Abnormal event monitoring method for rail transit train control equipment

Abstract

The invention discloses an abnormal event monitoring method for rail transit train control equipment, and the method comprises the following steps: 1, carrying out the monitoring preparation stage, and carrying out the system deployment and network architecture construction; step 2; in the data acquisition and transmission stage, various parameters of the train control equipment are acquired in real time by using a sensor, and the acquired data are transmitted to a monitoring center through a communication network; 3, a data analysis and processing stage: carrying out data preprocessing, anomaly detection and early warning and response; step 4; and in the summarization and improvement stage, event summarization, system optimization, training and education are carried out. The information safety level of the rail transit system can be effectively improved, and the life and property safety of passengers is guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of data security protection, and in particular to a method for monitoring abnormal events of rail transit train control equipment. Background Art

[0002] With the rapid development and widespread application of urban rail transit systems, the information security issues of train control equipment, as a core component, are becoming increasingly prominent. Once the train control equipment suffers from abnormal information security incidents (such as hacker attacks, virus invasions, etc.), it may cause the train operation control to fail and cause serious safety accidents. Therefore, real-time monitoring and early warning of abnormal information security incidents of train control equipment are of great significance to ensure the safety of rail transit systems; In the process of monitoring abnormal information security events in urban rail transit train control equipment, the abnormal event monitoring method will be used.

[0003] The existing abnormal event monitoring method has single monitoring data and cannot well guarantee the data information security of rail transit train control equipment, which has a certain impact on the use of the abnormal event monitoring method. Therefore, an abnormal event monitoring method for rail transit train control equipment is proposed. Summary of the invention

[0004] The technical problem to be solved by the present invention is: how to solve the problem that the existing abnormal event monitoring method has a single monitoring data and cannot well guarantee the data information security of rail transit train control equipment, which has brought certain impacts on the use of the abnormal event monitoring method. A method for abnormal event monitoring of rail transit train control equipment is provided.

[0005] The present invention solves the above technical problems through the following technical solutions, and the present invention comprises the following steps: Step 1: Monitoring preparation phase, system deployment and network architecture construction; Step 2: Data collection and transmission stage: sensors are used to collect various parameters of train control equipment in real time, and the collected data are transmitted to the monitoring center through the communication network; Step 3: Data analysis and processing stage, data preprocessing, anomaly detection, early warning and response; Step 4: Summary and improvement phase, conduct event summary, system optimization, training and education.

[0006] Furthermore, the specific process of the system deployment is as follows: Install sensors and data acquisition devices: Sensors: Install sensors at locations on train control equipment where abnormal events need to be monitored, including temperature sensors, vibration sensors, and current and voltage sensors, to monitor the physical status and operating parameters of the equipment in real time; Data acquisition device: Deploy the data acquisition unit, which is responsible for receiving data from sensors and performing preliminary processing and conversion; Configure the security monitoring and early warning system: Monitoring parameter setting: According to the characteristics and safety requirements of the train control equipment, set the specific parameters that need to be monitored, including temperature range, vibration frequency and current and voltage thresholds; Warning threshold: Set reasonable warning thresholds for each monitoring parameter. When the parameter value exceeds or falls below these thresholds, the system will trigger the alarm mechanism; Alarm rules: Develop detailed alarm rules to clearly define what level of alarm signal should be issued under what circumstances, as well as the alarm signal processing process and responsible persons.

[0007] Furthermore, the specific process of the network architecture construction is as follows: First, build a communication network, including wired network and wireless network: Wired network: Use optical fiber media to build a stable communication link between train control equipment and monitoring center; Wireless network: Use wireless communication technology to transmit data in areas where wired networks cannot be laid; Redundancy design: set up dual network redundancy or multi-path transmission; After that, deploy network security equipment: Firewall: Firewalls are deployed at the border of the communication network to filter and inspect data packets entering and leaving the network; Intrusion detection system: deploy an intrusion detection system to monitor network traffic in real time, analyze potential intrusion behaviors, and issue alarms; Encryption technology: Encrypt sensitive data; Access Control: Implement access control policies to limit access to train control equipment and monitoring systems.

[0008] Furthermore, in the process of encrypting the sensitive data, the encryption method used is one or a combination of symmetric encryption, asymmetric encryption and hybrid encryption.

[0009] Furthermore, the specific process of data collection is as follows: Parameter collection: Use sensors to collect the physical parameters of train control equipment in real time, including temperature, vibration, current and voltage; Monitor components inside the equipment, including circuit boards and power modules, and analyze whether they are operating abnormally, overheating or short circuiting; Conduct security status monitoring, monitor system logs, and record various events and errors generated during equipment operation; Monitor abnormal access records, including unauthorized login attempts and malware attacks; Data integration: Integrate the collected parameters and safety status information to form an equipment operation status report.

[0010] Furthermore, the specific process of data transmission is as follows: First, select the communication network, then use encryption technology to encrypt sensitive data, and use the hash function algorithm to check the integrity of the data during data transmission. After receiving the data, the receiver can verify the integrity of the data through the verification algorithm; At the same time, security measures are strengthened, firewalls or intrusion detection systems are deployed, and real-time monitoring and protection of data during transmission are performed; Perform redundant backup: Use a redundant backup strategy to back up data to multiple storage media or servers.

[0011] Furthermore, the data preprocessing specifically includes: Data cleaning: remove duplicate data, handle missing values, and correct erroneous data; Denoising: reducing or removing noise from data; Formatting: converting data into the required data format; Feature extraction: extract the required features from the preprocessed data Further, the specific process of anomaly detection is as follows: Algorithm application: Use statistics, data mining or machine learning algorithms to conduct in-depth analysis of the processed data and analyze abnormal patterns in the data, including data points that deviate from the normal distribution and isolated points outside the cluster; Anomaly identification: Based on the analysis results of the algorithm, possible abnormal information security events are identified, including illegal access attempts, signs of data leakage, and malware attacks.

[0012] Furthermore, the specific process of early warning and response is as follows: Early warning mechanism: Once abnormal behavior or patterns are detected, the early warning mechanism is triggered immediately, including sending early warning information to relevant personnel; Emergency response plan: Develop an emergency response plan based on the urgency and impact of the warning information, including determining response priorities, allocating resources, and developing disposal plans; Implementation of measures: Take corresponding measures according to the emergency response plan, including isolating the affected systems, restoring data backups, investigating the cause of the anomaly and strengthening security protection.

[0013] Furthermore, the specific contents of the event summary include: Root cause and vulnerability analysis: Analyze abnormal information security incidents and find out the root cause of the incident; Identify gaps or weaknesses in systems, processes or people operations; Impact assessment: Assess the scope and extent of the incident’s impact on system security, including the affected system components, the risk of data leakage, and the duration of business interruption; Analyze the possible long-term impact of the incident, including the loss of user trust; Improvement measures and suggestions: Based on event analysis and impact assessment, put forward specific improvement measures and suggestions.

[0014] Compared with the prior art, the present invention has the following advantages: the abnormal event monitoring method of rail transit train control equipment, abnormal information security event monitoring of rail transit train control equipment is a continuous process, which needs to be achieved through close cooperation and collaboration of multiple links such as system deployment, data collection and transmission, data analysis and processing, and summary and improvement; Through the above system deployment and network architecture construction, a solid foundation and guarantee can be provided for monitoring abnormal information security events of rail transit train control equipment. At the same time, the system needs to be regularly maintained and upgraded to ensure its continuous and effective operation; The data collection and transmission stage is a crucial link in the process of train control equipment monitoring. Through scientific and reasonable data collection and transmission strategies, the accuracy, integrity and security of monitoring data can be ensured, providing strong support for subsequent data analysis and decision-making; The data analysis and processing stage is the key link to ensure that the monitoring data of train control equipment can be converted into valuable information and effectively utilized. Through the organic combination of data preprocessing, anomaly detection, early warning and response steps, potential information security threats and system failures can be discovered and responded to in a timely manner to ensure the safety and stability of train operation; The system's security protection system can be continuously improved, the ability to respond to abnormal information security incidents can be enhanced, the stable operation of the system and the security and reliability of data can be ensured, making this method more worthy of promotion and use. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 It is the overall flow chart of the present invention. DETAILED DESCRIPTION

[0016] The following is a detailed description of an embodiment of the present invention. This embodiment is implemented on the premise of the technical solution of the present invention, and a detailed implementation method and a specific operation process are given, but the protection scope of the present invention is not limited to the following embodiment.

[0017] like Figure 1 As shown, this embodiment provides a technical solution: a method for monitoring abnormal events of a rail transit train control device, comprising the following steps: Step 1: Monitoring preparation phase, system deployment and network architecture construction; Monitoring preparation stage In the preparation stage of monitoring abnormal information security incidents of rail transit train control equipment, system deployment and network architecture construction are two crucial links. The following is a detailed description of these two links: System deployment 1. Install sensors and data acquisition devices: Sensors: Sensors are installed at key locations of train control equipment, such as temperature sensors, vibration sensors, current and voltage sensors, etc., to monitor the physical status and operating parameters of the equipment in real time.

[0018] Data acquisition device: Deploy data acquisition units (such as data acquisition cards, PLCs, etc.), which are responsible for receiving data from sensors and performing preliminary processing and conversion for subsequent analysis and transmission.

[0019] 2. Configure security monitoring and early warning system: Monitoring parameter setting: According to the characteristics and safety requirements of the train control equipment, set the specific parameters that need to be monitored, such as temperature range, vibration frequency, current and voltage thresholds, etc.

[0020] Warning threshold: Set reasonable warning thresholds for each monitoring parameter. When the parameter value exceeds or falls below these thresholds, the system will trigger the warning mechanism.

[0021] Alarm rules: Develop detailed alarm rules to clearly define what level of alarm signal should be issued under what circumstances, as well as the alarm signal processing process and responsible persons.

[0022] Network architecture construction Building a communication network: Wired network: Use wired media such as optical fiber and twisted pair to build a stable communication link between train control equipment and the monitoring center.

[0023] Wireless network (if applicable): In areas where wired networks cannot be laid, consider using wireless communication technologies (such as Wi-Fi, LTE-R, etc.) for data transmission.

[0024] Redundant design: In order to improve the reliability and stability of the communication network, redundant design is adopted, such as dual network redundancy and multi-path transmission.

[0025] Deployment of network security equipment: Firewall: Firewalls are deployed at the boundaries of communication networks to filter and inspect data packets entering and leaving the network to prevent illegal access and malicious attacks.

[0026] Intrusion Detection System (IDS): Deploy an intrusion detection system to monitor network traffic in real time, analyze potential intrusion behaviors, and issue alerts in a timely manner.

[0027] Encryption technology: Encrypt sensitive data to ensure confidentiality and integrity during data transmission.

[0028] Access Control: Implement strict access control policies to limit access to train control equipment and monitoring systems to prevent unauthorized access.

[0029] Through the above system deployment and network architecture construction, a solid foundation and guarantee can be provided for the monitoring of abnormal information security events of rail transit train control equipment. At the same time, the system needs to be regularly maintained and upgraded to ensure its continuous and effective operation.

[0030] Step 2: Data collection and transmission stage: sensors are used to collect various parameters of train control equipment in real time, and the collected data are transmitted to the monitoring center through the communication network; Data collection Data collection is the first step in the monitoring process. Its core is to use sensors and other monitoring equipment to obtain various parameters and safety status information of train control equipment in real time and accurately. Specifically, it includes the following aspects: Parameter collection: Sensors are used to collect the physical parameters of train control equipment in real time, including temperature, vibration, current, and voltage. These parameters directly reflect the operating status and performance of the equipment and are an important basis for evaluating the health of the equipment.

[0031] Monitor key components inside the equipment, such as circuit boards, power modules, etc., to ensure that they are working properly without abnormal conditions such as overheating and short circuits.

[0032] Security status monitoring: Monitor system logs and record various events and errors generated during equipment operation to promptly detect and handle potential security issues.

[0033] Monitor abnormal access records, such as unauthorized login attempts, malware attacks, etc., to ensure that devices are protected from network attacks and illegal access threats.

[0034] Data integration: Integrate the collected parameters and safety status information to form a comprehensive equipment operation status report. These reports can serve as the basis for subsequent analysis and decision-making.

[0035] Data Transfer Data transmission is the process of transmitting the collected data from the train control equipment to the monitoring center. In this process, the integrity, confidentiality and availability of the data need to be ensured. The specific measures are as follows: Communication network selection: Build a stable and reliable communication network to ensure the continuity and real-time performance of data transmission. You can choose a wired network (such as optical fiber, twisted pair, etc.) or a wireless network (such as LTE-R, Wi-Fi, etc.) as the transmission medium.

[0036] Application of encryption technology: Use encryption technology to encrypt sensitive data to prevent data from being stolen or tampered with during transmission. Common encryption technologies include symmetric encryption (such as AES) and asymmetric encryption (such as RSA). Encryption technology can ensure the confidentiality and integrity of data.

[0037] Data integrity verification: During data transmission, hash functions and other algorithms are used to verify the integrity of the data. After receiving the data, the receiver can verify the integrity of the data through the verification algorithm to ensure that the data has not been tampered with during transmission.

[0038] Strengthen security measures: deploy network security equipment such as firewalls and intrusion detection systems to monitor and protect data in real time during transmission. These devices can detect and block potential network security threats in a timely manner and protect the security of the data transmission process.

[0039] Redundant backup: To ensure data availability, a redundant backup strategy can be adopted. Important data can be backed up to multiple storage media or servers to prevent data loss or damage from affecting monitoring work.

[0040] In summary, data collection and transmission are crucial links in the process of train control equipment monitoring. Through scientific and reasonable data collection and transmission strategies, the accuracy, integrity and security of monitoring data can be ensured, providing strong support for subsequent data analysis and decision-making.

[0041] Step 3: Data analysis and processing stage, data preprocessing, anomaly detection, early warning and response; The data analysis and processing phase is a key step to ensure that the data obtained from the data collection and transmission phase can be converted into valuable information. In this phase, the main tasks are to pre-process the data, detect anomalies, and establish early warning and response mechanisms. The following is a detailed explanation of these steps: Data preprocessing Data preprocessing is a prerequisite for data analysis, which aims to improve data quality and provide an accurate and reliable data foundation for subsequent analysis.

[0042] Data cleaning: remove duplicate data, process missing values ​​(such as through interpolation, deletion or marking), correct erroneous data, etc., to ensure data integrity and consistency.

[0043] Denoising: Reducing or eliminating noise (i.e. random errors or interference) in data to improve the accuracy and reliability of the data. This can be achieved through smoothing techniques, filtering algorithms, etc.

[0044] Formatting: Converting data into a form suitable for analysis, such as unifying data format, adjusting data structure, standardizing or normalizing data, etc., for subsequent processing and analysis.

[0045] Feature extraction: Extract key features from preprocessed data. These features can reflect the essential characteristics and potential laws of the data, providing strong support for subsequent analysis and prediction.

[0046] Anomaly Detection Anomaly detection is an important part of data analytics, which aims to identify unusual behaviors or patterns in data that may indicate potential information security incidents or system failures.

[0047] Algorithm application: Use statistics, data mining and machine learning algorithms to conduct in-depth analysis of the processed data. These algorithms can automatically discover abnormal patterns in the data, such as data points that deviate from the normal distribution, isolated points outside the cluster, etc.

[0048] Abnormal identification: Based on the analysis results of the algorithm, possible abnormal information security events are identified, such as illegal access attempts, signs of data leakage, malware attacks, etc. These abnormal events may pose a threat to the security and stability of the system.

[0049] Early warning and response The early warning and response mechanism is the key to ensuring that abnormal events can be discovered in a timely manner and handled effectively.

[0050] Early warning mechanism: Once abnormal behavior or patterns are detected, the early warning mechanism is triggered immediately. This includes sending early warning information (such as email, SMS, instant message, etc.) to relevant personnel so that they can understand the abnormal situation in time and take corresponding measures.

[0051] Emergency response plan: According to the urgency and impact of the warning information, formulate a corresponding emergency response plan. This includes determining response priorities, allocating resources, formulating disposal plans, etc., to ensure that abnormal events can be handled quickly and effectively.

[0052] Implementation of measures: Take necessary measures in accordance with the emergency response plan. This may include isolating the affected system, restoring data backup, investigating the cause of the abnormality, strengthening security protection, etc., to prevent the abnormal incident from spreading further and reduce its impact.

[0053] In summary, the data analysis and processing stage is the key link to ensure that the monitoring data of train control equipment can be converted into valuable information and effectively utilized. Through the organic combination of data preprocessing, anomaly detection, and early warning and response steps, potential information security threats and system failures can be discovered and responded to in a timely manner, ensuring the safety and stability of train operation.

[0054] Step 4: Summary and improvement phase, conduct event summary, system optimization, training and education; The summary and improvement phase is an important step to ensure that lessons are learned from the incidents that have occurred and to improve system security and response capabilities. The following is a detailed summary and improvement measures for this phase: Event Summary Root cause and vulnerability analysis: Conduct in-depth analysis of abnormal information security incidents that occur, and find out the root cause of the incident through technical investigation, log review, personnel interviews, etc.

[0055] Identify loopholes or weaknesses in systems, processes or people operations that are often the direct cause of an incident.

[0056] Impact assessment: Assess the scope and extent of the incident's impact on system security, including affected system components, risk of data leakage, duration of business interruption, etc.

[0057] Analyze the possible long-term impact of the incident, such as loss of user trust, legal compliance issues, etc.

[0058] Improvement measures and suggestions: Based on the event analysis and impact assessment, specific improvement measures and suggestions are proposed. This may include technical repairs (such as vulnerability patches, system reinforcement), process optimization (such as emergency response processes, monitoring strategy adjustments) and management enhancement (such as authority management, audit system improvement).

[0059] System Optimization Monitoring system upgrade: Based on the summary and analysis results, the existing monitoring system will be optimized and upgraded. This may include introducing more advanced monitoring technologies, adding monitoring points, increasing monitoring frequency, etc., to improve the accuracy and efficiency of monitoring.

[0060] Integrate monitoring data from different sources to achieve cross-system linkage monitoring in order to gain a more comprehensive understanding of the system security status.

[0061] Strengthening network security protection: Strengthening network security protection capabilities, including deploying more powerful firewalls, intrusion detection systems (IDS / IPS), security event management (SIEM) systems, etc.

[0062] Conduct security vulnerability scans and penetration tests regularly to promptly identify and fix potential security risks.

[0063] Implement strict access control and permission management policies to ensure that only authorized personnel can access sensitive data and system resources.

[0064] Training and Education Security training: Regularly conduct security training for relevant personnel, including technical personnel, management personnel, and end users. The training content should cover the latest security threats, defense technologies, emergency response procedures, etc.

[0065] Improve personnel's safety awareness and practical ability through case analysis, simulation exercises and other methods.

[0066] Continuous education: Establish a continuous education mechanism to encourage personnel to continuously learn new safety knowledge and skills. This can be achieved through internal training, external courses, online learning platforms, etc.

[0067] Establish security knowledge sharing sessions or forums to promote communication and cooperation among personnel and jointly improve the organization's security protection level.

[0068] Through the efforts in the summary and improvement stages, we can continuously improve the system's security protection system, enhance the ability to respond to abnormal information security incidents, and ensure the stable operation of the system and the security and reliability of data.

[0069] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0070] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0071] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. A method for monitoring abnormal events of rail transit train control equipment, characterized in that: The following steps are involved: Step 1: Monitoring preparation phase, system deployment and network architecture construction; Step 2: In the data collection and transmission stage, sensors are used to collect various parameters of train control equipment in real time, and the collected data are transmitted to the monitoring center through the communication network; Step 3: Data analysis and processing stage, data preprocessing, anomaly detection, early warning and response; Step 4: During the summary and improvement phase, event summaries, system optimization, and training and education are conducted.

2. The abnormal event monitoring method of a rail transit train control device according to claim 1, characterized in that: The specific process of the system deployment is as follows: Install sensors and data acquisition devices: Sensors: Install sensors at locations on train control equipment where abnormal events need to be monitored, including temperature sensors, vibration sensors, and current and voltage sensors, to monitor the physical status and operating parameters of the equipment in real time; Data acquisition device: Deploy the data acquisition unit, which is responsible for receiving data from sensors and performing preliminary processing and conversion; Configure the security monitoring and early warning system: Monitoring parameter setting: According to the characteristics and safety requirements of the train control equipment, set the specific parameters that need to be monitored, including temperature range, vibration frequency, and current and voltage thresholds; Warning threshold: Set reasonable warning thresholds for each monitoring parameter. When the parameter value exceeds or falls below these thresholds, the system will trigger the alarm mechanism; Alarm rules: Develop detailed alarm rules to clearly define what level of alarm signal should be issued under what circumstances, as well as the alarm signal processing process and responsible persons.

3. The abnormal event monitoring method for rail transit train control equipment according to claim 1 is characterized in that: The specific process of the network architecture construction is as follows: First, build a communication network, including wired network and wireless network: Wired network: Use optical fiber media to build a stable communication link between train control equipment and monitoring center; Wireless network: Use wireless communication technology to transmit data in areas where wired networks cannot be laid; Redundancy design: set up dual network redundancy or multi-path transmission; Then deploy network security equipment: Firewall: Firewalls are deployed at the border of the communication network to filter and inspect data packets entering and leaving the network; Intrusion detection system: deploy an intrusion detection system to monitor network traffic in real time, analyze potential intrusion behaviors, and issue alarms; Encryption technology: Encrypt sensitive data; Access Control: Implement access control policies to limit access to train control equipment and monitoring systems.

4. The abnormal event monitoring method for rail transit train control equipment according to claim 3 is characterized in that: In the process of encrypting the sensitive data, the encryption method used is one or a combination of symmetric encryption, asymmetric encryption and hybrid encryption.

5. The abnormal event monitoring method for rail transit train control equipment according to claim 1 is characterized in that: The specific process of data collection is as follows: Parameter collection: Use sensors to collect the physical parameters of train control equipment in real time, including temperature, vibration, current and voltage; Monitor components inside the equipment, including circuit boards and power modules, and analyze whether they are operating abnormally, overheating or short circuiting; Conduct security status monitoring, monitor system logs, and record various events and errors generated during equipment operation; Monitor abnormal access records, including unauthorized login attempts and malware attacks; Data integration: Integrate the collected parameters and safety status information to form an equipment operation status report.

6. The abnormal event monitoring method for rail transit train control equipment according to claim 1, characterized in that: The specific process of data transmission is as follows: First, select the communication network, then use encryption technology to encrypt sensitive data, and use the hash function algorithm to check the integrity of the data during data transmission. After receiving the data, the receiver can verify the integrity of the data through the verification algorithm; At the same time, security measures are strengthened, firewalls or intrusion detection systems are deployed, and real-time monitoring and protection of data during transmission are performed; Perform redundant backup: Use a redundant backup strategy to back up data to multiple storage media or servers.

7. The abnormal event monitoring method for rail transit train control equipment according to claim 1, characterized in that: The data preprocessing specifically includes: Data cleaning: remove duplicate data, handle missing values, and correct erroneous data; Denoising: reducing or removing noise from data; Formatting: converting data into the required data format; Feature extraction: Extract the required features from the preprocessed data.

8. The abnormal event monitoring method for rail transit train control equipment according to claim 1, characterized in that: The specific process of anomaly detection Ruixian: Algorithm application: Use statistics, data mining or machine learning algorithms to conduct in-depth analysis of the processed data and analyze abnormal patterns in the data, including data points that deviate from the normal distribution and isolated points outside the cluster; Anomaly identification: Based on the analysis results of the algorithm, possible abnormal information security events are identified, including illegal access attempts, signs of data leakage, and malware attacks.

9. The abnormal event monitoring method for rail transit train control equipment according to claim 1, characterized in that: The specific process of early warning and response is as follows: Early warning mechanism: Once abnormal behavior or patterns are detected, the early warning mechanism is triggered immediately, including sending early warning information to relevant personnel; Emergency response plan: Develop an emergency response plan based on the urgency and impact of the warning information, including determining response priorities, allocating resources, and developing disposal plans; Implementation of measures: Take corresponding measures according to the emergency response plan, including isolating the affected systems, restoring data backups, investigating the cause of the anomaly and strengthening security protection.

10. The abnormal event monitoring method of rail transit train control equipment according to claim 1, characterized in that: The specific contents of the incident summary include: Root cause and vulnerability analysis: Analyze abnormal information security incidents and find out the root cause of the incident; Identify gaps or weaknesses in systems, processes or people operations; Impact assessment: Assess the scope and extent of the incident’s impact on system security, including the affected system components, the risk of data leakage, and the duration of business interruption; Analyze the possible long-term impact of the incident, including the loss of user trust; Improvement measures and suggestions: Based on event analysis and impact assessment, put forward specific improvement measures and suggestions.

Images