A network security early warning method and device for train communication network

Abstract

The present invention relates to the technical field of digital information transmission, and in particular to a network security early warning method and device for a train communication network, the method comprising: formulating a collection plan, acquiring corresponding information of a train based on the collection plan to obtain collected data; periodically using a LOF algorithm to perform a primary screening based on the collected data to obtain normal points and abnormal points, performing feature analysis on the normal points to determine the probability that the data points conform to a train track, performing corrections based on the probability of the train track, and weighting the abnormal points within the normal points obtained during the primary screening process through the LOF algorithm; performing a safety early warning based on the abnormal points obtained during the primary screening and / or the abnormal points within the normal points during the primary screening process; that is, performing data abnormality monitoring more accurately through the k-local abnormality factor of each data point of the modified LOF algorithm, avoiding the occurrence of early warning misjudgment, and improving the accuracy of judgment.

Description

Technical Field

[0001] The present invention relates to the technical field of digital information transmission, and in particular to a network security early warning method and device for a train communication network. Background Art

[0002] For the train log data transmitted by the train communication network, if abnormal transmission data occurs, it will lead to the spread of misleading information or the erroneous execution of operating instructions, thereby causing the train to execute abnormal stops or acceleration plans, etc. Therefore, security warnings for train data are a key link in ensuring the safety of train operation.

[0003] In existing methods, a density-based LOF (local anomaly factor) anomaly monitoring algorithm is usually used to monitor anomalies in the log data transmitted by trains. However, due to the continuous change characteristics of log data during train operation, the data will not suddenly change drastically, so the local density of normal data should show similarity, while the local density of abnormal data should show dissimilarity. If some data that require early warning also show good density properties, it may lead to misjudgment of the early warning. Summary of the invention

[0004] In order to solve the technical problem that abnormal data with good density properties leads to misjudgment of warnings and affects the accuracy of judgment, the purpose of the present invention is to provide a network security warning method and device for train communication networks. The technical solutions adopted are as follows:

[0005] Formulate a collection plan, and obtain the corresponding information of the train based on the collection plan to obtain the collected data;

[0006] Based on the collected data, the LOF algorithm is periodically used to perform preliminary screening to obtain normal points and abnormal points. The normal points are analyzed for characteristics to determine the probability that the data points conform to the train trajectory. Corrections are made based on the probability of the train trajectory, and the abnormal points within the normal points in the preliminary screening process are obtained by weighting the LOF algorithm.

[0007] A safety warning is issued based on abnormal points obtained from the initial screening and / or abnormal points within normal points during the initial screening process.

[0008] Furthermore, a collection plan is formulated, and corresponding information of the train is obtained based on the collection plan to obtain the collected data, including:

[0009] The acquisition solution includes GPS, receivers and track sensors;

[0010] Use GPS to obtain the longitude and latitude information of the train through the receiver to obtain the train's location information; use the track sensor to obtain the speed and acceleration of the train;

[0011] Based on the position information, speed and acceleration of the train, the log data of the train is periodically collected and transmitted to obtain the collected data.

[0012] Furthermore, based on the collected data, the LOF algorithm is periodically used to perform preliminary screening to obtain normal points and abnormal points, including:

[0013] Based on the collected data, feature analysis is performed, and the time corresponding to the transmitted time data is periodically obtained. All collected times are defined as the horizontal and vertical coordinates to establish a two-dimensional coordinate system. The LOF algorithm is used based on the two-dimensional coordinate system to obtain the k-local anomaly factor of each moment. The normal points and abnormal points are initially screened according to the k-local anomaly factor.

[0014] Furthermore, the time corresponding to the transmitted time data is periodically obtained, and the calculation formula of the period is:

[0015]

[0016] in, Indicates the period of data collection; Indicates that after transmission, there are Time data; Indicated by natural constant An exponential function with base ; Indicates k-local anomaly factor of the data at each moment; Indicates the transmission The time corresponding to the moment data; Indicates the transmission The time corresponding to the moment data; Indicates the transmission The time corresponding to the moment data.

[0017] Furthermore, the initial screening yields normal and abnormal points, including:

[0018] Based on the time data, the corresponding period anomaly degree is obtained, and the calculation formula is:

[0019]

[0020] in, Display time data The degree of cycle abnormality; Represents time data; Represents the maximum and minimum normalized function; represents the time corresponding to the k-local anomaly factor closest to 1; represents the period of data collection; k represents the size of the neighborhood in the k-local anomaly factor; min represents the minimum value function;

[0021] Determine whether the periodic abnormality exceeds the preset abnormality threshold. If so, it means that the data at the current moment is an abnormal point; if not, it means that the data at the current moment is a normal point.

[0022] Furthermore, feature analysis is performed on normal points to determine the probability that the data points conform to the train trajectory, including:

[0023] Based on the speed and acceleration of the train at the current time, the distance traveled by the train at the next time is estimated. The corresponding calculation formula is:

[0024]

[0025] in, Indicates the current time The velocity and acceleration are estimated to the adjacent time the distance travelled; Indicates the current time The speed of the train; Indicates the current time The acceleration of the train; represents the integral variable;

[0026] based on The probability of the train running track from the current time to the adjacent time is obtained, and the corresponding calculation formula is:

[0027]

[0028] in, Indicates the current time To the adjacent time Probability of conforming to the train running trajectory; Indicates the current time To the adjacent time the distance travelled; represents a hyperparameter;

[0029] based on The correction is performed to obtain the probability that the data point conforms to the correction of the train running trajectory. The corresponding calculation formula is:

[0030]

[0031] in, Indicates the current time To the adjacent time The probability that the data point conforms to the train trajectory correction; Indicates adjacent time To the current time Probability of conforming to the train running trajectory; Indicates adjacent time To the adjacent time Probability of conforming to the train running trajectory;

[0032] based on Get the current time The probability that a data point conforms to the train track is calculated as:

[0033]

[0034] in, Indicates the current time The probability that a data point fits the train trajectory; represents the maximum and minimum normalized function; Indicates adjacent time To the current time The probability that the data point conforms to the train trajectory correction; Indicates adjacent time To the current time time interval; Indicates adjacent time To the current time time interval; Indicates the current time To the adjacent time time interval; Indicates adjacent time To the adjacent time time interval.

[0035] Furthermore, corrections are made based on the probability of the train trajectory, including:

[0036] According to the probability of train trajectory, the k-local anomaly factor is corrected, and the corresponding calculation formula is:

[0037]

[0038] in, Represents data points Modified k-local anomaly factor; express sample size of the distance neighborhood; express Points within the distance neighborhood ; express Points within the distance neighborhood The k-reachable density of Represents data points The k-reachable density of express Points within the distance neighborhood Probability of matching the train trajectory; express The distance within the neighborhood The probability that a point fits the train trajectory.

[0039] Furthermore, the weighted LOF algorithm is used to obtain abnormal points within normal points during the initial screening process, including:

[0040] Determine data points based on weighting based on k-reachable density The normal degree of , the corresponding calculation formula is:

[0041]

[0042] in, Represents data points degree of normality; Indicated by natural constant An exponential function with base ; Represents data points Modified k-local anomaly factor;

[0043] judge Whether it exceeds the preset threshold, if so, it means that the current data point is a normal point within the normal points; if not, it means that the current data point is an abnormal point within the normal points.

[0044] Furthermore, a safety warning is issued based on the abnormal points obtained in the initial screening and / or the abnormal points within the normal points in the initial screening process, including:

[0045] Obtain safety warning measures, identify potential problems based on abnormal points obtained from the initial screening and / or abnormal points within normal points during the initial screening process, and notify operation and maintenance personnel to perform maintenance; if abnormal points obtained from the initial screening and / or abnormal points within normal points during the initial screening process appear continuously, take safety warning measures to issue a safety warning.

[0046] In order to solve the above technical problems, the present invention provides another technical solution as follows: a network security early warning device for a train communication network, comprising the following units:

[0047] The collection unit is used to: formulate a collection plan, and obtain corresponding information of the train based on the collection plan to obtain collected data;

[0048] The data processing unit is used to: periodically use the LOF algorithm to perform preliminary screening based on the collected data to obtain normal points and abnormal points, perform feature analysis on the normal points to determine the probability that the data points conform to the train trajectory, make corrections based on the probability of the train trajectory, and weight the abnormal points within the normal points in the preliminary screening process through the LOF algorithm;

[0049] The early warning unit is used to: issue a safety early warning based on abnormal points obtained during the initial screening and / or abnormal points within normal points during the initial screening process.

[0050] The present invention has the following beneficial effects: for abnormal monitoring of the collected data after transmission, two LOF algorithm analyses are adopted, one is to combine periodic analysis to preliminarily screen normal points and abnormal points, this step is conducive to the subsequent concise and clear analysis of data, and the second is to further analyze the characteristics of the normal points after the initial screening, correct the k-local anomaly factor, avoid the situation that those data points that should have been warned are not detected due to good density properties, and can more accurately use the LOF anomaly monitoring technology for early warning, that is, through the k-local anomaly factor of each data point of the corrected LOF algorithm, more accurate data anomaly monitoring is carried out, avoid the occurrence of false warnings, and improve the accuracy of judgment. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0052] Figure 1 A system flow chart of a network security early warning method for a train communication network provided by an embodiment of the present invention;

[0053] Figure 2 A flowchart of the steps of a network security early warning method for a train communication network provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0054] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following is a detailed description of the network security early warning method and device for train communication network proposed by the present invention, its specific implementation method, structure, features and effects, in combination with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0055] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0056] The specific scheme of a network security early warning method and device for a train communication network provided by the present invention is described in detail below with reference to the accompanying drawings.

[0057] The density-based LOF anomaly monitoring algorithm monitors the log data transmitted by the train. Due to the continuous change characteristics of the log data during train operation, the data will not suddenly change drastically. The local density of normal data should show similarity, and the local density of abnormal data should show dissimilarity. If it also shows good density properties for data that require warning, it will lead to misjudgment of safety warnings. The first embodiment of the present invention provides a network security warning method for a train communication network. The method uses the k-local anomaly factor of each data point of the modified LOF algorithm to more accurately monitor data anomalies, avoid misjudgment of warnings, and improve the accuracy of judgment. In order to realize a network security warning method for a train communication network, a network security warning method device for a train communication network is provided. The device is essentially a software system, which is composed of units that realize corresponding functions. The specific steps in the method are now introduced in detail.

[0058] Please combine Figure 1 and Figure 2 , which shows a system flow chart and a step flow chart of a network security early warning method for a train communication network provided by an embodiment of the present invention, the method comprising:

[0059] Step S1: formulate a collection plan, and obtain corresponding information of the train based on the collection plan to obtain collected data;

[0060] Step S2: Based on the collected data, the LOF algorithm is periodically used to perform preliminary screening to obtain normal points and abnormal points, and the normal points are subjected to feature analysis to determine the probability that the data points conform to the train trajectory, and the data points are corrected according to the probability of the train trajectory, and the abnormal points within the normal points in the preliminary screening process are obtained by weighting the LOF algorithm;

[0061] Step S3: issuing a safety warning based on the abnormal points obtained in the initial screening and / or the abnormal points within the normal points during the initial screening process.

[0062] It is explained that the train communication network is used to ensure the safety, efficiency and comfort of the train during operation, and involves numerous communication equipment inside the train and external communication facilities, including communication equipment inside the train, between trains and between trains and the ground, to ensure timely and effective communication between train crew, drivers and passengers, that is, real-time monitoring and scheduling of the train during operation.

[0063] LOF algorithm refers to Local Outlier Factor algorithm, which is an algorithm used for data mining. It is mainly used to identify outliers or outliers in data sets. Its core is to evaluate the degree of abnormality by calculating the local outlier factor of each point. In the specific implementation process, the LOF algorithm first calculates the local density of each point, and then calculates its local outlier factor by comparing the density difference between the point and its neighboring points. Specifically, for each point in the data set, the LOF algorithm will find its k nearest neighbors and calculate the density of these neighboring points. Then the algorithm will calculate the relative density difference between the point and each neighboring point, and standardize these difference values ​​to obtain the LOF value of the point.

[0064] Preferably, step S1 includes: the acquisition scheme includes GPS, a receiver and a track sensor;

[0065] Step S11: using GPS to obtain the longitude and latitude information of the train through the receiver to obtain the location information of the train; using the track sensor to obtain the speed and acceleration of the train;

[0066] Step S12: Periodically collect the train's position information, speed and acceleration to form log data, and transmit the data to obtain collected data.

[0067] To explain, GPS (Global Positioning System) refers to the global positioning system, which is a navigation system composed of a series of satellites in the earth's orbit; these satellites continuously send signals, and users receive these signals through receivers and use these signals to determine their own position and time; its working principle is that after the user's receiver receives signals from multiple satellites, it can determine the distance between the user and the satellite by calculating the transmission time of the signal. Since the position of the satellite is known, the user can calculate its own position through this distance information; at the same time, since the satellite signal transmission is synchronous, the user can determine his own time by comparing the arrival time of the signal.

[0068] Receivers are used to receive various signals or information and are widely used in radio communications, television, radar and other fields. They mainly capture signals from different frequencies from the transmission medium and convert them into recognizable information, such as sound, images or other data. They usually include antennas, tuners, amplifiers and demodulators. The antenna is used to receive radio waves, the tuner is used to select a specific frequency, the amplifier is used to enhance the signal strength, and the demodulator is used to convert the modulated signal into the original information.

[0069] Track sensors are used to monitor and sense various status information of trains and tracks in real time. They are widely used in high-speed railways, urban rail transit, subways and other railway transportation systems, providing strong technical support to ensure safe, efficient and stable operation.

[0070] It is explained that by using a global positioning system (GPS) receiver to accurately capture the specific longitude and latitude coordinates of the train and determine its exact position in the railway network, the travel status of the train can be monitored in real time and ensure that it travels along the correct track; at the same time, with the help of track sensors, the travel speed and acceleration of the train can be measured and acquired in real time, and these data are used as the log data of the train; then the log data of the train is periodically collected and transmitted to obtain the collected data, which is used as the analysis data of this embodiment for analysis and processing by relevant personnel.

[0071] It can be explained that the sampling interval of the real-time train log data transmitted in the train communication network is periodic, so all the time data obtained by the transmission are also periodic. For periodic data, the distance between the two is equal, and the distance between them in two dimensions is also equal, so the local density must be equal; by determining the period of the train log data as mentioned above, the normal points and abnormal points that conform to the period are obtained through initial screening of the period; among these normal points, they may not be truly normal points, but just indicate that the data after transmission conforms to the transmission period, so this batch of data points needs to be monitored for abnormalities.

[0072] When the train is running, the log data of the train is continuous and smooth, so the local density is equal. The LOF algorithm is used for abnormal monitoring. It is assumed that some of the data to be warned also show good density properties, which makes it difficult to distinguish the warning. Therefore, it is necessary to perform feature analysis on this batch of data and then correct the k-local anomaly factor to improve the accuracy of anomaly monitoring.

[0073] To explain the above description in detail, preferably, in step S2, the LOF algorithm is periodically used to perform preliminary screening based on the collected data to obtain normal points and abnormal points, including:

[0074] Based on the collected data, feature analysis is performed, and the time corresponding to the transmitted time data is periodically obtained. All collected times are defined as the horizontal and vertical coordinates to establish a two-dimensional coordinate system. The LOF algorithm is used based on the two-dimensional coordinate system to obtain the k-local anomaly factor of each moment. The normal points and abnormal points are initially screened according to the k-local anomaly factor.

[0075] To explain, feature analysis refers to the multi-dimensional exploration and interpretation of data, with the aim of revealing the potential correlations between data and their inherent regularities. Through analysis, we can accurately understand the connotation of the data and extract valuable information from it to ensure the efficiency and practicality of the analysis results.

[0076] k-Local Outlier Factor, k-LOF for short, is an algorithm used to detect outliers in data mining. It mainly determines whether it is an outlier by analyzing the local density of each point in the data set. The k-LOF algorithm is based on the local outlier factor algorithm and introduces the parameter k for improvement. Specifically, the parameter k represents the size of the neighborhood of a data point, that is, the set of k data points closest to the point. In practical applications, the k-LOF algorithm is usually used in combination with other anomaly detection methods to improve the accuracy and robustness of anomaly detection.

[0077] Specifically, we first conduct feature analysis on the collected data, that is, we conduct in-depth feature analysis on the log data of train operation; the train position, speed, and acceleration transmitted in real time in the train communication network, in order to timely optimize the operation efficiency of the train and improve the efficiency and reliability of the entire transportation system, the collection interval of these log data has obvious periodicity, so all data moments obtained through transmission will also show periodic characteristics.

[0078] Then all the transmitted data moments are regarded as a two-dimensional data set with time as the horizontal and vertical coordinates. It can be shown that the LOF algorithm responds better to multi-dimensional data; for periodic data, the distance on the time coordinate should be equal, and the distance on the two-dimensional coordinate should also be equal, so the local density must also be equal; therefore, the LOF algorithm is used to calculate the k-local anomaly factor at each moment, and its tendency to 1 indicates a normal point. Conversely, points with more values ​​less than 1 and dense points and discrete points with more values ​​greater than 1 are all abnormal points; thus, normal points and abnormal points can be accurately identified, the operating efficiency can be optimized, and the efficiency and reliability of the entire transportation system can be improved.

[0079] To explain, local density refers to the number of individuals per unit area or unit volume in a certain area.

[0080] Preferably, the time corresponding to the transmitted time data is periodically obtained, and the calculation formula of the period is:

[0081]

[0082] in, Indicates the period of data collection; Indicates that after transmission, there are Time data; Indicated by natural constant An exponential function with base ; Indicates k-local anomaly factor of the data at each moment; Indicates the transmission The time corresponding to the moment data; Indicates the transmission The time corresponding to the moment data; Indicates the transmission The time corresponding to the moment data.

[0083] It can be explained that for a normal train log data cycle, the cycle is equal to all data on both sides. However, it is possible that an abnormal signal was transmitted, resulting in inaccurate selection of the average time difference on both sides of some data. Therefore, it is necessary to use the average time difference between all data points and both sides to calculate the period. Different weights need to be added to obtain the log data period. Normal points contribute more to the period. By weighting, the result of the period calculation is more stable and reliable. It should be noted that under normal circumstances, There is no possibility of being zero. If there is an extreme case, add a constant 0.01 after the denominator of the fraction, which can avoid the situation where the denominator of the fraction is zero.

[0084] Preferably, the normal points and abnormal points obtained by initial screening include:

[0085] Based on the time data, the corresponding period anomaly degree is obtained, and the calculation formula is:

[0086]

[0087] in, Display time data The degree of cycle abnormality; Represents time data; represents the maximum and minimum normalized function; represents the time corresponding to the k-local anomaly factor closest to 1; Represents the period of data collection; k represents the size of the neighborhood in the k-local anomaly factor; min represents the minimum value function.

[0088] Determine whether the periodic abnormality exceeds the preset abnormality threshold. If so, it means that the data at the current moment is an abnormal point; if not, it means that the data at the current moment is a normal point.

[0089] Explanation: For time data For example, assuming that there is an anomaly in its cycle, the distance from all cycle collection points The minimum distance is far, that is, the data point with the k-local anomaly factor closest to 1 is regarded as a point on the cycle, and the cycle is known. , all the collection points that meet the period are obtained, and the above calculation formula is obtained, which is convenient for analyzing and evaluating the periodicity of the moment data.

[0090] Specifically, in this embodiment, the preset abnormality threshold is 0.7. When the degree of cycle abnormality exceeds 0.7, an abnormal point is obtained in the initial screening; otherwise, if the degree of cycle abnormality does not exceed 0.7, it is a normal point; wherein, the preset abnormality threshold can be set by the implementer according to the specific actual situation and is not specifically limited.

[0091] Preferably, in step S2, feature analysis is performed on normal points to determine the probability that the data points conform to the train track, including:

[0092] It is explained that the normal points obtained through preliminary screening only mean that they meet the predetermined transmission cycle during the transmission process, and do not mean that they are normal points. Therefore, the data in the normal points still need to be monitored for abnormalities. This method is implemented in combination with the LOF algorithm abnormal monitoring algorithm. By monitoring abnormal changes in local density, abnormal data points in four-dimensional space, namely time, position, speed, and acceleration, are identified. The ratio of the local reachable density of the data point to the local reachable density of the data in the neighborhood is calculated to determine whether it is an abnormal point. The data are subjected to feature analysis and then corrected by k-local anomaly factor, thereby improving the accuracy of abnormal monitoring.

[0093] Understandably, there is an inherent correlation between the position, speed and acceleration in the train log data. The data collected by real-time monitoring is collected at very small intervals. First, the data at adjacent time points are estimated based on speed and acceleration. By comparing the position data between the two places and combining the preset train route, the actual track distance between the two places is calculated with the help of engineering drawings to verify whether it meets the established running track probability. During the train operation, if special circumstances such as turning are encountered, the estimated track distance may deviate. In this setting, if it is assumed that the track distance in the time periods on both sides also meets the established standards, even if there is a deviation between the actual track and the estimated track, it can still be determined that it meets the track distance requirements. In order to improve accuracy, the track probability in adjacent time periods is used for correction to correct and confirm whether the train track at each time point meets the preset standards, and the train track compliance probability at each time point is obtained to ensure the accuracy and safety of train operation.

[0094] Step S21: Performing feature analysis on normal points to determine the probability that the data points conform to the train track, including:

[0095] Based on the speed and acceleration of the train at the current time, the distance traveled by the train at the next time is estimated. The corresponding calculation formula is:

[0096]

[0097] in, Indicates the current time The velocity and acceleration are estimated to the adjacent time the distance travelled; Indicates the current time The speed of the train; Indicates the current time The acceleration of the train; represents the integration variable.

[0098] It is explained that when the acceleration remains constant, that is, the data interval collected by real-time monitoring is small enough to ensure that the train runs smoothly and there is no sudden braking or other situations that cause sudden changes in acceleration, the area of ​​the graph enclosed by speed and time is exactly equivalent to the distance the object moves.

[0099] Step S22: Based on The probability of the train running track from the current time to the adjacent time is obtained, and the corresponding calculation formula is:

[0100]

[0101] in, Indicates the current time To the adjacent time Probability of conforming to the train running trajectory; Indicates the current time To the adjacent time the distance travelled; Represents a hyperparameter.

[0102] Explanation: Trains follow a set route. If GPS is used to accurately locate the train at the current time, With adjacent moments The actual distance traveled by the train can be calculated based on the established route. The smaller the deviation between the actual distance traveled and the estimated distance traveled, the higher the degree of conformity between the train trajectory and the preset trajectory, and the two are inversely proportional. It is used to avoid the situation where the denominator of the fraction is zero. It can be set to 0.01. The implementer can set the size of the hyperparameter according to the actual situation.

[0103] Step S23: Based on The correction is performed to obtain the probability that the data point conforms to the correction of the train running trajectory. The corresponding calculation formula is:

[0104]

[0105] in, Indicates the current time To the adjacent time The probability that the data point conforms to the train trajectory correction; Indicates adjacent time To the current time Probability of conforming to the train running trajectory; Indicates adjacent time To the adjacent time The probability of the train running trajectory being met.

[0106] It is explained that for the train running trajectory, it moves in accordance with the established lines and operating specifications. Within a given time period, the movement of the train should be continuous and uninterrupted; if the train accidentally deviates from the preset trajectory at a certain moment, then its trajectory status may not be consistent with expectations in the time periods on both sides of that moment; based on this, it is assumed that the train running trajectory meets the requirements in the adjacent time periods on both sides, and it is inferred that the train operation in this specific time period should also comply with the established trajectory; and then the compliance probability of the train running trajectory in the adjacent time periods will be used to correct possible deviations to improve the compliance of the overall running trajectory.

[0107] Step S24: Based on Get the current time The probability that a data point conforms to the train track is calculated as:

[0108]

[0109] in, Indicates the current time The probability that a data point fits the train trajectory; represents the maximum and minimum normalized function; Indicates adjacent time To the current time The probability that the data point conforms to the train trajectory correction; Indicates adjacent time To the current time time interval; Indicates adjacent time To the current time time interval; Indicates the current time To the adjacent time time interval; Indicates adjacent time To the adjacent time time interval.

[0110] To explain, the above formula is to find the probability of the train trajectory in a time period, but a data point is in two time periods, so it is necessary to use the probability of the two time periods to find it, according to the time period distance to the current time The closer the distance, the greater the contribution of the probability value.

[0111] Preferably, in step S2, correction is performed according to the probability of the train trajectory, including:

[0112] It is explained that the data points in the k-neighborhood of the data are weighted by the above formula, so that the data points that are more consistent with the trajectory probability have a greater impact on the k-local anomaly factor, and the data points that are inconsistent with the trajectory probability have a smaller impact on the k-local anomaly factor. This setting can prevent those data points that should be warned from being misjudged as normal due to their good density properties, and effectively avoid potential confusion and omissions in the LOF anomaly monitoring algorithm during the distinction and warning process.

[0113] According to the probability of train trajectory, the k-local anomaly factor is corrected, and the corresponding calculation formula is:

[0114]

[0115] in, Represents data points Modified k-local anomaly factor; express sample size of the distance neighborhood; express Points within the distance neighborhood ; express Points within the distance neighborhood The k-reachable density of Represents data points The k-reachable density of express Points within the distance neighborhood Probability of matching the train trajectory; express The distance within the neighborhood The probability that a point fits the train trajectory.

[0116] Explain that the LOF anomaly detection algorithm is used to find data points The k-local anomaly factor for The k-reachable density of all points in the k-neighborhood of a point is weighted so that the weighted result is more consistent with the consideration of trajectory probability. This weighted operation aims to increase the weights of points that have a more significant impact on the k-local anomaly factor, ensuring the accuracy and rationality of anomaly assessment.

[0117] Preferably, in step S2, the weighted LOF algorithm is used to obtain abnormal points within normal points in the initial screening process, including:

[0118] Determine data points based on weighting based on k-reachable density The normal degree of , the corresponding calculation formula is:

[0119]

[0120] in, Represents data points degree of normality; Indicated by natural constant An exponential function with base ; Represents data points Modified k-local outlier factor.

[0121] judge Whether it exceeds the preset threshold, if so, it means that the current data point is a normal point within the normal points; if not, it means that the current data point is an abnormal point within the normal points.

[0122] It is explained that for normal points, the corrected k-local anomaly factor value tends to 1. If the data points are over-dense, their k-local anomaly factor is less than 1. On the contrary, if the data points are over-dispersed, their k-local anomaly factor is greater than 1. The closer the k-local anomaly factor value is to 1, the higher the normality of the data point.

[0123] Specifically, in this embodiment, the preset threshold is 0.7. The normal degree of the data point is more than 0.7, indicating that the normal point obtained by the initial screening is a real normal point; on the contrary, if the data point The normality of the data point does not exceed 0.7. It is the abnormal point among the normal points in the initial screening; among them, the preset threshold value can be set by the implementer according to the specific actual situation and is not specifically limited.

[0124] Preferably, step S3 includes:

[0125] Obtain safety warning measures, identify potential problems based on abnormal points obtained from the initial screening and / or abnormal points within normal points during the initial screening process, and notify operation and maintenance personnel to perform maintenance; if abnormal points obtained from the initial screening and / or abnormal points within normal points during the initial screening process appear continuously, take safety warning measures to issue a safety warning.

[0126] It is explained that in order to ensure the effective operation of the safety monitoring system, potential problems are identified based on the abnormal points obtained in the initial screening and / or the abnormal points within the normal points during the initial screening process, and the operation and maintenance personnel need to be notified for maintenance. At this time, it means that the train can still ensure safe operation. After the train stops running, the operation and maintenance personnel are notified to inspect the train to ensure the safety of train operation; when these abnormal points appear continuously, there is a warning signal, and the safety early warning mechanism is activated to minimize potential injuries and losses; and through this early warning mechanism, the ability to respond to emergencies can be improved to ensure the safety of personnel and property.

[0127] Understandably, for the abnormal monitoring of the collected data after transmission, two LOF algorithm analyses were used. The first was to combine periodic analysis to initially screen normal points and abnormal points. This step is conducive to the subsequent concise and clear analysis of the data. The second was to further analyze the characteristics of the normal points that have passed the initial screening, and correct the k-local anomaly factor, avoiding the situation where data points that should have been warned were not detected due to their good density properties. The LOF anomaly monitoring technology can be used more accurately for early warning, that is, the k-local anomaly factor of each data point of the corrected LOF algorithm can be used to more accurately monitor data anomalies, avoid false warnings, and improve the accuracy of judgments.

[0128] An embodiment of the present invention provides a network security early warning device for a train communication network, comprising the following units:

[0129] The collection unit is used to: formulate a collection plan, and obtain corresponding information of the train based on the collection plan to obtain collected data;

[0130] The data processing unit is used to: periodically use the LOF algorithm to perform preliminary screening based on the collected data to obtain normal points and abnormal points, perform feature analysis on the normal points to determine the probability that the data points conform to the train trajectory, make corrections based on the probability of the train trajectory, and weight the abnormal points within the normal points in the preliminary screening process through the LOF algorithm;

[0131] The early warning unit is used to: issue a safety early warning based on abnormal points obtained during the initial screening and / or abnormal points within normal points during the initial screening process.

[0132] It can be understood that when a unit of a network security warning device for a train communication network is in operation, it is necessary to utilize a network security warning method for a train communication network provided in the first embodiment. Therefore, whether the collection unit, the data processing unit and the warning unit are integrated or different hardware is configured to produce functions similar to the effects achieved by the present invention, they all fall within the scope of protection of the present invention.

[0133] Specifically, first, the corresponding information of the train is obtained by the acquisition unit based on the acquisition plan to obtain the collected data, which provides a basis for subsequent data processing; then, the data processing unit is combined with the LOF abnormality monitoring algorithm to obtain the abnormal points of the initial screening and the abnormal points within the normal points in the initial screening, so as to improve the accuracy of abnormality monitoring; then, when these two data points appear in a continuous state, a safety warning is issued, and data abnormality monitoring is performed more accurately, which effectively prevents the situation of false warning, improves the accuracy of judgment, and ensures the safe operation of the train.

[0134] It should be noted that the sequence of the above embodiments of the present invention is only for description and does not represent the advantages and disadvantages of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0135] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

Claims

1. A network security early warning method for train communication network, characterized in that: The method comprises: Formulate a collection plan, and obtain the corresponding information of the train based on the collection plan to obtain the collected data; Based on the collected data, the LOF algorithm is periodically used to perform preliminary screening to obtain normal points and abnormal points. The normal points are analyzed for characteristics to determine the probability that the data points conform to the train trajectory. Corrections are made based on the probability of the train trajectory, and the abnormal points within the normal points in the preliminary screening process are obtained by weighting the LOF algorithm. A safety warning is issued based on abnormal points obtained from the initial screening and / or abnormal points within normal points during the initial screening process.

2. A network security early warning method for a train communication network as claimed in claim 1, characterized in that: Formulate a collection plan, and obtain the corresponding information of the train based on the collection plan to obtain the collected data, including: The acquisition solution includes GPS, receivers and track sensors; Use GPS to obtain the longitude and latitude information of the train through the receiver to obtain the train's location information; use the track sensor to obtain the speed and acceleration of the train; Based on the position information, speed and acceleration of the train, the log data of the train is periodically collected and transmitted to obtain the collected data.

3. A network security early warning method for a train communication network as claimed in claim 2, characterized in that: Based on the collected data, the LOF algorithm is periodically used for initial screening to obtain normal points and abnormal points, including: Based on the collected data, feature analysis is performed, and the time corresponding to the transmitted time data is periodically obtained. All collected times are defined as the horizontal and vertical coordinates to establish a two-dimensional coordinate system. The LOF algorithm is used based on the two-dimensional coordinate system to obtain the k-local anomaly factor of each moment. The normal points and abnormal points are initially screened according to the k-local anomaly factor.

4. A network security early warning method for a train communication network as claimed in claim 3, characterized in that: The time corresponding to the transmitted time data is periodically obtained. The calculation formula for the period is: in, Indicates the period of data collection; Indicates that after transmission, there are Time data; Indicated by natural constant An exponential function with base ; Indicates k-local anomaly factor of the data at each moment; Indicates the transmission The time corresponding to the moment data; Indicates the transmission The time corresponding to the moment data; Indicates the transmission The time corresponding to the moment data.

5. A network security early warning method for train communication network as claimed in claim 4, characterized in that: The initial screening yielded normal and abnormal points, including: Based on the time data, the corresponding period anomaly degree is obtained, and the calculation formula is: in, Display time data The degree of cycle abnormality; Represents time data; represents the maximum and minimum normalized function; represents the time corresponding to the k-local anomaly factor closest to 1; represents the period of data collection; k represents the size of the neighborhood in the k-local anomaly factor; min represents the minimum value function; Determine whether the periodic abnormality exceeds the preset abnormality threshold. If so, it means that the data at the current moment is an abnormal point; if not, it means that the data at the current moment is a normal point.

6. A network security early warning method for train communication network as claimed in claim 3, characterized in that: Perform feature analysis on normal points to determine the probability that the data point conforms to the train track, including: Based on the speed and acceleration of the train at the current time, the distance traveled by the train at the next time is estimated. The corresponding calculation formula is: in, Indicates the current time The velocity and acceleration are estimated to the adjacent time the distance travelled; Indicates the current time The speed of the train; Indicates the current time The acceleration of the train; represents the integral variable; based on The probability of the train running track from the current time to the adjacent time is obtained, and the corresponding calculation formula is: in, Indicates the current time To the adjacent time Probability of conforming to the train running trajectory; Indicates the current time To the adjacent time the distance travelled; represents a hyperparameter; based on The correction is performed to obtain the probability that the data point conforms to the correction of the train running trajectory. The corresponding calculation formula is: in, Indicates the current time To the adjacent time The probability that the data point conforms to the train trajectory correction; Indicates adjacent time To the current time Probability of conforming to the train running trajectory; Indicates adjacent time To the adjacent time Probability of conforming to the train running trajectory; based on Get the current time The probability that a data point conforms to the train track is calculated as: in, Indicates the current time The probability that a data point fits the train trajectory; represents the maximum and minimum normalized function; Indicates adjacent time To the current time The probability that the data point conforms to the train trajectory correction; Indicates adjacent time To the current time time interval; Indicates adjacent time To the current time time interval; Indicates the current time To the adjacent time time interval; Indicates adjacent time To the adjacent time time interval.

7. A network security early warning method for a train communication network as claimed in claim 6, characterized in that: Corrections are made based on the probability of the train trajectory, including: According to the probability of train trajectory, the k-local anomaly factor is corrected, and the corresponding calculation formula is: in, Represents data points Modified k-local anomaly factor; express sample size of the distance neighborhood; express Points within the distance neighborhood ; express Points within the distance neighborhood The k-reachable density of Represents data points The k-reachable density of express Points within the distance neighborhood Probability of matching the train trajectory; express The distance within the neighborhood The probability that a point fits the train trajectory.

8. A network security early warning method for a train communication network as claimed in claim 7, characterized in that: And the weighted LOF algorithm is used to obtain abnormal points within the normal points in the initial screening process, including: Determine data points based on weighting based on k-reachable density The normal degree of , the corresponding calculation formula is: in, Represents data points degree of normality; Indicated by natural constant An exponential function with base ; Represents data points Modified k-local anomaly factor; judge Whether it exceeds the preset threshold, if so, it means that the current data point is a normal point within the normal points; if not, it means that the current data point is an abnormal point within the normal points.

9. A network security early warning method for train communication network as claimed in claim 1, characterized in that: Safety warnings are issued based on abnormal points obtained from the initial screening and / or abnormal points within normal points during the initial screening process, including: Obtain safety warning measures, identify potential problems based on abnormal points obtained from the initial screening and / or abnormal points within normal points during the initial screening process, and notify operation and maintenance personnel to perform maintenance; if abnormal points obtained from the initial screening and / or abnormal points within normal points during the initial screening process appear continuously, take safety warning measures to issue a safety warning.

10. A network security early warning device for train communication network, characterized in that: The following units are included: The collection unit is used to: formulate a collection plan, and obtain corresponding information of the train based on the collection plan to obtain collected data; The data processing unit is used to: periodically use the LOF algorithm to perform preliminary screening based on the collected data to obtain normal points and abnormal points, perform feature analysis on the normal points to determine the probability that the data points conform to the train trajectory, make corrections based on the probability of the train trajectory, and weight the abnormal points within the normal points in the preliminary screening process through the LOF algorithm; The early warning unit is used to: issue a safety early warning based on abnormal points obtained during the initial screening and / or abnormal points within normal points during the initial screening process.

Images