Railway communication network early warning method and system based on intrusion detection

Abstract

The invention provides a railway communication network early warning method and system based on intrusion detection, and the method comprises the steps: collecting the protocol session flow of a key node of a railway communication network, and carrying out the analysis to obtain session-level interaction data; extracting a time sequence feature and a state conversion feature of the protocol session, calculating a dynamic information entropy value, and generating an entropy feature vector; constructing a behavior chain sequence of the equipment, and calculating a behavior chain probability by adopting an attenuation weighted N-Gram model; dividing network operation scenes through time-sensitive clustering, and establishing a dynamic baseline library for storing entropy threshold baselines and behavior chain probability threshold baselines of the scenes; entropy deviation detection and behavior chain anomaly detection are executed in parallel; and when the entropy deviation detection and the behavior chain anomaly detection trigger alarms at the same time, generating a high-confidence alarm and linking the protection equipment. According to the method, through a dual detection mechanism of dynamic information entropy analysis and an attenuation weighting behavior chain, and in combination with time-sensitive scene clustering, high-precision low-false-alarm early warning of complex railway communication network attacks is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of railway communication network security, and particularly relates to a railway communication network early warning method and system based on intrusion detection. BACKGROUND

[0002] The railway communication network is the core infrastructure supporting train operation control, dispatching command, passenger service and equipment monitoring, and its security is directly related to the reliability, efficiency and passenger life and property safety of railway transportation. With the rapid development of 5G-R, Internet of Things and intelligent railway technology, the scale and complexity of the railway communication network have been significantly improved, but it also faces more severe network security threats.

[0003] Traditional static defense techniques usually have the following defects: manual log analysis response delay > 4 hours, far exceeding the 50ms safety time window of train-ground communication, and unable to block penetration attacks; static security strategies cannot distinguish between business scenarios (such as 300 daily dispatching instructions per minute and 2000 during the Spring Festival peak), resulting in false positives during peak periods when normal traffic is misjudged as DDoS attacks, while slow scanning attacks during maintenance windows also greatly increase the false negative rate; due to the inability to analyze interactive semantics, the detection rate of GSM-R / 5G-R protocol vulnerability attacks by encrypted traffic deep packet inspection (DPI) is < 35%. SUMMARY

[0004] Therefore, the purpose of the present application is to provide a railway communication network early warning method and system based on intrusion detection to solve the above-mentioned problems.

[0005] According to the railway communication network early warning method based on intrusion detection provided by the present application, the method comprises:

[0006] Collecting protocol session traffic of key nodes of the railway communication network, and analyzing to obtain session-level interactive data;

[0007] Based on the session-level interactive data, extracting the timing features and state transition features of the protocol session, calculating the dynamic information entropy value, and generating an entropy feature vector;

[0008] Based on the session-level interactive data, constructing a behavior chain sequence of the device, and calculating the behavior chain probability using a decay-weighted N-Gram model;

[0009] Dividing the network operation scenarios by time-sensitive clustering, and establishing a dynamic baseline library for storing the entropy threshold baseline and behavior chain probability threshold baseline of each scenario;

[0010] Parallelly performing entropy deviation detection and behavior chain anomaly detection;

[0011] When the entropy deviation detection and the behavior chain anomaly detection trigger the alarm at the same time, a high-confidence alarm is generated and a protection device is linked.

[0012] Further, the dynamic information entropy value is calculated, including:

[0013] A set of legal transition sets of the protocol state machine is defined as {transition1, transition2,..., transition n}, wherein transition i represents an i-th type of state transition event.

[0014] Based on the session-level interaction data, probabilities of occurrence of various types of transition events in historical sessions are counted to obtain a state transition probability distribution P(transition i );

[0015] For the state transition probability distribution, an entropy value is calculated, and a formula is as follows: wherein H is an entropy value of a current session, n is a total number of legal state transition types, P(transition i ) is a probability of occurrence of an i-th type of transition event.

[0016] Based on the entropy values of various protocol interaction stages, an entropy feature vector is constructed, and the entropy feature vector is [H auth , H cmd , H response ], wherein H auth is a session entropy value of an authentication stage, H cmd is a session entropy value of an instruction interaction stage, and H response is an entropy value of a response delay distribution.

[0017] Further, the behavior chain probability is calculated by using a decay-weighted N-Gram model, including:

[0018] The behavior chain sequence is composed of atomic operations, including at least two consecutive operations in GPS reporting, state querying, and control response.

[0019] The behavior chain probability is calculated, and a formula is as follows: wherein P(chain) is a behavior chain probability, representing a probability of occurrence of a current behavior chain, λ is a time decay factor, λ∈[0.9, 0.99], t now is a current time stamp, t k is an occurrence time stamp of an k-th historical behavior chain, t m is an occurrence time stamp of an m-th historical behavior chain, and count(chain k ) is a historical behavior chain chain kThe number of occurrences, K is the total number of matched historical chains, and M is the total number of all historical behavior chains in the time window.

[0020] Further, the dynamic baseline library is established, and the dynamic baseline library comprises:

[0021] Based on the full amount of historical session data in the first week, a global initial entropy threshold baseline vector and a global initial behavior chain probability threshold baseline are generated to perform cold start when the system is initialized.

[0022] A clustering feature vector is constructed, and based on the clustering feature vector, the network state is divided into three types of scenes, namely, daily scheduling, peak operation and maintenance mode, by time-sensitive clustering.

[0023] The historical session data is re-assigned according to the scene label, and the entropy threshold baseline vector and the behavior chain probability threshold baseline of each dedicated scene are calculated respectively, and the entropy threshold baseline vector of the dedicated scene is: The authentication phase entropy threshold baseline, the instruction interaction entropy threshold baseline and the response delay entropy threshold baseline of the corresponding scene are represented respectively, and the behavior chain probability threshold baseline of the dedicated scene is: The average value of the behavior chain probability of the corresponding scene is, The standard deviation of the behavior chain probability of the corresponding scene is;

[0024] The dedicated threshold baseline of each scene is updated independently.

[0025] Further, the clustering feature vector is constructed, and the clustering feature vector comprises:

[0026] The traffic cycle feature, the device online rate feature and the instruction type distribution feature in the current time window are extracted.

[0027] A time decay factor is introduced to generate a current clustering feature vector with time weight: V cluster =[δ·F t δ·D o , δ·c1, δ·c2, δ·c3], wherein δ is a time decay factor, 0 < δ ≤ 0.2, F t is the traffic cycle feature, D O is the device online rate feature, C d is the instruction type distribution feature, C d =[c1, c2, c3], c1 is the control instruction proportion, c2 is the state query proportion, and c3 is the data reporting proportion.

[0028] Further, the network state is divided into three types of scenes, namely, daily scheduling, peak operation and maintenance mode, by time-sensitive clustering, and the network state is divided into three types of scenes, namely, daily scheduling, peak operation and maintenance mode, by time-sensitive clustering.

[0029] The three types of scenario clustering centers are initialized, wherein the daily scheduling center is: the peak operation center is: and the maintenance mode center is: wherein, are historical sample statistical means;

[0030] The time-decay Euclidean distance between the current clustering feature vector and each scenario center is calculated:

[0031]

[0032] wherein, V cluster，a represents the a-th feature value of the current clustering feature vector V cluster , c j，a represents the a-th feature value of the j-th scenario center C j , j = 1, 2, 3;

[0033] The current clustering feature vector is attributed to the scenario corresponding to the minimum distance;

[0034] If the minimum distance > θ, a temporary scenario is created and manual review is started, wherein θ = 2 x historical average inter-class distance.

[0035] Further, the parallel execution of entropy deviation detection and behavior chain abnormality detection comprises:

[0036] The entropy feature vector is compared with the entropy threshold baseline of the current scenario, and the entropy value deviation degree is calculated, and if any entropy value deviation degree is greater than a preset deviation degree, a primary alarm is triggered;

[0037] The behavior chain probability is compared with the behavior chain probability threshold baseline of the current scenario, and if the behavior chain probability is less than the behavior chain probability threshold baseline, a primary alarm is triggered.

[0038] Further, the calculation of the entropy value deviation degree comprises:

[0039] The entropy value deviation degree of each stage is calculated respectively, and the formula is: wherein, x ∈ {auth, cmd, response}, D x is D auth when representing the entropy value deviation of the authentication stage, at this time H x is H auth , representing the session entropy value of the authentication stage, is the entropy threshold baseline of the authentication stage of the current scenario, D x is D cmd when representing the entropy value deviation of the instruction interaction, at this time H x is H cmd, represents the entropy value of the instruction interaction stage of the session, is , represents the entropy threshold baseline of the instruction interaction stage of the current scene, x is D response , represents the entropy value of the response delay, and H x is H response , represents the entropy value of the response delay distribution, is , represents the entropy threshold baseline of the response delay of the current scene.

[0040] Further, the high-confidence alarm is generated and the protection equipment is linked,

[0041] When the high-confidence alarm is triggered, the abnormal session is automatically isolated;

[0042] Based on the behavior chain sequence and the entropy feature vector, a traceability report is generated, and the abnormal points marked in the traceability report include the atomic operation position with the lowest behavior chain probability and the protocol interaction stage with the largest entropy value mutation.

[0043] The application also provides a railway communication network early warning system based on intrusion detection, which is used to realize the above-mentioned railway communication network early warning method based on intrusion detection, and the system comprises:

[0044] A data acquisition module is configured to acquire protocol session traffic of key nodes of a railway communication network and analyze session-level interaction data;

[0045] A session entropy analysis module is configured to extract time sequence features and state transition features of protocol sessions based on the session-level interaction data, calculate dynamic information entropy values, and generate entropy feature vectors;

[0046] A behavior chain modeling module is configured to construct a behavior chain sequence of a device based on the session-level interaction data, and calculate behavior chain probabilities by using a decay-weighted N-Gram model;

[0047] A dynamic baseline maintenance module is configured to divide network operation scenes by time-sensitive clustering, establish a dynamic baseline library, and store entropy threshold baselines and behavior chain probability threshold baselines of each scene in the dynamic baseline library;

[0048] A parallel detection module is configured to perform entropy deviation detection and behavior chain anomaly detection in parallel;

[0049] A joint early warning module is configured to generate a high-confidence alarm and link protection equipment when the entropy deviation detection and the behavior chain anomaly detection trigger alarms at the same time.

[0050] In conclusion, the railway communication network early warning method based on intrusion detection of the present application can accurately identify the behavior patterns (such as skipping the authentication step or injecting illegal instructions) of the attacker's protocol session forgery by analyzing the state jump logic of the protocol interaction, constructing dynamic information entropy, avoiding the dependence on encrypted content, significantly improving the perception ability of protocol-level vulnerability attacks, and solving the functional failure problem of traditional deep packet inspection in the railway encrypted communication scene.

[0051] The device operation is abstracted as an atomic behavior chain, and a time decay mechanism is introduced to focus on recent legal patterns, which can effectively eliminate the interference of historical data, and the time decay N-Gram model has good recognition ability for low-frequency slow attacks (such as latent penetration with legal credentials) and device operation mode drift (such as behavior change after firmware upgrade), and overcomes the blind area defect of traditional threshold detection on long-period and low-rate threats.

[0052] Based on the real-time clustering and baseline autonomous mechanism of the network operation scene, the diurnal peak, seasonal scheduling and emergency maintenance and other discretization business phases are dynamically adapted, the misjudgment risk problem of the static strategy in the traffic surge or device batch operation scene is solved, the synchronization of the security strategy and the business pulse is realized, and the zero-interference operation under the super-high availability requirement is guaranteed.

[0053] Finally, the dynamic information entropy of the protocol session and the device behavior chain probability are used as detection dimensions in parallel to form a double verification mechanism, the attack needs to break through two types of feature thresholds at the same time to trigger high-confidence alarms and link the protection devices, so that the detection false alarm rate is greatly reduced, and the business interruption caused by single detection false alarm is avoided.

[0054] Through the double detection mechanism of dynamic information entropy analysis and decay weighted behavior chain modeling, combined with the time-sensitive scene clustering technology, the accuracy and real-time performance of the railway communication network intrusion detection are significantly improved, the high-precision and low-false alarm early warning of the complex railway communication network attack is realized, and reliable security protection is provided for key scenes such as high-speed rail scheduling and train control.

[0055] Additional aspects and advantages of the present application will be in part apparent and in part pointed out hereinafter. BRIEF DESCRIPTION OF DRAWINGS

[0056] The above and / or additional aspects and advantages of the present application will become apparent and be readily understood from the description of the embodiments, combined with the accompanying drawings, in which:

[0057] Figure 1 The flowchart of the railway communication network early warning method based on intrusion detection of the present application is shown in Figure 1.

[0058] Figure 2System block diagram of the railway communication network early warning system based on intrusion detection of embodiment two of the present application. DETAILED DESCRIPTION

[0059] For the purpose of promoting the understanding of the present application, the present application will be more fully described by reference to the following drawings. There can be several embodiments of the present application and the present application can be practiced in many different forms. There are, therefore, no restrictions in the preferred embodiments which are outlined in the description which is to be considered in all aspects as illustrative rather than restrictive.

[0060] It is to be understood that where an element is referred to as being "on" another element, it can be directly on the other element or intervening elements can also be present. Where an element is referred to as being "connected", it is understood that, while the element can be directly connected to, it can be indirectly connected to the other element and one or more intervening elements can be present. As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0061] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used in the description of the application herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0062] Embodiment one

[0063] Referring to Figure 1 The present application proposes a railway communication network early warning method based on intrusion detection, which comprises steps S101 to S106:

[0064] S101, collecting protocol session traffic of key nodes of the railway communication network, and obtaining session level interaction data by analysis.

[0065] It can be understood that a hardware splitter is deployed at the business control plane nodes such as the radio block center (RBC), train control center (TCC), and centralized traffic control system (CTC), and a hardware splitter is deployed at the core network elements such as the radio block center (RBC) and train control center (TCC), and the original traffic is obtained through zero-copy mirroring technology.

[0066] Railway communication adopts GSM-R / LTE-R and other railway special protocols. Wireshark, Suricata or custom parser is used to identify the fields of GSM-R / LTE-R protocol (such as BSSMAP message, S1AP signaling). The parsing process extracts session metadata (five-tuple, IMSI / TMSI), signaling content (location update, handover command) and service parameters (train ID, QoS level), and generates structured data through tools such as Scapy or Zeek.

[0067] Based on five-tuple or service identification, complete sessions are tracked to extract timing features (message interval, response delay), state transitions (protocol state machine jumps) and behavior chains (such as "GPS reporting -> status query -> control response"). Data structure examples include session ID, protocol type, node information and message sequence (type, timestamp, source / destination, payload), such as BSSMAP_ASSIGNMENT_REQ and BSSMAP_ASSIGNMENT_COMPLETE interaction records in train handover process.

[0068] S102, based on the session-level interaction data, extracting timing features and state transition features of protocol sessions, calculating dynamic information entropy value, and generating entropy feature vector;

[0069] Further optionally, the calculation of the dynamic information entropy value comprises:

[0070] Define the set of legal jumps of the protocol state machine as {transition1, transition2,..., transition n}, where transition i represents the i-th type of state jump event;

[0071] Based on the session-level interaction data, the probabilities of occurrence of various types of jump events in historical sessions are counted to obtain the state jump probability distribution P(transition i );

[0072] The entropy value is calculated for the state jump probability distribution, and the formula is: Where H is the entropy value of the current session, n is the total number of legal state jump types, and P(transition i ) is the probability of occurrence of the i-th type of jump event.

[0073] Based on the entropy values of each protocol interaction phase, an entropy feature vector is constructed, and the entropy feature vector is [H auth , H cmd , H response ], where H auth is the session entropy value of the authentication phase, H cmdH is the entropy value of the session in the instruction interaction stage response H is the entropy value of the response delay distribution.

[0074] It can be understood that the railway protocol such as GSM-R / LTE-R is decomposed into discrete state transition events to form a set of {transition1, transition2, …, transition n} which can be mathematically described, and accurately corresponds to the train control business logic, wherein each transition i represents a kind of legal state transition event, such as idle→dedicated mode or handover request→handover completion in GSM-R protocol. The embodiment can avoid the GSM-R voice / data encryption barrier by directly analyzing the protocol interaction mode, so that the detection rate is greatly improved compared with deep packet inspection.

[0075] Based on the parsed session-level interaction data, the occurrence probability of each type of transition event in the historical session is counted to form a state transition probability distribution P(transition i ), so as to capture the statistical law of protocol interaction. For example, if the handover request to handover completion accounts for 80% in the historical session, the state transition probability distribution P(transition i ) = 0.8.

[0076] The entropy value H of the current session is calculated by the entropy formula in information theory to quantify the degree of uncertainty of the protocol interaction. The legal session has stable entropy value due to uniform transition probability distribution, and the attack behavior causes sudden change of entropy value due to abnormal transition (such as skipping authentication). The embodiment can accurately identify threats such as man-in-the-middle attack (sudden drop of entropy value) and denial of service (sudden increase of entropy value), so that the false positive rate is greatly reduced.

[0077] S103, based on the session-level interaction data, constructing a behavior chain sequence of the device, and calculating the behavior chain probability by using a decay weighted N-Gram model.

[0078] Further optionally, the calculating the behavior chain probability by using the decay weighted N-Gram model comprises:

[0079] The behavior chain sequence is composed of atomic operations, including at least two consecutive operations in GPS reporting, state query, and control response;

[0080] The behavior chain probability is calculated by the formula: Wherein, P(chain) is the behavior chain probability, representing the occurrence probability of the current behavior chain, λ is a time decay factor, λ ∈ [0.9, 0.99], t now is the current timestamp, t k is the occurrence timestamp of the kth historical behavior chain, and t mtimestamp of the mth historical behavior chain, count(chain k ) is the number of occurrences of the same historical behavior chain chain k as the current behavior chain, K is the total number of matched historical chains, and M is the total number of all historical behavior chains within the time window.

[0081] It can be understood that the atomic operation is defined as a typical operation in railway communication (such as GPS reporting, state query, and control response), and the behavior chain sequence is composed of at least two consecutive atomic operations (such as “GPS reporting→state query” or “state query→control response→GPS reporting”). The device behavior is converted into a quantifiable and serialized mode, which accurately matches the train control, scheduling instructions and other railway-specific business flows.

[0082] The behavior chain probability is calculated by the formula The weighted frequency P(chain) is used to represent the occurrence probability of the current behavior chain, and the introduced exponential decay factor λ∈[0.9, 0.99] (for example, when λ=0.95, the weight of data before March is less than 1%) makes the model focus on recent behavior patterns and automatically weaken the interference of historical data. The legitimate behavior changes caused by device firmware upgrade or seasonal strategy adjustment can be naturally absorbed by the λ decay mechanism (new data weight>old data), avoiding misjudgment. If the attacker disguises as a low-frequency penetration of normal operation (such as 1 unauthorized instruction per hour), it will be identified because the value of P(chain) is much lower than the historical baseline.

[0083] In S104, the network operation scenarios are divided by time-sensitive clustering, and a dynamic baseline library is established to store the entropy threshold baseline and the behavior chain probability threshold baseline of each scenario.

[0084] Further optionally, the establishment of the dynamic baseline library comprises:

[0085] Based on the full amount of historical session data in the first week, a global initial entropy threshold baseline vector and a global initial behavior chain probability threshold baseline are generated to perform cold start when the system is initialized;

[0086] A clustering feature vector is constructed, and based on the clustering feature vector, the network state is divided into three scenarios of daily scheduling, peak operation, and maintenance mode by time-sensitive clustering;

[0087] The historical session data is re-assigned according to the scene label, and the entropy threshold baseline vector and the behavior chain probability threshold baseline of each dedicated scenario are calculated respectively. The entropy threshold baseline vector of the dedicated scenario is: wherein, respectively, are the average of the authentication phase entropy, the average of the instruction interaction entropy, and the average of the response delay entropy of the corresponding scene, respectively, represent the authentication phase entropy threshold baseline, the instruction interaction entropy threshold baseline, and the response delay entropy threshold baseline of the corresponding scene, and the behavior chain probability threshold baseline of the exclusive scene is: is the average of the behavior chain probability of the corresponding scene, is the standard deviation of the behavior chain probability of the corresponding scene.

[0088] The exclusive threshold baseline of each scene is updated independently.

[0089] It can be understood that the full amount of historical session data collected in the first week after the system is deployed (without distinguishing between scenes) is used to calculate two types of global initial baselines, solving the cold start problem of lacking scene labels during system initialization. The global initial entropy threshold baseline vector is calculated using the global statistical mean: wherein, respectively, represent the average of the entropy values of the authentication phase, the instruction interaction phase, and the response delay distribution in the historical data. At the same time, the global initial behavior chain probability threshold baseline is calculated using the normal distribution statistical principle: μ P is the historical average of the behavior chain probability, and σ P is the historical standard deviation of the behavior chain probability. Under the assumption of normal distribution, this behavior chain probability threshold covers 99.7% of normal behaviors (μ P ± 3σ P interval), making the abnormality judgment mathematically certain.

[0090] The traffic period F t (packets / minute), the device online rate D O , and the instruction type distribution C d (control instruction c1 / state query c2 / data reporting c3 proportion) are collected in real time using a sliding window, accurately quantifying the network operation state and constructing a clustering feature vector.

[0091] When performing clustering, the network state is divided into three types of scenes: daily scheduling (control instruction dominant), peak operation (state query surge), and maintenance mode (device reporting dominant) using time-decaying Euclidean distance, which is consistent with the real scenes of railway operation.

[0092] The historical session data in the cold start phase is labeled with scene labels in reverse according to the clustering results: the clustering feature vector of the historical period is calculated, and it is attributed to the nearest scene according to the minimum Euclidean distance, such as being close to the center of peak operation and being labeled as peak. After clustering, the exclusive threshold baseline of each scene is calculated, and the behavior chain probability threshold baseline of the exclusive scene is: the behavior chain probability threshold baseline of the exclusive scene:

[0093] When the system enters a specific scenario (such as peak operation), only the exclusive threshold baseline of the corresponding scenario is updated, and the update formula of the entropy threshold baseline vector is: V Current is the entropy feature vector mean of the current detection window, is the entropy threshold baseline vector before the exclusive scenario is updated, and is used to control the update amplitude, 0.1≤α≤0.3, and the update formula of the behavior chain probability threshold baseline is: is the behavior chain probability threshold baseline before the exclusive scenario is updated, and is the statistical value of the behavior chain probability in the current window, and the baselines of other scenarios remain frozen in this process to avoid cross-scenario misadjustment caused by business mutations.

[0094] Further optionally, the constructing a clustering feature vector comprises:

[0095] extracting traffic period features, device online rate features, and instruction type distribution features in the current time window;

[0096] introducing a time decay factor to generate a current clustering feature vector with a time weight: V cluster =[δ·F t , δ·D o , δ·c1, δ·c2, δ·c3], wherein δ is a time decay factor, 0<δ≤0.2, F t is a traffic period feature, D O is a device online rate feature, C d is an instruction type distribution feature, and C d =[c1, c2, c3], c1 is a control instruction proportion, c2 is a state query proportion, and c3 is a data reporting proportion.

[0097] Understandably, three types of key features are extracted in the sliding time window: traffic period F t (packets / minute), device online rate D O , and instruction type distribution C d (control instruction c1 / state query c2 / data reporting c3 proportion), wherein the traffic period F t is the number of packets in a unit of time, which reflects network load in real time and captures business flooding in peak periods, such as a significant increase in F t in the peak operation scenario; the device online rate D O is the proportion of active devices, which quantifies network topology stability and identifies batch device offline or malicious access, such as when D O may decrease to less than 60% in maintenance mode; and the instruction type distribution C d= [c1, c2, c3], c1 is the control instruction proportion, c2 is the state query proportion, c3 is the data reporting proportion, such as c1>70% in the daily scheduling scene, c2>50% in the peak operation scene, and c3>60% in the maintenance mode scene, and the three-dimensional features jointly construct the digital fingerprint of railway business.

[0098] A time decay factor δ∈(0, 0.2] is introduced to weight the clustering feature vector, and a current clustering feature vector with time weight is generated: V cluster = [δ·F t , δ·D O , δ·c1, δ·c2, δ·c3], to strengthen the influence of recent features, such as δ=0.1, the data weight of last week is only 10% of the historical average, and the interference of obsolete data is suppressed.

[0099] Further optionally, the network state is divided into three scenes of daily scheduling, peak operation and maintenance mode by time-sensitive clustering, comprising:

[0100] A historical sample set {V1, V2, …, V N} is defined, where N is the sample number, and V i is the i-th historical clustering feature vector, including traffic cycle, device online rate and instruction type distribution features;

[0101] Based on the historical samples, the clustering centers of the three scenes are initialized, wherein the daily scheduling center is: The peak operation center is: The maintenance mode center is: Wherein, All are statistical means of historical samples;

[0102] The time decay Euclidean distance between the current clustering feature vector and each scene center is calculated:

[0103]

[0104] Where v cluster，a represents the a-th feature value of the current clustering feature vector V cluster , c j,a represents the a-th feature value of the j-th scene center C j , j=1, 2, 3, and δ is the time decay factor;

[0105] The current clustering feature vector is attributed to the scene corresponding to the minimum distance;

[0106] If the minimum distance>θ, a temporary scene is created and artificial review is started, wherein θ=2×historical average inter-class distance.

[0107] It can be understood that the historical clustering feature vectors are collected based on the historical sliding window to form a sample set {V1, V2, …, V N}, each vector contains traffic period, device online rate and instruction type distribution features, providing data basis for scene division.

[0108] According to the statistical mean μ (to avoid scene drift caused by random initialization) of historical samples, and initialize three types of scene centers:

[0109] Daily scheduling center represents low traffic period, high device online rate, and high proportion of control instructions (c1=0.7), i.e. control instructions dominate.

[0110] Peak operation center represents high traffic period, device online rate saturation, and high proportion of state query (c2=0.5), i.e. state query surge.

[0111] Maintenance mode center represents medium traffic period, low device online rate, and high proportion of data reporting (c3=0.6), i.e. data reporting is dominant.

[0112] Further explanation: each scene center is a five-dimensional vector, in the form of: wherein, is the historical mean of traffic period F t . Daily scheduling: low load such as F t <800 packets / minute; peak operation: high load such as F t >1500 packets / minute; maintenance mode: medium load such as 800<F t <1200 packets / minute.

[0113] is the historical mean of device online rate D O . Daily scheduling: high online rate such as D O >95% (all devices normally participate in scheduling); peak operation: saturated online rate such as D O ≈100% (all devices are in connected state); maintenance mode: low online rate such as D O <80% (part of the devices are offline due to maintenance).

[0114] Instruction type distribution (C d = [c1, c2, c3]) of the history. Daily schedule: control instructions c1 dominate State queries c2 and data reporting c3 have a low proportion Peak operation: state queries c2 have a higher proportion Control instructions c1 have a lower proportion Maintenance mode: data reporting c3 has a significantly higher proportion Control instructions c1 have the lowest proportion

[0115] Calculate the current clustering feature vector V cluster and the distance from the scene center C j : wherein, The weighting (δ ∈ (0, 0.2]) strengthens the influence of recent features (for example, when δ = 0.1, the data from last week is attenuated by 90%) and suppresses historical noise interference. For example, when a lightning strike causes a device to go offline, The weighted feature weight is automatically reduced D O to avoid false cutting into maintenance mode.

[0116] Assign the current clustering feature vector to the scene with the smallest distance (daily schedule, peak operation, or maintenance mode). If the smallest distance > θ (θ = 2 × the average inter-class distance of the history), create a temporary scene and manually review it to deal with extreme events, such as regional failures.

[0117] S105, the entropy deviation detection and behavior chain anomaly detection are performed in parallel.

[0118] Further optionally, the parallel entropy deviation detection and behavior chain anomaly detection includes:

[0119] Compare the entropy feature vector with the entropy threshold baseline of the current scene, calculate the entropy value deviation degree, and if any entropy value deviation degree is greater than a preset deviation degree, trigger a primary alarm;

[0120] Compare the behavior chain probability with the behavior chain probability threshold baseline of the current scene, and if the behavior chain probability is less than the behavior chain probability threshold baseline, trigger a primary alarm.

[0121] Understandably, the current entropy feature vector [H auth , H cmd , H response ] generated in step S102 is compared with the entropy threshold baseline vector corresponding to the current scene (daily schedule / peak operation / maintenance mode), the entropy value deviation degree of each stage is calculated, and if any entropy value (H auth , Hcmd or H response If the deviation exceeds a preset deviation (e.g., 30%), a primary alarm is triggered. Typical scenario: Identity spoofing attacks (such as man-in-the-middle attacks that skip authentication) cause the entropy value H during the authentication phase to increase. auth A sudden drop; response latency disorder (such as a DoS attack) causes the entropy value H of the response latency to decrease. response A surge.

[0122] The current behavior chain probability P(chain) calculated in step S103 is compared with the behavior chain probability threshold baseline corresponding to the current scenario. If the current behavior chain probability is less than the behavior chain probability threshold baseline corresponding to the current scenario, a primary alarm is triggered. Typical scenario: Low-frequency penetration attacks (such as one unauthorized command per hour) cause the behavior chain probability to be significantly lower than the historical normal distribution interval (μ). P ±3σ P ).

[0123] Primary alarms are generated when triggered by a single engine, serving as a risk warning but without triggering any blocking. When triggered by two engines simultaneously, high-confidence alarms are generated, and the session is automatically isolated and traced back to its source.

[0124] Further optionally, the calculation of the entropy deviation includes:

[0125] Calculate the entropy deviation for each stage using the following formula: Where x∈{auth,cmd,response}, D x D auth H represents the entropy deviation during the authentication phase. x For H auth This represents the session entropy value during the authentication phase. for D represents the baseline entropy threshold for the authentication phase in the current scenario. x D cmd H represents the entropy degree of instruction interaction. x For H cmd This represents the session entropy value during the command interaction phase. for D represents the baseline entropy threshold for the instruction interaction phase of the current scenario. x D response The entropy value representing the response delay is H. x For H response , representing the entropy value of the response delay distribution. for The entropy threshold baseline represents the response latency of the current scenario.

[0126] S106, when the entropy deviation detection and the behavior chain anomaly detection trigger alarms simultaneously, a high confidence alarm is generated and the protection device is activated.

[0127] Further optionally, the generation of high-confidence alarms and the activation of protective devices include:

[0128] When a high-confidence alarm is triggered, the abnormal session is automatically isolated;

[0129] Based on the behavior chain sequence and entropy feature vector, a source tracing report is generated. The anomalies marked in the source tracing report include the atomic operation positions with the lowest probability in the behavior chain and the protocol interaction stages with the largest entropy value mutations.

[0130] Understandably, a high-confidence alarm can only be generated when both entropy deviation detection and behavioral chain anomaly detection in step S105 trigger a primary alarm (dual-engine joint decision). Ensuring the high confidence of the alarm can significantly reduce the false alarm rate. When a high-confidence alarm is triggered, the attack source session connection is immediately cut off, and the SDN controller or firewall is activated to inject blocking flow table entries.

[0131] Generating a source tracing report based on behavioral chain sequences and entropy feature vectors can accurately pinpoint the root cause of anomalies. A dynamic programming algorithm can be used to backtrack the behavioral chain sequence and mark the atomic operation positions with the lowest probability (e.g., in the control response → GPS spoofing, the P(chain) of the "GPS spoofing" operation is 0.45, significantly lower than the scenario baseline of 0.65). Based on the entropy feature vector [H... auth H cmd H response ], calculate the rate of change of entropy at each stage (e.g., H). auth The value suddenly increased from 3.2 to 5.1, a change rate of 59.4%, marking the protocol interaction phase with the largest mutation.

[0132] The report includes the abnormal session ID, timestamp, atomic operation sequence, entropy change curve, and attack type speculation (such as GPS spoofing attack or protocol state machine overflow attack).

[0133] In summary, the railway communication network early warning method based on intrusion detection of the present invention, by analyzing the state transition logic of protocol interaction and constructing dynamic information entropy, avoids dependence on encrypted content and can accurately identify the behavior patterns of attackers forging protocol sessions (such as skipping authentication steps or injecting illegal instructions), significantly improving the ability to perceive protocol-level vulnerability attacks and solving the functional failure problem of traditional deep packet inspection in railway encrypted communication scenarios.

[0134] The device operation is abstracted as an atomic behavior chain, a time decay mechanism is introduced to focus on recent legal patterns, historical data interference can be effectively stripped, the time decay N-Gram model has good recognition ability for low-frequency slow attacks (such as latent penetration under legal credentials) and device operation mode drift (such as behavior change after firmware upgrade), and overcomes the blind area defect of traditional threshold detection on long-period and low-rate threats.

[0135] Based on the real-time clustering and baseline autonomous mechanism of network operation scene, the discretization business phase of day and night peak, seasonal scheduling and emergency maintenance is dynamically adapted, the misjudgment risk problem of static strategy in the scene of traffic surge or device batch operation is solved, the synchronization of security policy and business pulsation is realized, and the zero-interference operation under the requirement of ultra-high availability is guaranteed.

[0136] Finally, the dynamic information entropy of the protocol session and the device behavior chain probability are used as detection dimensions in parallel to form a double verification mechanism, the attack needs to break through two types of feature thresholds at the same time to trigger high-confidence alarm and link the protection device, so that the detection false alarm rate is greatly reduced, and the business interruption caused by single detection false alarm is avoided.

[0137] Through the double detection mechanism of dynamic information entropy analysis and decay weighted behavior chain modeling, combined with time-sensitive scene clustering technology, the accuracy and real-time performance of railway communication network intrusion detection are significantly improved, high-precision and low-false alarm early warning of complex railway communication network attacks is realized, and reliable security protection is provided for key scenes such as high-speed rail scheduling and train control.

[0138] Embodiment two

[0139] Please refer to Figure 2 The railway communication network early warning system based on intrusion detection provided by the application comprises:

[0140] The data acquisition module is used for acquiring protocol session traffic of key nodes of the railway communication network, and analyzing to obtain session-level interaction data;

[0141] The session entropy analysis module is used for extracting time sequence features and state transition features of the protocol session based on the session-level interaction data, calculating dynamic information entropy values, and generating entropy feature vectors;

[0142] The behavior chain modeling module is used for constructing a behavior chain sequence of the device based on the session-level interaction data, and calculating a behavior chain probability by using a decay weighted N-Gram model;

[0143] The dynamic baseline maintenance module is used for dividing network operation scenes by time-sensitive clustering, establishing a dynamic baseline library, and storing entropy threshold baselines and behavior chain probability threshold baselines of each scene;

[0144] Parallel detection module: used for performing entropy deviation detection and behavior chain anomaly detection in parallel;

[0145] Joint early warning module: used for generating a high-confidence alarm and linking to a protection device when the entropy deviation detection and the behavior chain anomaly detection trigger alarms at the same time.

[0146] Further optionally, the session entropy analysis module is further used for:

[0147] Defining a set of protocol state machine legal transitions as {transition1, transition2, …, transition n}, wherein transition i represents an i-th type of state transition event;

[0148] Based on the session-level interaction data, the probabilities of occurrence of various types of transition events in historical sessions are counted to obtain a state transition probability distribution P(transition i );

[0149] For the state transition probability distribution, an entropy value is calculated, and the formula is: wherein H is an entropy value of a current session, n is a total number of legal state transition types, and P(transition i ) is a probability of occurrence of an i-th type of transition event;

[0150] Based on the entropy values of various protocol interaction stages, an entropy feature vector is constructed, and the entropy feature vector is [H auth , H cmd , H response ], wherein H auth is a session entropy value of an authentication stage, H cmd is a session entropy value of an instruction interaction stage, and H response is an entropy value of a response delay distribution.

[0151] Further optionally, the behavior chain modeling module is further used for:

[0152] The behavior chain sequence is composed of atomic operations, including at least two consecutive operations in GPS reporting, state query, and control response;

[0153] A behavior chain probability is calculated, and the formula is: wherein P(chain) is a behavior chain probability, representing a probability of occurrence of a current behavior chain, λ is a time decay factor, λ ∈ [0.9, 0.99], t now is a current time stamp, t k is an occurrence time stamp of an k-th historical behavior chain, and t m is an occurrence time stamp of an m-th historical behavior chain, and count(chaink ) is the same as the current behavior chain k occurrence times, K is the total number of matched historical chains, and M is the total number of all historical behavior chains in the time window.

[0154] Further optionally, the dynamic baseline maintenance module is further configured to:

[0155] based on the full amount of historical session data in the first week, generate a global initial entropy threshold baseline vector and a global initial behavior chain probability threshold baseline to perform cold start when the system is initialized;

[0156] construct a clustering feature vector, and based on the clustering feature vector, divide the network state into three types of scenes, namely, daily scheduling, peak operation and maintenance mode, by time-sensitive clustering;

[0157] redistribute the historical session data according to the scene labels, and calculate the entropy threshold baseline vector and the behavior chain probability threshold baseline of each dedicated scene respectively, wherein the entropy threshold baseline vector of the dedicated scene is: respectively represent the authentication stage entropy threshold baseline, the instruction interaction entropy threshold baseline and the response delay entropy threshold baseline of the corresponding scene, and the behavior chain probability threshold baseline of the dedicated scene is: is the average value of the behavior chain probability of the corresponding scene, is the standard deviation of the behavior chain probability of the corresponding scene;

[0158] update the dedicated threshold baseline of each scene independently.

[0159] Further optionally, the dynamic baseline maintenance module is further configured to:

[0160] extract the traffic cycle feature, the device online rate feature and the instruction type distribution feature in the current time window;

[0161] introduce a time decay factor to generate a current clustering feature vector with time weight: V cluster = [δ·F t , δ·D O , δ·c1, δ·c2, δ·c3], wherein δ is a time decay factor, 0 < δ ≤ 0.2, F t is the traffic cycle feature, D O is the device online rate feature, C d is the instruction type distribution feature, and C d = [c1, c2, c3], c1 is the control instruction proportion, c2 is the state query proportion, and c3 is the data reporting proportion.

[0162] Further optionally, the dynamic baseline maintenance module is further configured to:

[0163] Initialize cluster centers for three types of scenarios, among which the daily scheduling center is: The peak operation center is: The maintenance mode center is: in, All are historical sample statistical mean;

[0164] Calculate the time-decayed Euclidean distance between the current cluster feature vector and the center of each scene:

[0165]

[0166] Among them, V cluster，a V represents the current cluster feature vector. cluster The a-th eigenvalue, c j，a C represents the center of the j-th scene. j The a-th eigenvalue, j = 1, 2, 3;

[0167] Assign the current cluster feature vector to the scenario corresponding to the minimum distance;

[0168] If the minimum distance is greater than θ, a temporary scene is created and manual review is initiated, where θ = 2 × historical average class spacing.

[0169] Further optionally, the parallel detection module is also used for:

[0170] Compare the entropy feature vector with the entropy threshold baseline of the current scene, calculate the entropy value deviation, and trigger a primary alarm if any entropy value deviation is greater than a preset deviation.

[0171] The probability of the behavior chain is compared with the baseline threshold of the behavior chain probability in the current scene. If the probability of the behavior chain is less than the baseline threshold, a primary alarm is triggered.

[0172] Further optionally, the parallel detection module is also used for:

[0173] Calculate the entropy deviation for each stage using the following formula: Where x∈{auth,cmd,response}, D x D auth H represents the entropy deviation during the authentication phase. x For H auth This represents the session entropy value during the authentication phase. for D represents the baseline entropy threshold for the authentication phase in the current scenario. x D cmd The time represents the entropy value of the command interaction, at which point H x For H cmdH represents the entropy value of the instruction interaction phase, is H represents the entropy threshold baseline of the instruction interaction phase of the current scenario, x is D response H represents the entropy value of the response delay distribution, x is H response H represents the entropy value of the response delay distribution, is H represents the entropy threshold baseline of the response delay of the current scenario.

[0174] Further optionally, the joint early warning module is further used for:

[0175] When triggering the high-confidence alarm, the abnormal session is automatically isolated;

[0176] Based on the behavior chain sequence and the entropy feature vector, a traceability report is generated, and the abnormal points marked in the traceability report include the atomic operation position with the lowest behavior chain probability and the protocol interaction phase with the largest entropy value mutation.

[0177] The above-described embodiments only express several embodiments of the present application, and the description is more specific and detailed, but it cannot be understood as a limitation on the scope of the patent of the present application. It should be noted that for ordinary skilled persons in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are all within the scope of protection of the present application. Therefore, the protection scope of the patent of the present application should be subject to the appended claims.

Claims

1. A method for early warning of intrusion detection in railway communication networks, characterized in that, The method includes: Collect protocol session traffic from key nodes of the railway communication network and parse it to obtain session-level interaction data; Based on the session-level interaction data, the temporal features and state transition features of the protocol session are extracted, the dynamic information entropy value is calculated, and an entropy feature vector is generated. Based on the session-level interaction data, a behavior chain sequence of the device is constructed, and the probability of the behavior chain is calculated using a decay-weighted N-Gram model. The network operation scenarios are divided by time-sensitive clustering, and a dynamic baseline library is established to store the entropy threshold baseline and behavior chain probability threshold baseline for each scenario. Parallel execution entropy deviation detection and behavior chain anomaly detection; When the entropy deviation detection and the behavior chain anomaly detection trigger alarms simultaneously, a high-confidence alarm is generated and the protection device is activated.

2. The railway communication network early warning method based on intrusion detection according to claim 1, characterized in that, The calculation of the dynamic information entropy value includes: Define the set of valid transitions in the protocol state machine as {transition1, transition2, ..., transition...} n }, where transition i This represents the i-th type of state transition event; Based on the aforementioned session-level interaction data, the probability of various transition events occurring in historical sessions is statistically analyzed to obtain the state transition probability distribution P(transition). i ); For the state transition probability distribution, the entropy value is calculated using the following formula: Where H is the entropy value of the current session, n is the total number of valid state transition types, and P(transition) i Let be the probability of the i-th type of jump event occurring; Based on the entropy values ​​of each protocol interaction stage, an entropy feature vector is constructed, wherein the entropy feature vector is [H]. auth H cmd H response ], where H auth H is the session entropy value during the authentication phase. cmd H represents the session entropy value during the instruction interaction phase. response The entropy value is the response delay distribution.

3. The railway communication network early warning method based on intrusion detection according to claim 1, characterized in that, The calculation of the behavioral chain probability using the decay-weighted N-Gram model includes: The behavior chain sequence consists of atomic operations, including at least two consecutive operations from GPS reporting, status query, and control response; The formula for calculating the probability of a behavioral chain is: Where P(chain) is the probability of the action chain, representing the probability of the current action chain occurring, λ is the time decay factor, λ∈[0.9, 0.99], t now t is the current timestamp. k Let t be the timestamp of the occurrence of the k-th historical behavior chain. m Let `count(chain)` be the timestamp of the occurrence of the `m`th historical behavior chain. k (a chain of historical behaviors that is the same as the current behavior chain) k The occurrence count, K is the total number of historical chains matched, and M is the total number of all historical behavior chains within the time window.

4. The railway communication network early warning method based on intrusion detection according to claim 1, characterized in that, The establishment of the dynamic baseline library includes: Based on the full historical session data of the first week, a global initial entropy threshold baseline vector and a global initial behavior chain probability threshold baseline are generated to perform a cold start during system initialization. Construct clustering feature vectors, and based on these clustering feature vectors, classify network states into three scenarios—daily scheduling, peak operation, and maintenance mode—using time-sensitive clustering. Historical session data is redistributed according to scene labels, and the entropy threshold baseline vector and behavior chain probability threshold baseline are calculated for each specific scene. The entropy threshold baseline vector for each specific scene is: These represent the baseline entropy thresholds for the authentication phase, command interaction, and response latency, respectively. The baseline behavioral chain probability threshold for the specific scenario is: This represents the average probability of the behavioral chain in the corresponding scenario. The standard deviation of the probability of the behavioral chain in the corresponding scenario; Each scenario has its own independent threshold baseline updated.

5. The railway communication network early warning method based on intrusion detection according to claim 4, characterized in that, The construction of clustering feature vectors includes: Extract traffic cycle characteristics, device online rate characteristics, and command type distribution characteristics within the current time window; Introducing a time decay factor generates a time-weighted current cluster feature vector: V cluster =[δ·F t ,δ·D o [δ·c1, δ·c2, δ·c3], where δ is the time decay factor, 0 < δ ≤ 0.2, F t D represents the periodic characteristics of the flow. O For equipment online rate characteristics, C d For instruction type distribution characteristics, C d = [c1, c2, c3], where c1 is the proportion of control commands, c2 is the proportion of status queries, and c3 is the proportion of data reporting.

6. The railway communication network early warning method based on intrusion detection according to claim 5, characterized in that, The network state is divided into three scenarios—daily scheduling, peak operation, and maintenance mode—using time-sensitive clustering, including: Initialize cluster centers for three types of scenarios, among which the daily scheduling center is: The peak operation center is: The maintenance mode center is: in, All are historical sample statistical mean; Calculate the time-decayed Euclidean distance between the current cluster feature vector and the center of each scene: Among them, v cluster，a V represents the current cluster feature vector. cluster The a-th eigenvalue, c j，a C represents the center of the j-th scene. j The a-th eigenvalue, j = 1, 2, 3; Assign the current cluster feature vector to the scenario corresponding to the minimum distance; If the minimum distance is greater than θ, a temporary scene is created and manual review is initiated, where θ = 2 × historical average class spacing.

7. The railway communication network early warning method based on intrusion detection according to claim 2 or 4, characterized in that, The parallel execution entropy deviation detection and behavior chain anomaly detection include: Compare the entropy feature vector with the entropy threshold baseline of the current scene, calculate the entropy value deviation, and trigger a primary alarm if any entropy value deviation is greater than a preset deviation. The probability of the behavior chain is compared with the baseline threshold of the behavior chain probability in the current scene. If the probability of the behavior chain is less than the baseline threshold, a primary alarm is triggered.

8. The railway communication network early warning method based on intrusion detection according to claim 7, characterized in that, The calculation of entropy deviation includes: Calculate the entropy deviation for each stage using the following formula: Where x∈{auth,cmd,response}, D x D auth H represents the entropy deviation during the authentication phase. x For H auth This represents the session entropy value during the authentication phase. for D represents the baseline entropy threshold for the authentication phase in the current scenario. x D cmd The time represents the entropy value of the command interaction, at which point H x For H cmd This represents the session entropy value during the command interaction phase. for D represents the baseline entropy threshold for the instruction interaction phase of the current scenario. x D response The entropy value representing the response delay is H. x For H response , representing the entropy value of the response delay distribution. for The entropy threshold baseline represents the response latency of the current scenario.

9. The railway communication network early warning method based on intrusion detection according to claim 1, characterized in that, The generation of high-confidence alarms and the activation of protective devices include: When a high-confidence alarm is triggered, the abnormal session is automatically isolated; Based on the behavior chain sequence and entropy feature vector, a source tracing report is generated. The anomalies marked in the source tracing report include the atomic operation positions with the lowest probability in the behavior chain and the protocol interaction stages with the largest entropy value mutations.

10. A railway communication network early warning system based on intrusion detection, used to implement the railway communication network early warning method based on intrusion detection as described in any one of claims 1 to 9, characterized in that, The system includes: Data acquisition module: used to collect protocol session traffic of key nodes in the railway communication network and parse it to obtain session-level interaction data; Session entropy analysis module: used to extract the temporal features and state transition features of the protocol session based on the session-level interaction data, calculate the dynamic information entropy value, and generate an entropy feature vector; Behavior chain modeling module: used to construct the device's behavior chain sequence based on the session-level interaction data, and calculate the behavior chain probability using a decay-weighted N-Gram model; Dynamic baseline maintenance module: used to divide network operation scenarios through time-sensitive clustering, establish a dynamic baseline library, and store the entropy threshold baseline and behavior chain probability threshold baseline for each scenario; Parallel detection module: used for parallel execution of entropy deviation detection and behavioral chain anomaly detection; Joint early warning module: When the entropy deviation detection and behavior chain anomaly detection trigger alarms simultaneously, a high confidence alarm is generated and the protection equipment is activated.

Images