Network attack detection method based on decision tree applied to subway communication

Abstract

This invention provides a network attack detection method based on decision trees applied to subway communication, comprising: a communication interface module forwarding received data packets to a filtering model in a round-robin fashion; each filtering model extracting feature points from the corresponding data packets to form a feature vector, and transmitting the feature vector to a decision tree model; the decision tree model judging the correctness of the feature vector according to set judgment conditions, and feeding back the judgment result to the corresponding first storage device; an application read module reading the judgment results from each first storage device, storing data packets with a judgment result of 0 to a second storage device, and incrementing the error packet count in the second storage device by 1; and the application periodically reading the error packet count in the second storage device, judging whether the error packet count read in two consecutive time intervals exceeds a set threshold. If it exceeds the set threshold, the user is alerted to check whether they are under a network storm attack. It has the advantages of high efficiency in multi-threaded processing and strong applicability.

Description

Technical Field

[0001] This invention belongs to the field of rail transit communication, and specifically relates to a network attack detection method based on decision trees applied to subway communication. Background Technology

[0002] Currently, subway communication processes message information by sending the message to the application, which then checks for erroneous messages using subway signal security protocols and information from the peer device. However, when faced with a large-scale network attack, because the application processes erroneous messages in a single thread, it repeatedly executes error checking measures, disrupting normal subway communication. Summary of the Invention

[0003] The purpose of this invention is to provide a network attack detection method based on decision trees applied to subway communication, which has the advantages of high efficiency in multi-threaded processing and strong applicability.

[0004] To achieve the above objectives, this invention provides a network attack detection method based on decision trees applied to subway communication, comprising: a communication interface module forwarding received data packets in a round-robin fashion to a filtering model in each filtering model module; each filtering model storing the corresponding received data packets in a corresponding first storage device, and each filtering model extracting feature points from the corresponding received data packets to form a feature vector, and transmitting the feature vector to a decision tree model; the decision tree model judging the correctness of the feature vector according to set judgment conditions, and feeding back the judgment result to the corresponding first storage device; an application read module reading the judgment results from each first storage device, storing data packets with incorrect judgment results in a second storage device, and incrementing the number of incorrect packets in the second storage device by 1; and an application periodically reading the number of incorrect packets in the second storage device, judging whether the number of incorrect packets read in two adjacent time intervals is greater than a set threshold, and if it is greater than the set threshold, reminding the user to check whether they are under a network storm attack.

[0005] Preferably, the communication interface module is connected to a single-line filtering model module, the filtering model module includes m filtering models Ai, and the communication interface module is connected to each of the m filtering models Ai; each filtering model is connected to a first storage device Pi, i = 1, 2, ..., m.

[0006] Preferably, the communication interface module connects to multiple filtering model modules via multi-line connections, and each filtering model module includes multiple filtering models to accelerate the filtering of data packets.

[0007] Preferably, the communication interface module forwards the received data packets to m filtering models Ai in turn. Each filtering model Ai stores the data packets in a queue in the corresponding first storage device Pi, and records the preset result of the data packets in the first storage device Pi as X.

[0008] Preferably, each of the first storage devices Pi includes multiple storage sites, namely a first storage site, a second storage site, ..., an Nth storage site, for storing the N data packets transmitted by the corresponding filtering model Ai.

[0009] Preferably, if the decision tree model determines that the feature vector composed of feature points is correct according to the judgment conditions, it outputs the first judgment result and feeds back the first judgment result to the corresponding first storage device, and modifies the judgment preset X originally stored in the first storage device to 1; if the decision tree model determines that the feature vector composed of feature points is incorrect according to the judgment conditions, it outputs the second judgment result to 0, and feeds back the second judgment result 0 to the corresponding first storage device, and modifies the preset result X originally stored in the first storage device to 0.

[0010] Preferably, the selection of the feature points includes the entire message length, certain fields of the metro signal security protocol, and peer device information stored in the application data.

[0011] Preferably, the application read module reads the judgment result from the first storage location of the first storage device Pi in turn, including the following scenarios: Scenario 1: If the first storage device Pi is empty, then the data reading of the application read module is paused, and the generation of data packets in the first storage location of the first storage device Pi is waited for; Scenario 2: If the first storage device Pi is not empty, then the data packets stored in the first storage location of the first storage device Pi are read.

[0012] Preferably, reading the data packet stored in the first storage location of the first storage device Pi includes the following three cases: Case 2-1: If the first judgment result is X, the data packet corresponding to the judgment result X is placed in the corresponding storage location, and after waiting for a certain period of time, the judgment result of the first storage location is read again; if the judgment result read by the application read module for the second time is 1 or X, the corresponding data packet is handed over to the application for further processing; Case 2-2: If the first judgment result is 1, the data packet corresponding to the first storage location is directly handed over to the application for further processing; Case 2-3: If the first or second judgment result is 0, the data packet corresponding to the first storage location is stored in the second storage device, and the number of erroneous packets in the second storage device is incremented by 1.

[0013] Preferably, the application read module reads the judgment result from the first sorted storage location of the first storage device P1 in turn. After reading the first sorted storage location of the first storage device P1, it continues to read the judgment result of the first sorted storage location of the first storage device P2, and repeats the process of reading the judgment result until the judgment result of the first sorted storage location in the m-th first storage device Pm is read. Then, it starts reading the judgment result from the first sorted storage location of the first storage device P1 again, and performs N loops in sequence.

[0014] Preferably, the application and the second storage device are connected to the alarm by setting a timer thread.

[0015] Preferably, a timer in the timer thread is started, and the application retrieves the number of error packets from the second storage device every n minutes. When the difference between the number of error packets retrieved and the number of error packets retrieved previously exceeds a set threshold, an alarm signal is transmitted to the alarm device to prompt the user to check whether they are under attack by a network storm.

[0016] In summary, compared with the prior art, the network attack detection method based on decision trees applied to subway communication provided by this invention has the following beneficial effects:

[0017] 1. Multi-threaded processing for high efficiency. The filtering model module can be called by a single thread or multiple threads; when multiple filtering model modules are configured, the packet filtering is multi-threaded, which can greatly speed up the packet filtering; thus, in the event of a network attack, the impact on normal subway communication can be reduced.

[0018] 2. This method has strong applicability. The communication interface module can be a socket, a physical link layer, and a communication interface for different railway signaling safety communication protocols; that is, the packet filtering model connected to the communication interface module can be used not only for packets received by the socket, but also for IP packets received by the physical link layer, as well as packets for different railway signaling safety communication protocols; it only requires reselecting feature points and adjusting the decision tree model according to the scenario, thus having wide applicability. Attached Figure Description

[0019] Figure 1 This is a flowchart of the network attack detection method based on decision tree applied to subway communication according to the present invention. Detailed Implementation

[0020] The following will be combined with the appendix in the embodiments of the present invention. Figure 1 The technical solutions, structural features, objectives and effects achieved in the embodiments of the present invention will be described in detail.

[0021] It should be noted that the accompanying drawings are in a very simplified form and use non-precise proportions. They are only used to facilitate and clarify the purpose of illustrating the embodiments of the present invention, and are not intended to limit the implementation conditions of the present invention. Therefore, they have no substantial technical significance. Any modifications to the structure, changes in the proportional relationship, or adjustments to the size should still fall within the scope of the technical content disclosed in the present invention, provided that they do not affect the effects and objectives that the present invention can produce.

[0022] It should be noted that, in this invention, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only the expressly listed elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus.

[0023] This invention provides a network attack detection method based on decision trees applied to subway communication, such as... Figure 1 As shown, the network attack detection method includes: the communication interface module 1 forwards the received data packets in a round-robin fashion to the filtering model 21 in each filtering model module 2; each filtering model 21 stores the corresponding received data packets in the corresponding first storage device 4, and each filtering model 21 extracts feature points from the corresponding received data packets to form a feature vector, and transmits the feature vector to the decision tree model 3; the decision tree model 3 judges the correctness of the feature vector according to the set judgment conditions, and feeds back the judgment result to the corresponding first storage device 4; the application read module 5 reads the judgment result from each first storage device 4, stores the data packets with the judgment result of error in the second storage device 6, and increments the number of error packets in the second storage device 6 by 1; the application 7 reads the number of error packets in the second storage device 6 at regular intervals, and judges whether the number of error packets read in two adjacent time intervals is greater than a set threshold. If it is greater than the set threshold, the user is reminded to check whether they are under a network storm attack.

[0024] Specifically, in this embodiment, such as Figure 1As shown, the communication interface module 1 is connected to a single-line filtering model module 2, which includes m filtering models 21. The communication interface module 1 is connected to each of the m filtering models 21, and each filtering model 21 is represented by Ai (i = 1, 2, ..., m). Each filtering model 21 is connected to a first storage device 4, i.e., there are m first storage devices 4 in total, and each first storage device is represented by Pi (i = 1, 2, ..., m). When the communication interface module 1 forwards the received data packets to the m filtering models Ai in a round-robin fashion, each filtering model Ai stores the data packets in the corresponding first storage device Pi in a queue, and records the preset result of the data packets in the first storage device Pi as X. Each first storage device Pi includes multiple storage points, namely the first storage point, the second storage point, ..., the Nth storage point, for storing the N data packets transmitted by the corresponding filtering model Ai.

[0025] Specifically, the communication interface module 1 forwards the received data packets to the m filtering models Ai in a round-robin manner. This means that the first data packet in the first cycle is sent to the filtering model A1, the second data packet is sent to the filtering model A2, and so on, until the mth data packet is sent to the filtering model Am. Then, the first to the Mth data packets in the second cycle are sent to the filtering models A1 to Ai in turn, and so on, so that the data packets of the N cycles are sent to the corresponding filtering models Ai in turn.

[0026] Furthermore, the m data packets in the first loop are stored at the first storage location of the first storage device Pi corresponding to each filtering model Ai; the M data packets in the second loop are stored at the second storage location of the first storage device Pi corresponding to each filtering model Ai; and so on, storing the data packets of N loops sequentially at the corresponding storage locations of the first storage device Pi. In other embodiments, the communication interface module 1 can also connect multiple filtering model modules 2 via multiple lines, and each filtering model module 2 includes multiple filtering models 21. By connecting multiple filtering model modules 2, the extraction and filtering of data packets can be processed in a multi-threaded manner, which can greatly speed up the filtering of data packets. When a network attack occurs, the impact on normal subway communication can be reduced.

[0027] The communication interface module 1 can be a socket, a physical link layer, or a port of different railway signal security communication protocols, making this method applicable to a variety of scenarios and with wide applicability.

[0028] Furthermore, the filtering model module 2 can select from Filter, Wrapper, Embedded, PCA (Principal Component Analysis), and LDA (Linear Discriminant Analysis) models to extract and simplify feature points from different types of data packets. The data packet types include data packets received from sockets, IP data packets received from the physical link layer, and data packets corresponding to different railway signal safety communication protocols.

[0029] In this embodiment, as Figure 1 As shown, communication interface module 1 uses socket 11 as the communication port to continuously receive data packets. Simultaneously, a filter model is used to extract feature points from each data packet received by socket 11, and the extracted feature points are used to form a feature vector, which is then cyclically transmitted to decision tree model 3 for judgment. By judging the feature vector, the correctness of the data packet corresponding to the feature vector is determined.

[0030] Furthermore, such as Figure 1 As shown, in this embodiment, the decision tree model 3 is denoted as AA. Decision tree model AA uses information entropy to determine the importance of each feature point in the feature vector, and then constructs a classification binary tree. The root node of the classification binary tree is the feature point, and the leaf nodes are the specific classification results. The classification result of the leaf node is the correctness judgment result of the data packet. Specifically, in this embodiment, the judgment condition of the decision tree model AA is the weight value of the feature point. If the weight value of the feature point is greater than 0.8, then the feature point is judged to be correct, and the classification result output by the corresponding leaf node is correct, that is, the correctness judgment result of the data packet is correct; conversely, if the weight value of the feature point is less than or equal to 0.8, then the feature point is judged to be incorrect, and the classification result output by the corresponding leaf node is incorrect, that is, the correctness judgment result of the data packet is incorrect. It should be noted that the judgment condition is set according to the content of the feature point.

[0031] Furthermore, if decision tree model 3 determines that the feature vector composed of feature points is correct based on the judgment conditions, it outputs the first judgment result as 1 and feeds back the first judgment result 1 to the corresponding first storage device 4, modifying the preset result X originally stored in the first storage device 4 to 1; conversely, if decision tree model 3 determines that the feature vector composed of feature points is incorrect based on the judgment conditions, it outputs the second judgment result as 0 and feeds back the second judgment result 0 to the corresponding first storage device 4, modifying the preset result X originally stored in the first storage device 4 to 0.

[0032] The selection of the feature points includes the entire message length, certain fields of the metro signal security protocol, and peer device information stored in the application data. Specifically, taking the RSSPII secure communication protocol as an example of the metro signal security protocol, certain fields that can be used as feature points include: the version field of the protocol's ALE layer, the application type field, the packet type field, and the checksum field. The version field and application type field are generally determined by configuration, while the packet type field and checksum field have fixed ranges; therefore, these fields can be selected and judged as feature points.

[0033] Furthermore, the application read module 5 reads the judgment result from the first storage location of the first storage device Pi in a round-robin manner, including the following scenarios:

[0034] Scenario 1: If the first storage device Pi is empty, that is, there is no data packet input at the first storage location in the first storage device Pi, then the data reading of the application read module 5 is paused, and the application waits for the data packet to be generated at the first storage location in the first storage device Pi.

[0035] Scenario 2: If the first storage device Pi is not empty, meaning it contains a judgment result, then the data packet stored at the first sorted storage location in the first storage device Pi is read. This includes three cases:

[0036] Scenario 2-1: If the first judgment result is X, it means that when the application read module 5 reads the judgment result, the decision tree model 3 has not yet judged the data packet. Therefore, the judgment result read is the preset result X. At this time, the data packet corresponding to the judgment result X needs to be put back into the corresponding storage location, and after waiting for a certain period of time, the judgment result of the first-ranked storage location is read again. If the judgment result read by the application read module 5 for the second time is 1 or X, the corresponding data packet is handed over to the application 7 for the next step of processing. That is, the data packet in the first-ranked storage location is transmitted to the application 7, so that the data packet stored in the second storage location is ranked first, so as to perform the next cycle of judgment. In order to avoid line congestion, the data of the storage location with the judgment result X read for the second time will still be transmitted to the application 7 for the next operation to improve work efficiency and prevent the data packet from being abnormal data and causing line congestion.

[0037] Case 2-2: If the first judgment result is 1, then the data packet corresponding to the first sorted storage location is directly handed over to application 7 for the next step of processing.

[0038] Case 2-3: If the judgment result obtained for the first or second time is 0, then the data packet corresponding to the storage position with the first ranking is stored in the second storage device 6 (the second storage device 6 is denoted as Q in this embodiment), and the number of erroneous packets in the second storage device Q is incremented by 1.

[0039] The application read module 5 takes turns reading the judgment result starting from the first sorted storage location in the first storage device P1. After reading the judgment result of the first sorted storage location in the first storage device P1, it continues to read the judgment result of the first sorted storage location in the first storage device P2, and repeats the same judgment process until the judgment result of the first sorted storage location in the m-th first storage device Pm is read. Then, it starts reading the judgment result again from the first sorted storage location in the first storage device P1, and repeats this process N times.

[0040] While verifying the correctness of data packets received by communication interface module 1, application 7 and the second storage device 6 are connected to alarm 9 via timer thread 8. Furthermore, a timer in timer thread 8 is activated, and application 7 retrieves the number of erroneous packets from the second storage device 6 every n minutes. When the difference between the retrieved number of erroneous packets and the previously retrieved number exceeds a set threshold, an alarm signal is transmitted to alarm 9, prompting the user to check if they are under a network storm attack.

[0041] In summary, compared with the prior art, the network attack detection method based on decision tree applied to subway communication provided by this invention has advantages such as high multi-threaded processing efficiency and strong applicability.

[0042] Although the present invention has been described in detail through the preferred embodiments above, it should be understood that the above description should not be considered as a limitation of the present invention. Various modifications and substitutions to the present invention will be apparent to those skilled in the art after reading the above description. Therefore, the scope of protection of the present invention should be defined by the appended claims.

Claims

1. A network attack detection method based on a decision tree applied to subway communication, characterized in that, The communication interface module (1) forwards the received data packets to each screening model (21) in the screening model module (2) in turn. Each screening model (21) stores the corresponding received data packet in the corresponding first storage device (4), and each screening model (21) extracts the feature points in the corresponding received data packet to form a feature vector, and transmits the feature vector to the decision tree model (3). The decision tree model (3) judges the correctness of the feature vector according to the set judgment condition, and feeds back the judgment result to the corresponding first storage device (4). The application reading module (5) reads the judgment result from each first storage device (4), stores the data packet with the wrong judgment result in the second storage device (6), and increases the number of error packets in the second storage device (6) by 1. The application (7) reads the number of error packets in the second storage device (6) at a fixed time, and judges whether the number of error packets read at adjacent two times is greater than the set threshold value by calculating the growth difference between the current obtained number of error packets and the previously obtained number of error packets. If the growth difference is greater than the set threshold value, the user is reminded to check whether the network storm attack is being suffered. The communication interface module (1) is single-wire connected with one screening model module (2), the screening model module (2) includes m screening models Ai, and the communication interface module (1) is connected with the m screening models Ai respectively.

2. The network attack detection method based on decision tree applied to subway communication according to claim 1, wherein, The communication interface module (1) is connected with multiple screening model modules (2) through multiple lines, each screening model module (2) includes multiple screening models (21), so as to speed up the screening of data packets. 3.The network attack detection method based on decision tree applied to subway communication according to claim 1, wherein, The communication interface module (1) forwards the received data packets to the m screening models Ai in turn, each screening model Ai stores the data packets in the corresponding first storage device Pi in the form of a queue, and records the preset result of the data packets in the first storage device Pi as X.

4. The network attack detection method based on a decision tree applied to subway communication according to claim 2, characterized in that, Each first storage device Pi includes multiple storage sites, i.e., a first storage site, a second storage site,..., and an Nth storage site, for storing N data packets transmitted by the corresponding screening model Ai. 5.The network attack detection method based on decision tree applied to subway communication according to claim 4, wherein, 6. The network attack detection method based on the decision tree for subway communication according to claim 5, wherein if the decision tree model (3) judges that the feature vector composed of the feature points is correct according to the judgment condition, a first judgment result is output as 1, and the first judgment result 1 is fed back to the corresponding first storage device (4), and the original stored judgment preset X in the first storage device (4) is modified as 1. If the decision tree model (3) judges that the feature vector composed of the feature points is incorrect according to the judgment condition, a second judgment result is output as 0, and the second judgment result 0 is fed back to the corresponding first storage device (4), and the original stored preset result X in the first storage device (4) is modified as 0. ​ ​ 7. The network attack detection method based on decision tree applied to subway communication according to claim 6, characterized in that, The selection of the feature points contains the whole message length, the field of the subway signal safety protocol, and the information of the peer device stored in the application data. 8.The network attack detection method based on decision tree applied to subway communication according to claim 6, wherein, The application reading module (5) reads the judgment result from the first storage site of the first storage device Pi in turn and in cycles, including the following scenarios: Scenario 1: The first storage device Pi is empty, and the data reading of the application reading module (5) is suspended, waiting for the generation of the data packet in the first storage site of the first storage device Pi. Scenario 2: The first storage device Pi is not empty, and the data packet stored in the first storage site of the first storage device Pi is read. 9.The network attack detection method based on decision tree applied to subway communication according to claim 8, wherein, The reading of the data packet stored in the first storage site of the first storage device Pi includes the following three cases: Case 2-1: The first acquired judgment result is X, the data packet corresponding to the judgment result X is put into the corresponding storage site, and after a certain period of time, the judgment result of the first storage site is read again; if the second reading judgment result of the application reading module (5) is 1 or X, the corresponding data packet is handed over to the application (7) for further processing. Case 2-2: The first acquired judgment result is 1, and the data packet corresponding to the first storage site is directly handed over to the application (7) for further processing. Case 2-3: The first or second acquired judgment result is 0, and the data packet corresponding to the first storage site is stored in the second storage device (6), and the number of error packets in the second storage device (6) is increased by 1. 10.The network attack detection method based on decision tree applied to subway communication according to claim 9, wherein, The application reading module (5) reads the judgment result from the first storage site of the first storage device P1 in turn and in cycles, and after the reading of the first storage site of the first storage device P1 is completed, the judgment result of the first storage site of the first storage device P2 is read, and the reading process is repeated until the judgment result of the first storage site of the mth first storage device Pm is read. Then, the judgment result of the first storage site of the first storage device P1 is read again, and N cycles are performed in turn. 11.The network attack detection method based on decision tree applied to subway communication according to claim 1, wherein, The application (7) and the second storage device (6) are connected with the alarm (9) through the setting of the timer thread (8). 12.The network attack detection method based on decision tree applied to subway communication according to claim 11, wherein, The timer in the timer thread (8) is started, and the application (7) acquires the number of error packets from the second storage device (6) every n minutes. When the growth difference between the acquired number of error packets and the previously acquired number of error packets exceeds the set threshold value, an alarm signal is transmitted to the alarm (9) to prompt the user to check whether an attack of network storm is being suffered.

Images