perform wavelet threshold denoising on the equipment operation status data to generate a denoised equipment status sequence; S22. Perform a standardized mapping operation on the network communication data, and the calculation formula is: in, is the original network communication data, is the mean of historical data, is the standard deviation of historical data; S23. Using an adaptive interpolation algorithm to fill in missing values ​​in the data access log, the adaptive interpolation algorithm is based on a time series autoregressive model; S24. Generate a standardized feature vector through the dynamic feature fusion formula: in, is the device state feature vector, is the network communication feature vector, is the log eigenvector, , , is the dynamic weight coefficient and satisfies .

[0031] It should be noted that heterogeneous data fusion preprocessing is to standardize the collected multi-dimensional feature data in order to generate a unified standardized feature vector. This process includes wavelet threshold denoising of the equipment operation status data to remove noise interference in the data and generate a clearer equipment status sequence; performing standardized mapping operations on network communication data to unify its numerical range for subsequent processing; using an adaptive interpolation algorithm to fill in missing values ​​in the data access log to ensure data integrity; and finally, using a dynamic feature fusion formula to fuse data features from different sources into a standardized feature vector. The purpose of these steps is to eliminate differences between different data sources, improve data consistency and availability, and provide a high-quality data foundation for subsequent security assessments.

[0032] Specifically, wavelet threshold denoising is a signal processing method based on wavelet transform, which improves the clarity of the signal by decomposing the signal and removing high-frequency noise components. In the equipment operation status data, such as vibration signals or current signals, they may be affected by environmental noise or internal interference of the equipment. Wavelet threshold denoising can effectively remove these interferences and retain the main features of the signal. The standardized mapping operation of network communication data is achieved by subtracting the mean of historical data from the original data and dividing it by the standard deviation of historical data. This operation can normalize data of different ranges to a unified numerical range, which is convenient for subsequent analysis and processing. The adaptive interpolation algorithm is an algorithm based on the time series autoregressive model. It can predict missing values ​​based on existing data points, thereby filling in the gaps in the data access log and ensuring the integrity of the data. The dynamic feature fusion formula is to weight the sum of the device status feature vector, network communication feature vector and log feature vector according to the dynamic weight coefficient to generate a comprehensive standardized feature vector for subsequent security assessment.

[0033] Preferably, in the wavelet threshold denoising process, appropriate wavelet basis functions and thresholds can be selected according to the specific operating environment and signal characteristics of the device. For example, for equipment vibration signals with more high-frequency noise, the Daubechies wavelet basis function can be selected, and the threshold can be dynamically adjusted according to the signal-to-noise ratio of the signal. In the standardized mapping operation of network communication data, the mean and standard deviation of historical data can be updated regularly to adapt to changes in the network communication environment. For the adaptive interpolation algorithm, the parameters of the autoregressive model can be adjusted according to the time series characteristics of the data access log, such as increasing the order of the model to improve the accuracy of the interpolation. In addition, the dynamic weight coefficient in the dynamic feature fusion formula can be dynamically adjusted according to the importance and real-time status of the data, such as increasing the weight of the device status feature vector when the device is heavily loaded to more accurately reflect the security status of the data assets.

[0034] In some embodiments, the dynamic weight allocation algorithm in step S3 includes: S31. Calculate integrity assessment value : in, is the number of data blocks that failed verification, is the total number of data blocks; S32. Calculate availability evaluation value : in, is the average response time, is the preset response threshold, is the availability attenuation factor; S33. Calculate confidentiality assessment value , the confidentiality evaluation value is based on the joint calculation of the encryption strength classification matrix and the number of unauthorized accesses; S34. Integrity assessment based on dynamic environmental factors , Availability Evaluation Value and confidentiality assessment value Perform weighted fusion to generate comprehensive security assessment indicators : in, , , is the dynamic weight coefficient and satisfies The dynamic weight coefficient is based on the real-time load rate of the equipment and environmental risk level calculate: in, is the real-time load rate of the equipment, It is the environmental risk level.

[0035] It should be noted that the dynamic weight allocation algorithm is a key step in the present invention for calculating security assessment indicators. It calculates the corresponding evaluation values ​​by comprehensively considering the integrity, availability and confidentiality of the data, and weights and fuses these evaluation values ​​according to dynamic environmental factors to finally generate a comprehensive security assessment index. This dynamic weight allocation method can adjust the weight coefficient according to the real-time load rate of the equipment and the environmental risk level, so as to more accurately reflect the security status of data assets. For example, the integrity assessment value is determined by calculating the ratio of the number of data blocks that failed verification to the total number of data blocks, the availability assessment value is calculated based on the ratio of the average response time to the preset response threshold and an attenuation factor, and the confidentiality assessment value is calculated based on the encryption strength grading matrix and the number of unauthorized accesses. This evaluation method can comprehensively reflect the security status of data assets in different aspects.

[0036] Specifically, the calculation of the integrity assessment value is based on the integrity check result of the data. For example, the number of data blocks that failed the check can be detected through the hash check of the data block or other integrity check algorithms. By comparing this number with the total number of data blocks, the integrity assessment value can be obtained. The calculation of the availability assessment value involves the average response time and the preset response threshold. The average response time is obtained by sampling and calculating the system response time, while the preset response threshold is set according to the system design and business requirements to measure whether the system response is within an acceptable range. The attenuation factor is used to adjust the sensitivity of the availability assessment value to adapt to different business scenarios. The calculation of the confidentiality assessment value is more complicated. It needs to be combined with the encryption strength grading matrix and the number of unauthorized accesses for comprehensive evaluation. The encryption strength grading matrix can classify data into different encryption levels according to the importance and sensitivity of the data, while the number of unauthorized accesses reflects the risk level of illegal access to the data. By jointly calculating these two factors, the confidentiality assessment value can be obtained. The calculation of the dynamic weight coefficient is determined based on the real-time load rate of the device and the environmental risk level, which can ensure that under different operating conditions, the security assessment index can accurately reflect the security status of the data assets.

[0037] Preferably, when calculating the integrity assessment value, a more advanced verification algorithm, such as a distributed verification algorithm based on blockchain, can be used to improve the accuracy and reliability of the verification. For the calculation of the availability assessment value, the attenuation factor can be dynamically adjusted according to actual business needs, such as increasing the value of the attenuation factor under high load conditions to more strictly evaluate the system availability. In the calculation of the confidentiality assessment value, more factors can be introduced, such as the access permission level of the data and the classification label of the data, to more comprehensively evaluate the confidentiality of the data. In addition, the calculation of the dynamic weight coefficient can be more finely adjusted according to the changes in the real-time load rate of the equipment and the environmental risk level, such as dynamically predicting the changing trend of the weight coefficient through a machine learning algorithm to achieve a more accurate security assessment.

[0038] In some embodiments, the method for generating the dynamic threshold comprises: S41. Constructing a time series prediction model based on historical safety assessment data, wherein the model adopts an improved exponential smoothing algorithm; S42. Calculate the threshold fluctuation interval through the Markov chain state transfer matrix; S43. According to the current equipment load factor Dynamically adjust the threshold base value: in, is the baseline threshold, is the load influence factor, is the equipment load factor.

[0039] It should be noted that the generation of dynamic thresholds is a key step in the present invention for improving the accuracy of risk warnings. The method for generating dynamic thresholds includes constructing a time series prediction model based on historical safety assessment data, calculating the threshold fluctuation range through the Markov chain state transition matrix, and dynamically adjusting the threshold reference value according to the current equipment load factor. The time series prediction model adopts an improved exponential smoothing algorithm, which can predict the changing trend of future data based on historical data, thereby providing a basis for the generation of dynamic thresholds. The Markov chain state transition matrix is ​​used to calculate the fluctuation range of the threshold, taking into account the transition probability between data states, so that the threshold can adapt to the dynamic changes of data. The equipment load factor reflects the current operating load of the equipment. By dynamically adjusting the threshold reference value, the threshold can be made more in line with the actual operating state of the equipment, thereby improving the accuracy and adaptability of risk warnings.

[0040] Specifically, the time series prediction model is built based on historical security assessment data, which includes past integrity assessment values, availability assessment values, and confidentiality assessment values. The improved exponential smoothing algorithm enables the model to better capture the changing trend of data by assigning different weights to historical data. For example, recent data will be assigned higher weights to reflect the latest changes in the data. The Markov chain state transition matrix is ​​constructed based on the transition probability between data states. It divides the data state into different intervals and calculates the probability of transitioning from one state to another. In this way, the fluctuation range of the threshold can be predicted so that the threshold can adapt to the dynamic changes of data. The equipment load factor is calculated based on the real-time operating status of the equipment, which reflects the current load of the equipment. By combining the equipment load factor with the load influence factor, the threshold baseline value can be dynamically adjusted to make the threshold more consistent with the actual operating status of the equipment. For example, when the equipment load is high, the threshold baseline value can be appropriately increased to avoid false alarms caused by excessive equipment load.

[0041] Preferably, when constructing a time series prediction model, appropriate exponential smoothing parameters can be selected according to the characteristics of historical data to improve the prediction accuracy of the model. For example, for data with seasonal changes, a seasonal exponential smoothing algorithm can be introduced. When calculating the Markov chain state transition matrix, the division accuracy of the state interval can be increased to more accurately reflect the transition probability between data states. For example, the data state is divided into more intervals, and the range of each interval is adjusted according to the actual data. When dynamically adjusting the threshold reference value, the load impact factor can be adjusted according to the actual operation of the equipment. For example, different load impact factors can be set for different types of equipment to better reflect the impact of the equipment load on the threshold. In addition, machine learning algorithms, such as neural networks, can be introduced to further optimize the generation process of dynamic thresholds and improve the adaptability and accuracy of thresholds.

[0042] In some embodiments, the generation of the multi-level risk warning signal in step S4 includes: S44. When the deviation exceeds the first-level threshold, a yellow warning signal is generated and in-depth log analysis is initiated; S45. When the deviation exceeds the secondary threshold, an orange warning signal is generated and the data backup mechanism is triggered; S46. When the deviation exceeds the third-level threshold, a red warning signal is generated and the high-risk data link is cut off.

[0043] It should be noted that the generation of multi-level risk warning signals is based on the deviation between the security assessment index and the dynamic threshold. The deviation refers to the degree of difference between the current security assessment index and the set dynamic threshold, which is used to measure the deviation between the security status of data assets and the normal status. When the deviation exceeds the set first-level threshold, a yellow warning signal is generated and the log in-depth analysis is started, which indicates that there may be potential security risks and further analysis of the log is required to determine the specific source of the risk. When the deviation exceeds the second-level threshold, an orange warning signal is generated and the data backup mechanism is triggered, which indicates that the security risk is high and measures need to be taken to protect the integrity and availability of the data. When the deviation exceeds the third-level threshold, a red warning signal is generated and the high-risk data link is cut off, which indicates that the security risk is extremely high and immediate measures need to be taken to prevent data leakage or system failure. This multi-level warning mechanism can take different response measures according to the severity of the risk, thereby improving the effectiveness and flexibility of risk warning.

[0044] Specifically, the calculation of the degree of deviation is achieved by comparing the current security assessment index with the dynamic threshold. For example, the integrity assessment value, availability assessment value, and confidentiality assessment value are compared with the corresponding dynamic thresholds respectively to calculate their respective degrees of deviation. The first-level threshold, second-level threshold, and third-level threshold are pre-set according to actual security requirements and risk assessment standards to distinguish different risk levels. The yellow warning signal indicates that there may be security risks, and it is necessary to start deep log analysis to determine the specific source of the risk by analyzing detailed information of the data access log, such as access timestamp, access frequency, and geographic location of the access source. The orange warning signal indicates that the security risk is high, and the data backup mechanism needs to be triggered to ensure the integrity and availability of the data by backing up important data. The red warning signal indicates that the security risk is extremely high, and it is necessary to cut off the high-risk data link to prevent data leakage or system failure by isolating the threatened data flow.

[0045] Preferably, when calculating the degree of deviation, different weights can be set for different security assessment indicators to reflect their importance in the overall security assessment. For example, a higher weight can be given to the confidentiality assessment value because the confidentiality of the data is usually more critical. When setting the first-level threshold, the second-level threshold, and the third-level threshold, adjustments can be made based on historical data and actual operating conditions. For example, by analyzing the data of historical security events, the reasonable range of different thresholds can be determined. When starting the deep analysis of logs, machine learning algorithms can be combined to automatically identify abnormal patterns in logs and improve analysis efficiency. When triggering the data backup mechanism, key data can be backed up first based on the importance and urgency of the data. When cutting off a high-risk data link, an automatic recovery mechanism can be set to promptly restore the normal operation of the data link after the risk is lifted. In addition, user-defined warning rules can be introduced to allow users to adjust the generation conditions and response measures of warning signals according to their own needs.

[0046] In some embodiments, the dynamic control of step S5 includes: S51. Adjust the access control strategy based on the risk warning signal level. The calculation formula is: in, is the base access permission. is the risk attenuation coefficient, is the warning signal level; S52. Evaluate value based on confidentiality Dynamically select encryption algorithm. Enable quantum encryption channel at the same time; S53. Implement traffic shaping control based on the token bucket algorithm for high-risk data flows.

[0047] It should be noted that the dynamic control module is a key link in adjusting the data asset protection strategy according to the risk warning signal level. Specifically, it can dynamically adjust the access control strategy, select the encryption algorithm, and implement flow control according to different risk levels. The adjustment of the access control strategy is based on the risk attenuation coefficient and the warning signal level to calculate new access rights, thereby limiting the access rights of high-risk users and protecting the security of data assets. The selection of the encryption algorithm is dynamically determined based on the confidentiality assessment value. When the confidentiality assessment value is lower than a certain threshold, a higher-level encryption algorithm, such as a quantum encryption channel, is enabled to enhance the confidentiality of the data. Flow control is to implement flow shaping control based on the token bucket algorithm for high-risk data flows to limit the impact of abnormal traffic on the system and ensure the stable operation of the network. Through these dynamic control measures, different levels of security risks can be effectively responded to and the security and reliability of data assets can be improved.

[0048] Specifically, the adjustment of access control policies is achieved by calculating the product of the baseline access rights and the risk attenuation coefficient. The baseline access rights are the system's default access rights level, while the risk attenuation coefficient is a parameter that is dynamically adjusted according to the current risk level. For example, when the risk level is high, the risk attenuation coefficient will decrease, thereby reducing the user's access rights. The selection of encryption algorithms is based on the specific value of the confidentiality assessment value. If the confidentiality assessment value is lower than 0.6, the system will enable the quantum encryption channel, which is a high-level encryption technology that can effectively prevent data from being stolen. Flow control is achieved through the token bucket algorithm, which can shape the data flow, limit the burstiness of the flow, and ensure the reasonable allocation of network resources. For example, when a high-risk data flow is detected, the token bucket algorithm will limit its flow to prevent it from occupying too much network bandwidth.

[0049] Preferably, when adjusting the access control policy, the calculation method of the risk attenuation coefficient can be further refined. For example, different attenuation coefficients can be set according to different risk types (such as network attacks, equipment failures, etc.) to more accurately adjust access rights. When selecting an encryption algorithm, in addition to the quantum encryption channel, other suitable encryption algorithms, such as the AES encryption algorithm, can be selected according to the range of confidentiality assessment values ​​to balance encryption strength and system performance. When implementing flow control, other flow control algorithms, such as the leaky bucket algorithm, can be combined to enhance the effect of flow control. In addition, a user feedback mechanism can be introduced to allow users to adjust the access control policy and encryption algorithm selection according to actual conditions, thereby improving the flexibility of the system and user experience.

[0050] In some embodiments, the dynamic weight coefficient , , Methods for determining include: S241. Through the equipment health index calculate : in, is the network health index, is the log health index; S242. , With dynamic weight coefficient , Association calculation:

[0051] S243. Use a sliding window mechanism to update the health index, and the window size is synchronized with the data collection cycle.

[0052] It should be noted that the determination of the dynamic weight coefficient is based on the device health index, network health index and log health index. The device health index is obtained by comprehensively evaluating the operating status data of the device, reflecting the health status of the device; the network health index is calculated based on the network communication data, reflecting the health status of the network; the log health index is obtained by analyzing the data access log, reflecting the health status of the data access behavior. By calculating the dynamic weight coefficient through these health indices, the weights of different data sources in feature fusion can be more reasonably allocated, thereby improving the quality of the feature vector and the accuracy of subsequent security assessments. The sliding window mechanism is used to update the health index to ensure that the weight coefficient can reflect the latest status of the data assets in a timely manner.

[0053] Specifically, the device health index can be obtained by analyzing the device operation status data, for example, the health score of the device is calculated through the data collected by the vibration sensor, temperature sensor and current sensor. The network health index can be obtained by analyzing the network communication data, for example, the health of the network is evaluated by the information such as the packet size and transmission delay captured by the network probe. The log health index can be obtained by analyzing the spatiotemporal characteristics of the data access log, for example, the health of the data access behavior is evaluated by the information such as the access timestamp, access frequency and access source geographic location. The calculation of the dynamic weight coefficient is based on the relative importance of these health indexes. For example, the device health index accounts for a certain proportion of the total weight, and the network health index and log health index account for a certain proportion of the remaining weight respectively. The window size of the sliding window mechanism can be set according to the data collection cycle. For example, if the data collection cycle is 10 minutes, the sliding window size can also be set to 10 minutes to ensure the real-time update of the health index.

[0054] Preferably, when calculating the device health index, more sensor data, such as humidity sensors and electromagnetic interference sensors, can be introduced to more comprehensively evaluate the health of the device. When calculating the network health index, different weights can be set according to the data packets of different protocol types to more accurately reflect the health of the network. When calculating the log health index, machine learning algorithms, such as cluster analysis, can be introduced to automatically identify abnormal access patterns, thereby more accurately evaluating the health of data access behavior. The sliding window mechanism can be adjusted according to actual needs. For example, for systems with high real-time requirements, a smaller window size can be set to reflect the status changes of data assets more quickly. In addition, a user-defined weight allocation mechanism can be introduced to allow users to adjust the weights of different health indexes according to their needs to improve the flexibility and adaptability of the system.

[0055] In some embodiments, a model optimization step is also included: S6. Update the security assessment model parameters based on an online learning mechanism, wherein the online learning mechanism uses an incremental random forest algorithm; S7. Enhance the robustness of the model through an adversarial sample generator, which is based on a generative adversarial network framework and specifically includes: S71. The generator generates a simulated abnormal feature vector based on historical attack data; S72. The discriminator calculates adversarial loss for real data and simulated data:

[0056] in, is the discriminator, For the generator, For real data, is the noise vector.

[0057] It should be noted that model optimization is an important part of the present invention for improving the performance of the safety monitoring and risk warning system. The online learning mechanism updates the parameters of the security assessment model through an incremental random forest algorithm, and can dynamically adjust the model according to new data to make it more adaptable to the security monitoring needs of railway data assets. The adversarial sample generator is based on the generative adversarial network (GAN) framework. The generator generates simulated abnormal feature vectors, and the discriminator calculates adversarial losses on real data and simulated data, thereby enhancing the robustness of the model and enabling it to better identify unknown attacks. This optimization method can improve the accuracy and adaptability of the model and ensure that the system maintains efficient operation in a complex and changeable railway operating environment.

[0058] Specifically, the incremental random forest algorithm is an online learning method that updates the model by gradually adding new data samples without retraining the entire model. This method can effectively utilize new data and improve the accuracy and timeliness of the model. In the present invention, the incremental random forest algorithm can dynamically update the parameters of the security assessment model based on the multi-dimensional feature data collected in real time. The generative adversarial network (GAN) framework consists of a generator and a discriminator. The generator generates simulated abnormal feature vectors based on historical attack data, which are used to simulate possible attack behaviors. The discriminator distinguishes between real data and generated simulated data, and optimizes the performance of the generator and discriminator through adversarial loss calculation. Adversarial loss calculation is a method of optimizing the model by minimizing the difference between the generator and the discriminator, which can make the simulated data generated by the generator more realistic, thereby improving the model's ability to recognize unknown attacks.

[0059] Preferably, in the incremental random forest algorithm, different update weights can be set according to the importance and real-time nature of the data. For example, higher weights can be given to high-risk data to update the model faster. In the generative adversarial network, more types of historical attack data can be introduced to enrich the simulated abnormal feature vectors of the generator and improve the model's ability to identify various types of attacks. For example, a variety of attack data such as phishing attacks and distributed denial of service attacks (DDoS) can be combined for training. In addition, other types of adversarial training methods, such as gradient-based adversarial training, can be introduced to further improve the robustness of the model. In the adversarial loss calculation, a regularization term can be introduced to prevent the model from overfitting and improve the generalization ability of the model.

[0060] The above-mentioned embodiments of the present invention have the following beneficial effects: The present invention can realize comprehensive monitoring of railway data assets by collecting multi-dimensional feature data of railway data assets, including equipment operation status data, network communication data, data access logs and environmental perception data, and performing heterogeneous data fusion preprocessing to generate standardized feature vectors, thereby avoiding risk omissions caused by single-dimensional monitoring. Security assessment indicators are calculated based on a dynamic weight allocation algorithm, including integrity assessment values, availability assessment values ​​and confidentiality assessment values, and weights can be dynamically adjusted according to the importance and real-time status of data in different dimensions, so as to more accurately assess the security status of data assets. Multi-level risk warning signals are generated according to the deviation between the security assessment indicators and the dynamic threshold, so that potential security threats can be discovered in time, and corresponding warning measures can be taken according to the threat level to improve the accuracy and timeliness of the warning. Access control strategies are adjusted based on the risk warning signal level, encryption algorithms are dynamically selected, and traffic shaping control is implemented for high-risk data flows, so that different levels of security risks can be flexibly responded to, the security protection capabilities of railway data assets are enhanced, and the risks of data leakage, system failure, etc. are effectively reduced, and the stable operation of the railway information system is guaranteed.

[0061] In addition, by calculating the dynamic weight coefficient through the equipment health index, and correlating the correlation coefficient, the sliding window mechanism is used to update the health index, which can make the weight distribution more reasonable and can timely reflect the health status of data assets, further improving the accuracy of security assessment. Based on the historical security assessment data, a time series prediction model is constructed to generate dynamic thresholds, and the threshold fluctuation range is calculated through the Markov chain state transfer matrix. The threshold baseline value is dynamically adjusted according to the current equipment load factor, which can make the threshold more adaptive and accurate, and avoid false positives or negative positives caused by fixed thresholds. Based on the online learning mechanism, the parameters of the security assessment model are updated, and the robustness of the model is enhanced by the adversarial sample generator, which can further improve the model's ability to identify unknown attacks, adapt to the complex and changeable operating environment of the railway system, and improve the overall performance and reliability of the railway data asset security monitoring and risk warning system.

[0062] like Figure 2 As shown, a railway data asset security monitoring and risk warning system 200 of some embodiments includes: The data collection module 201 includes a multi-source heterogeneous sensor unit, a network probe unit, and a log collection unit; The preprocessing module 202 includes a data cleaning unit, a standardization mapping unit and a feature fusion unit; The security assessment module 203 includes an integrity calculation unit, an availability analysis unit, a confidentiality assessment unit and a dynamic weight fusion unit; The early warning generation module 204 includes a threshold dynamic calculation unit, a deviation analysis unit and a multi-level signal generation unit; Dynamic control module 205, including an access policy adjustment unit, an encryption strength selection unit and a flow control unit; The output of the data acquisition module is connected to the input of the preprocessing module, the output of the preprocessing module is connected to the input of the safety assessment module, the output of the safety assessment module is connected to the input of the early warning generation module, and the output of the early warning generation module is connected to the input of the dynamic control module.

[0063] It is understandable that the modules and references in the railway data asset security monitoring and risk warning system 200 are Figure 1 The steps in the railway data asset security monitoring and risk warning method described above correspond to each other. Therefore, the operations, features and beneficial effects described above for the railway data asset security monitoring and risk warning method are also applicable to the railway data asset security monitoring and risk warning system 200 and the modules contained therein, and will not be repeated here.

[0064] Reference below Figure 3 , which shows a schematic diagram of the structure of an electronic device 300 suitable for implementing some embodiments of the present invention. The electronic devices in some embodiments of the present invention may include but are not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 3 The terminal device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0065] like Figure 3As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 to a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the electronic device 300 are also stored. The processing device 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0066] Typically, the following devices may be connected to the I / O interface 305: an input device 306 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 308 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 309. The communication device 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Figure 3 The electronic device 300 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead. Figure 3 Each block shown in the figure may represent one device, or may represent multiple devices as required.

[0067] Furthermore, the storage medium of the embodiment of the present application stores program instructions that can implement all the above methods, wherein the program instructions can be stored in the above storage medium in the form of a software product, including several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) or a processor to execute all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, or terminal devices such as a computer, a server, a mobile phone, and a tablet.

[0068] The above descriptions are only some preferred embodiments of the present invention and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present invention is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above inventive concept. For example, the above features are replaced with (but not limited to) technical features with similar functions disclosed in the embodiments of the present invention.

Claims

1. A railway data asset security monitoring and risk early warning method, characterized in that: The following steps are involved: S1. Collect multi-dimensional feature data of railway data assets, the multi-dimensional feature data including equipment operation status data, network communication data, data access log and environmental perception data; S2. Perform heterogeneous data fusion preprocessing on the multi-dimensional feature data to generate a standardized feature vector; S3. Calculate the security evaluation index of the standardized feature vector based on a dynamic weight allocation algorithm, wherein the security evaluation index includes an integrity evaluation value, an availability evaluation value, and a confidentiality evaluation value; S4. Generate multi-level risk warning signals based on the deviation between the safety assessment indicators and the dynamic threshold; S5. Trigger dynamic control of data asset protection strategies based on risk warning signals, including access permission adjustment, data encryption strength classification and traffic restriction.

2. The method according to claim 1, characterized in that The step S1 specifically includes: S11. Collecting equipment operation status data through multi-source heterogeneous sensors deployed on railway equipment nodes, wherein the multi-source heterogeneous sensors include vibration sensors, temperature sensors and current sensors; S12. Capturing network communication data based on a network probe, wherein the network communication data includes a protocol type, a packet size, and a transmission delay; S13. Extracting the spatiotemporal characteristics of data access logs through the log analysis engine, the spatiotemporal characteristics include access timestamps, access frequencies, and geographic locations of access sources; S14. Collect environmental parameters using environmental sensing equipment, where the environmental parameters include humidity, electromagnetic interference intensity, and physical protection status.

3. The method according to claim 1, characterized in that: The heterogeneous data fusion preprocessing in step S2 includes: S21. Perform wavelet threshold denoising on the equipment operation status data to generate a denoised equipment status sequence; S22. Perform a standardized mapping operation on the network communication data, and the calculation formula is: in, is the original network communication data, is the mean of historical data, is the standard deviation of historical data; S23. Using an adaptive interpolation algorithm to fill in missing values ​​in the data access log, the adaptive interpolation algorithm is based on a time series autoregressive model; S24. Generate a standardized feature vector through the dynamic feature fusion formula: in, is the device state feature vector, is the network communication feature vector, is the log eigenvector, , , is the dynamic weight coefficient.

4. The method according to claim 1, characterized in that The dynamic weight allocation algorithm in step S3 includes: S31. Calculate integrity assessment value : in, is the number of data blocks that failed verification, is the total number of data blocks; S32. Calculate availability evaluation value : in, is the average response time, is the preset response threshold, is the availability attenuation factor; S33. Calculate confidentiality assessment value , the confidentiality evaluation value is based on the joint calculation of the encryption strength classification matrix and the number of unauthorized accesses; S34. Integrity assessment based on dynamic environmental factors , Availability Evaluation Value and confidentiality assessment value Perform weighted fusion to generate comprehensive security assessment indicators : in, , , is a dynamic weight coefficient, which is calculated based on the real-time load rate of the device. and environmental risk level calculate: in, is the real-time load rate of the equipment, It is the environmental risk level.

5. The method according to claim 1, characterized in that The method for generating the dynamic threshold comprises: S41. Constructing a time series prediction model based on historical safety assessment data, wherein the model adopts an improved exponential smoothing algorithm; S42. Calculate the threshold fluctuation interval through the Markov chain state transfer matrix; S43. According to the current equipment load factor Dynamically adjust the threshold base value: in, is the baseline threshold, is the load influence factor, is the equipment load factor.

6. The method according to claim 1, characterized in that The generation of the multi-level risk warning signal in step S4 includes: S44. When the deviation exceeds the first-level threshold, a yellow warning signal is generated and in-depth log analysis is initiated; S45. When the deviation exceeds the secondary threshold, an orange warning signal is generated and the data backup mechanism is triggered; S46. When the deviation exceeds the third-level threshold, a red warning signal is generated and the high-risk data link is cut off.

7. The method according to claim 1, characterized in that The dynamic control of step S5 includes: S51. Adjust the access control strategy based on the risk warning signal level. The calculation formula is: in, is the base access permission. is the risk attenuation coefficient, is the warning signal level; S52. Evaluate value based on confidentiality Dynamically select encryption algorithm. Enable quantum encryption channel at the same time; S53. Implement traffic shaping control based on the token bucket algorithm for high-risk data flows.

8. The method according to claim 3, characterized in that The dynamic weight coefficient , , Methods for determining include: S241. Through the equipment health index calculate : in, is the network health index, is the log health index; S242. , The dynamic weight coefficient in claim 4 , Association calculation: S243. Use a sliding window mechanism to update the health index, and the window size is synchronized with the data collection cycle.

9. The method according to claim 1, characterized in that: It also includes a model optimization step: S6. Update the security assessment model parameters based on an online learning mechanism, wherein the online learning mechanism uses an incremental random forest algorithm; S7. Enhance the robustness of the model through an adversarial sample generator, which is based on a generative adversarial network framework and specifically includes: S71. The generator generates a simulated abnormal feature vector based on historical attack data; S72. The discriminator calculates adversarial loss for real data and simulated data: in, is the discriminator, For the generator, For real data, is the noise vector.

10. A railway data asset security monitoring and risk warning system, used to implement any of the methods described in claims 1-9 above, characterized in that: include: Data collection module, including multi-source heterogeneous sensor unit, network probe unit and log collection unit; Preprocessing module, including data cleaning unit, standardization mapping unit and feature fusion unit; Security assessment module, including integrity calculation unit, availability analysis unit, confidentiality assessment unit and dynamic weight fusion unit; The early warning generation module includes a threshold dynamic calculation unit, a deviation analysis unit and a multi-level signal generation unit; A dynamic control module, including an access policy adjustment unit, an encryption strength selection unit, and a flow control unit; The output of the data acquisition module is connected to the input of the preprocessing module, the output of the preprocessing module is connected to the input of the safety assessment module, the output of the safety assessment module is connected to the input of the early warning generation module, and the output of the early warning generation module is connected to the input of the dynamic control module.

Images