Safety assessment method and system for rail train, terminal equipment and medium
By clustering and feature extraction of syslog data from rail trains, combined with a security assessment model, the information security problem of onboard equipment in rail trains was solved, and real-time and accurate anomaly identification and equipment security assessment were achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CRRC ZHUZHOU ELECTRIC LOCOMOTIVE RESEARCH INSTITUTE CO LTD
- Filing Date
- 2024-11-22
- Publication Date
- 2026-05-22
AI Technical Summary
The information security issues of onboard equipment on rail trains have not been effectively resolved, making it difficult to identify abnormal events and behaviors, and consuming a lot of computing resources, which affects the real-time nature of information security assessments.
By clustering the syslog data of railcars, key log data features are extracted, and a pre-trained safety assessment model is used for evaluation to identify abnormal equipment.
It effectively reduces the computational resource consumption of redundant log data, improves the real-time performance and accuracy of information security assessment, promptly detects abnormal on-board equipment, and enhances the security of the rail vehicle network control system.
Smart Images
Figure CN122073536A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of rail train driving technology, specifically relating to a safety assessment method, system, terminal equipment, and medium for rail trains. Background Technology
[0002] Currently, rail transit is rapidly developing towards informatization and intelligence, with rail trains beginning to be equipped with more and more onboard intelligent equipment and dedicated communication networks.
[0003] To address the issues of insufficient installation space for onboard intelligent equipment and underutilization of communication network resources, train communication network technology is gradually transitioning towards onboard Ethernet and converged control networks. Converged control systems break away from the previous closed network structure, resulting in an increasing number of interconnection interfaces with external systems. While offering flexibility and convenience, this also presents significant challenges to network system information security. Currently, rail transit train network control systems do not consider the information security of various onboard devices during train operation, making it difficult to accurately identify abnormal events and behaviors of these devices. Furthermore, the excessive number of log files from onboard devices consumes significant computing resources, hindering the real-time performance of information security assessments.
[0004] Based on the above problems, there is an urgent need for a method to conduct real-time safety assessment of the train network control system by collecting, analyzing, and detecting abnormal event behaviors of on-board equipment in the train network control system through network communication data streams, so as to ensure the safe operation of rail trains. Summary of the Invention
[0005] The technical problem to be solved by the present invention is to provide a safety assessment method, system, terminal equipment and medium for rail trains, which can accurately identify abnormal event behaviors of on-board equipment, reduce computing resource consumption and solve the information security problem of various on-board equipment during rail train operation.
[0006] In a first aspect, the present invention provides a safety assessment method for rail trains, the method comprising the following steps:
[0007] The raw syslog log data of multiple on-board devices in the rail train is obtained. The raw syslog log data is clustered according to the event keywords corresponding to each on-board device to obtain multiple key syslog log data. The multiple key syslog log data correspond one-to-one with the multiple on-board devices. Each key syslog log data includes the network transmission protocol, event behavior and the occurrence time of the event behavior of its corresponding on-board device.
[0008] For each key syslog log data, data features are extracted and input into a pre-trained safety assessment model to obtain the safety assessment results of the rail train. The safety assessment model is trained using preset standard network transmission protocols, preset standard event behaviors, and preset standard occurrence times of multiple on-board devices under normal conditions as training samples. The data features include link features of network transmission protocols and time sequence features of event behaviors.
[0009] Optionally, the event keyword is a field in the syslog log data that describes the operating status of the vehicle-mounted device.
[0010] Optionally, the network transmission protocol is TRDP.
[0011] Optionally, link characteristics include source IP, source MAC, destination IP, destination MAC, and destination port.
[0012] Optionally, the timing characteristics include the temporal order of the occurrence times of events corresponding to multiple in-vehicle devices.
[0013] Optionally, the safety assessment results can be used to indicate onboard devices where abnormal events have occurred.
[0014] Optionally, the multiple onboard devices include at least train doors, train gearboxes, and driver's console;
[0015] The events related to train doors include opening and closing the doors;
[0016] The event behaviors of a train's transmission include deceleration, acceleration, and maintaining a constant speed;
[0017] The event behavior of the control panel includes normal access and abnormal access.
[0018] Secondly, the present invention provides a safety assessment system for rail trains, comprising:
[0019] The data acquisition module is used to acquire raw syslog log data from multiple onboard devices in the rail train. It clusters the raw syslog log data according to the event keywords corresponding to each onboard device to obtain multiple key syslog log data. Each key syslog log data corresponds one-to-one with multiple onboard devices. Each key syslog log data includes the network transmission protocol, event behavior, and the occurrence time of the event behavior of its corresponding onboard device.
[0020] The security assessment module is used to extract data features from each key syslog log data and input these features into a pre-trained security assessment model to obtain the security assessment results of the rail train. The security assessment model is trained using preset standard network transmission protocols, preset standard event behaviors, and preset standard occurrence times of multiple on-board devices under normal conditions as training samples. The data features include the link characteristics of the network transmission protocol and the temporal characteristics of the event behavior.
[0021] Thirdly, the present invention provides a terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-described method.
[0022] Fourthly, the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.
[0023] The beneficial effects of this invention are:
[0024] The safety assessment method for rail vehicles provided by this invention clusters the original syslog log data based on the event keywords corresponding to each onboard device, obtaining multiple key syslog log data. Data features of these key syslog log data are extracted, and then input into a safety assessment model to obtain the safety assessment result. Clustering the original syslog log data effectively reduces the consumption of computing resources by redundant log data, lowers network transmission load, and improves real-time performance. Simultaneously, the safety assessment model accurately identifies the data characteristics of onboard devices under abnormal conditions, promptly detects abnormal onboard devices, and improves the safety of the rail vehicle network control system. Attached Figure Description
[0025] Figure 1 This is a flowchart of a safety assessment method for rail trains according to one embodiment of this application;
[0026] Figure 2 This is a structural diagram of a safety assessment system for rail trains according to one embodiment of this application;
[0027] Figure 3 This is a schematic diagram of the structure of a terminal device in one embodiment of this application. Detailed Implementation
[0028] To address the technical problems of traditional methods failing to consider the information security of various onboard devices during rail train operation and consuming high computational resources, this invention discloses a safety assessment method, system, terminal equipment, and medium for rail trains. This method clusters the original syslog log data based on event keywords corresponding to each onboard device, obtaining multiple key syslog log data. Data features of these key syslog log data are extracted, and then input into a safety assessment model to obtain the safety assessment results. Clustering the original syslog log data effectively reduces the consumption of computational resources by redundant log data, lowers network transmission load, and improves real-time performance. Simultaneously, the safety assessment model accurately identifies the data characteristics of onboard devices under abnormal conditions, promptly detects abnormal onboard devices, and improves the security of the rail vehicle network control system.
[0029] The safety assessment method for railcars provided by this invention will be described below.
[0030] like Figure 1 As shown, the safety assessment methods for this railcar include:
[0031] Step 11: Obtain the raw syslog log data of multiple onboard devices in the rail train, and cluster the raw syslog log data according to the event keywords corresponding to each onboard device to obtain multiple key syslog log data.
[0032] Among them, multiple key syslog log data correspond one-to-one with multiple vehicle devices. Each key syslog log data includes the network transmission protocol, event behavior, and the occurrence time of the event behavior of its corresponding vehicle device.
[0033] In embodiments of the present invention, the aforementioned plurality of on-board devices include at least train doors, train gearboxes, and driver's consoles; the event behaviors of the train doors include door opening and door closing; the event behaviors of the train gearboxes include deceleration, acceleration, and maintaining constant speed; and the event behaviors of the driver's consoles include normal access and abnormal access.
[0034] For example, in one embodiment of the present invention, real-time communication traffic can be mirrored and collected from the switch of the TCMS system, and raw syslog log data from multiple vehicle-mounted devices can be obtained using network packet capture tools (such as Wireshark). It should be understood that syslog log data is a standardized protocol used to record system events, application states, error messages, and security logs. It is typically used to collect, transmit, and store system logs, covering operational information from various devices such as network devices, servers, operating systems, and applications. The syslog log format includes information such as timestamps, log levels, source addresses, and event descriptions.
[0035] The following describes the process of clustering the raw syslog log data based on the event keywords corresponding to each vehicle device to obtain multiple key syslog log data.
[0036] For example, the raw syslog data is first preprocessed (including redundant information removal and formatting) to remove irrelevant fields or noisy data, ensuring that all log items have a uniform format so that fields such as date, time, and event keywords can be effectively extracted. In another embodiment of the invention, for log content containing natural language descriptions, word segmentation is also required to convert the log messages into features that can be used for clustering.
[0037] Then, event keywords (fields used to describe the operating status of the vehicle equipment) are extracted from the preprocessed syslog log data, including the vehicle equipment identifier and the vehicle equipment status.
[0038] Subsequently, after vectorizing the extracted event keywords, the K-Means clustering algorithm is applied to divide the preprocessed syslog log data into different clusters based on the event keywords, resulting in multiple key syslog log data, each of which represents a similar type of log.
[0039] It's worth noting that this approach not only helps in understanding log distribution but also effectively improves the efficiency of log monitoring and fault diagnosis. In practical applications, clustering results can be used to optimize log storage, improve system response speed, and enable more efficient fault diagnosis.
[0040] Step 12: Extract the data features of each key syslog log data, and input the data features into the pre-trained safety assessment model to obtain the safety assessment results of the rail train.
[0041] In an embodiment of the present invention, the security assessment model is trained using preset standard network transmission protocols, preset standard event behaviors, and preset standard occurrence times of multiple vehicle-mounted devices under normal conditions as training samples. The data features include the link features of the network transmission protocols and the temporal features of the event behaviors.
[0042] It should be noted that, in the embodiments of the present invention, the network transmission protocol is the TRDP protocol. The aforementioned link characteristics include source IP, source MAC, destination IP, destination MAC, and destination port. The aforementioned timing characteristics include the chronological order of the occurrence of events corresponding to multiple in-vehicle devices. The aforementioned security assessment results are used to indicate in-vehicle devices exhibiting abnormal events.
[0043] The following describes the process of extracting key syslog log data features.
[0044] For example, based on link characteristics, the source IP, source MAC, destination IP, destination MAC, and destination port can be extracted using regular expressions or string matching.
[0045] Based on the timing characteristics, obtain the timestamps of key syslog log data and sort them in chronological order.
[0046] In some embodiments of the present invention, a decision tree model may be used as a security assessment model.
[0047] The above safety assessment results are used to indicate onboard equipment where abnormal events have occurred.
[0048] In another embodiment of the present invention, in order to further improve the real-time performance of security assessment, a security assessment whitelist can be constructed through pre-configured security assessment rules. When the network transmission protocol, event behavior, and occurrence time of the event behavior of the vehicle device can be found in the security assessment whitelist, it is determined that there is no abnormality; otherwise, it is determined that there is an abnormality.
[0049] For example, the safety assessment whitelist is {door open, driver console access normal}. When the event behavior of the on-board equipment is door open and driver console access abnormal, the safety assessment result is determined to be that the door or driver console is abnormal.
[0050] In embodiments of the present invention, the safety assessment results can be fed back to the driver terminal or the train dispatch center so as to promptly handle and maintain abnormal events and behaviors of onboard equipment.
[0051] As described above, the safety assessment method for rail vehicles provided by this invention clusters the original syslog log data based on the event keywords corresponding to each onboard device, obtaining multiple key syslog log data. It then extracts the data features of these key syslog log data and inputs these features into a safety assessment model to obtain the safety assessment results. Specifically, clustering the original syslog log data effectively reduces the consumption of computing resources by redundant log data, lowers network transmission load, and improves real-time performance. Simultaneously, the safety assessment model accurately identifies the data characteristics of onboard devices under abnormal conditions, promptly detects abnormal onboard devices, and improves the safety of the rail vehicle network control system.
[0052] The safety assessment system for rail trains provided by this invention will be described below.
[0053] like Figure 2 As shown, the safety assessment system for rail trains includes:
[0054] The data acquisition module 201 is used to acquire the raw syslog log data of multiple on-board devices in the rail train. The raw syslog log data is clustered according to the event keywords corresponding to each on-board device to obtain multiple key syslog log data. The multiple key syslog log data correspond one-to-one with the multiple on-board devices. Each key syslog log data includes the network transmission protocol, event behavior and the occurrence time of the event behavior of its corresponding on-board device.
[0055] The security assessment module 202 is used to extract data features from each key syslog log data and input the data features into a pre-trained security assessment model to obtain the security assessment results of the rail train. The security assessment model is trained using preset standard network transmission protocols, preset standard event behaviors, and preset standard occurrence times of multiple on-board devices under normal conditions as training samples. The data features include the link characteristics of the network transmission protocol and the temporal characteristics of the event behavior.
[0056] It should be noted that the information interaction and execution process between the above-mentioned devices / units are different from the method of this application.
[0057] The embodiments are based on the same concept, and their specific functions and technical effects can be found in the method embodiment section, which will not be repeated here. Those skilled in the art will understand that, for ease of description and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, which will not be repeated here.
[0058] like Figure 3 As shown, embodiments of the present invention provide a terminal device, such as... Figure 3 As shown, the terminal device D10 of this embodiment includes: at least one processor D100 ( Figure 3The diagram shows only one processor, a memory D101, and a computer program D102 stored in the memory D101 and executable on the at least one processor D100, wherein the processor D100 executes the computer program D102 to implement the steps in any of the above method embodiments.
[0059] Specifically, when the processor D100 executes the computer program D102, it acquires raw syslog log data from multiple onboard devices in the railcar. Based on the event keywords corresponding to each onboard device, it clusters the raw syslog log data to obtain multiple key syslog log data. For each key syslog log data, it extracts data features and inputs these features into a pre-trained safety assessment model to obtain the railcar's safety assessment result. Clustering the raw syslog log data based on the event keywords corresponding to each onboard device yields multiple key syslog log data. Extracting data features from these key syslog log data and inputting them into the safety assessment model results in a safety assessment. Clustering the raw syslog log data effectively reduces the consumption of computing resources by redundant log data, lowers network transmission load, and improves real-time performance. Simultaneously, the safety assessment model accurately identifies the data characteristics of onboard devices under abnormal conditions, promptly detects abnormal onboard devices, and improves the security of the railcar network control system.
[0060] The processor D100 can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.
[0061] In some embodiments, the memory D101 may be an internal storage unit of the terminal device D10, such as a hard disk or memory of the terminal device D10. In other embodiments, the memory D101 may be an external storage device of the terminal device D10, such as a plug-in hard disk, smart media card (SMC), secure digital card (SD), flash card, etc., equipped on the terminal device D10. Furthermore, the memory D101 may include both internal and external storage units of the terminal device D10. The memory D101 is used to store the operating system, applications, bootloader, data, and other programs, such as the program code of the computer program. The memory D101 can also be used to temporarily store data that has been output or will be output.
[0062] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps described in the various method embodiments above.
[0063] This application provides a computer program product that, when run on a terminal device, enables the terminal device to implement the steps described in the above-described method embodiments.
[0064] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of protection of this application is limited to these examples; within the framework of this application, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of one or more embodiments of this application as described above, which are not provided in detail for the sake of brevity.
[0065] One or more embodiments in this application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of this application. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of one or more embodiments in this application should be included within the protection scope of this application.
Claims
1. A safety assessment method for rail trains, characterized in that, include: The raw syslog log data of multiple on-board devices in the rail train is obtained. The raw syslog log data is clustered according to the event keywords corresponding to each on-board device to obtain multiple key syslog log data. The multiple key syslog log data correspond one-to-one with the multiple on-board devices. Each key syslog log data includes the network transmission protocol, event behavior, and occurrence time of the event behavior of its corresponding on-board device. For each of the key syslog log data, data features are extracted from the key syslog log data, and the data features are input into a pre-trained security assessment model to obtain the security assessment result of the rail train; wherein, the security assessment model is trained using preset standard network transmission protocols, preset standard event behaviors, and preset standard occurrence times of the multiple on-board devices under normal conditions as training samples, and the data features include the link characteristics of the network transmission protocol and the temporal characteristics of the event behavior.
2. The safety assessment method for rail trains according to claim 1, characterized in that, The event keyword is a field in the syslog log data that describes the operating status of the vehicle-mounted device.
3. The safety assessment method for rail trains according to claim 2, characterized in that, The network transmission protocol is TRDP.
4. The safety assessment method for rail trains according to claim 3, characterized in that, The link characteristics include source IP, source MAC, destination IP, destination MAC, and destination port.
5. The safety assessment method for rail trains according to claim 4, characterized in that, The timing characteristics include the temporal order of the occurrence times of the events corresponding to the multiple vehicle-mounted devices.
6. The safety assessment method for rail trains according to claim 5, characterized in that, The safety assessment results are used to indicate onboard equipment where abnormal events have occurred.
7. The safety assessment method for rail trains according to claim 6, characterized in that, The multiple on-board devices include at least train doors, train gearboxes, and driver's console; The events related to the train doors include opening and closing the doors; The event behaviors of the train transmission include deceleration, acceleration, and maintaining a constant speed; The event behaviors of the driver control console include normal access and abnormal access.
8. A safety assessment system for rail trains, characterized in that, include: The data acquisition module is used to acquire raw syslog log data from multiple on-board devices in the rail train, and cluster the raw syslog log data according to the event keywords corresponding to each on-board device to obtain multiple key syslog log data. The multiple key syslog log data correspond one-to-one with the multiple on-board devices, and each key syslog log data includes the network transmission protocol, event behavior, and occurrence time of the event behavior of its corresponding on-board device. The security assessment module is used to extract data features from each of the key syslog log data, and input the data features into a pre-trained security assessment model to obtain the security assessment result of the rail train. The security assessment model is trained using preset standard network transmission protocols, preset standard event behaviors, and preset standard occurrence times of the multiple on-board devices under normal conditions as training samples. The data features include the link features of the network transmission protocols and the temporal features of the event behaviors.
9. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1 to 7.
10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 7.