Network security digital substitute protection method and system

Abstract

The invention relates to the technical field of network security, in particular to a network security digital substitute protection method and system, and the method comprises the following steps: monitoring and recording network activities in real time based on a data stream from a railway network, including an equipment state and communication abnormity, analyzing normal and abnormal network behavior modes through employing an LSTM network, extracting behavior characteristics, and carrying out the protection of the network security digital substitute. And establishing a network virtual copy. According to the invention, by monitoring the data flow of the railway network in real time and recording the equipment state and the communication abnormity, the network security dynamic state is effectively captured, the instant response capability to the abnormal behavior is improved, the LSTM network is utilized to analyze and extract the behavior characteristics of the complex network, the analysis of the complex data mode is enhanced, the efficient identification of unknown threats is ensured, and the security of the network is improved. Through the automatic behavior deviation identification configuration and the emergency response instruction set, potential threats can be quickly and accurately handled, the probability of network security accidents is reduced, efficient risk management is realized, and the security performance of a railway network is greatly improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security digital stand-in protection method and system. Background Art

[0002] Cybersecurity technology focuses on the field of protecting computer systems, networks, and data from unauthorized access, attacks, and destruction. This field covers a wide range of technologies and strategies from physical hardware security to software and data protection, mainly including firewalls, intrusion detection, encryption, and multi-factor authentication, aimed at defending against malware, phishing attacks, network eavesdropping, and various other network threats.

[0003] Among them, the network security digital stand-in protection method is to use digital stand-in technology to directly protect the network security of the railway system. As a real-time protection layer, it can monitor network activities, detect abnormal behaviors, and prevent potential security threats. By creating a digital map of the system, it can continuously analyze data flows and commands to ensure that all operations comply with safety standards, and provide real-time feedback on security incidents, automatically handle security vulnerabilities and attack attempts, thereby refining the defense capabilities of the railway network system and protecting critical operational data from unauthorized access or destruction.

[0004] Most existing technologies rely on static threat databases and preset security rules. Therefore, they are not flexible and fast when fighting against complex attack patterns, especially zero-day attacks or highly customized malware. This security strategy that relies on preset rules also shows obvious shortcomings when facing internal threats or attacks executed through legal authentication means. In a critical infrastructure environment such as the railway network, once a security vulnerability occurs, the consequences can be particularly serious, such as damage to the control system, causing safety accidents and operational interruptions. The lack of predictability and adaptability of existing technologies not only increases maintenance pressure, but also causes security vulnerabilities to be ignored for a long time, increasing the risk of attacks on the railway network. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings of the prior art and to propose a network security digital stand-in protection method and system.

[0006] In order to achieve the above-mentioned purpose, the present invention adopts the following technical solution: a network security digital double protection method, comprising the following steps: S1: Based on the data stream from the railway network, the network activities are monitored and recorded in real time, including equipment status and communication anomalies. The LSTM network is used to analyze normal and abnormal network behavior patterns, extract behavior features, and establish a virtual copy of the network. S2: Based on the network virtual copy, continuously compare the real-time network behavior of the railway, identify the behavior pattern that deviates from the normal by analyzing the simulated data and behavior in the virtual copy, and refine the recognition ability of unknown attacks to generate a behavior deviation recognition configuration; S3: Based on the behavior deviation identification configuration, detect behaviors that conform to abnormal patterns, automatically trigger mandatory access rules for railway network security, restrict or terminate abnormal behaviors, block the spread of potential threats, and generate emergency response instruction sets; S4: According to the emergency response instruction set, an effect evaluation is performed to identify the effectiveness and defects of the response, and the mandatory access rules for railway network security are adjusted according to the identification results to optimize the security of the railway network and generate network protection optimization information.

[0007] The present invention is improved in that the steps of real-time monitoring and recording of network activities are specifically: S111: Based on the data stream from the railway network, extract the equipment status and communication anomaly information, perform preliminary data classification, and generate a preliminary monitoring data set; S112: Analyze the preliminary monitoring data set using the formula: ; Calculate the analysis results of key equipment status and communication anomalies to obtain network activity records, including: Indicates the device status change indicator. Indicates communication abnormality indicators. and is to adjust the weight, and It is a nonlinear adjustment coefficient used to handle the interaction between device status and communication anomalies.

[0008] The present invention is improved in that the steps of obtaining the network virtual copy are specifically as follows: S121: Analyze the network activity data using the LSTM network, identify normal and abnormal network behavior patterns, extract behavior features, and obtain a network feature set; S122: Based on the network feature set, simulate the changes of normal and abnormal behaviors, using the formula: ; Evaluating Virtual Copy Performance , establish a network virtual copy, where, Representative The weight coefficient of each behavior feature, Indicates behavioral characteristics, is the dynamic change rate, is the total number of features.

[0009] The present invention is improved in that the step of identifying the behavior pattern that deviates from the normal is specifically: S211: Based on the network virtual copy, continuously collect real-time network behavior data of the railway, including transmission time, frequency and flow characteristics of data packets, and generate a real-time network behavior data set; S212: Continuously compare the real-time network behavior data set with the simulated data in the virtual copy, using the formula: ; Calculate the similarity and deviation of each behavior feature and generate a deviation behavior tag, where: represents the behavior deviation value, and are the real-time data and the simulated data, respectively. eigenvalues, To adjust the index, is the total number of eigenvalues ​​involved in the comparison; S213: Analyze the deviant behavior mark, combine the feature extraction and pattern recognition technology of the virtual copy, calculate the distance between the cluster center of the marked behavior and the normal behavior, and generate a deviant behavior recognition result.

[0010] The present invention is improved in that the steps of obtaining the behavior deviation identification configuration are specifically as follows: S221: Analyze the identified deviating behavior patterns, evaluate the threats to railway network security for unknown or abnormal attack types, and generate network security threat results; S222: Based on the network security threat results, by simulating potential attack scenarios in a real network environment, the formula is used: ; Calculate the attack recognition rate , we get the behavior deviation identification configuration, where Indicates the number of attacks successfully identified, Indicates the total number of attacks. Represents the weight factor.

[0011] The present invention is improved in that the steps of obtaining the emergency response instruction set are specifically as follows: S311: Based on the behavior deviation identification configuration, detect behaviors that conform to abnormal patterns, including abnormal data packet sending frequency or unauthorized data access requests, record characteristic values ​​and timestamps of associated behaviors, and obtain abnormal behavior characteristic records; S312: Based on the abnormal behavior feature record, match it with the security rules, using the formula: ; Calculate the matching degree between each abnormal behavior and the security rule, and obtain the result matching list, where: Representative The matching degree of the behavior, It is behavior No. Features, It is the first of the safety rules Features, Indicates The weight factor of the feature, is the total number of features; S313: Evaluate the potential risk of each behavior in the result matching list, automatically trigger the mandatory access rules for railway network security, and generate an emergency response instruction set.

[0012] The present invention is improved in that the steps of identifying the validity and defects of the response are specifically as follows: S411: extracting monitoring response time and successful resolution rate data according to the emergency response instruction set to obtain effect evaluation information; S412: Based on the effect evaluation information, multiple indicators are analyzed using the formula: ; Calculate the deviation of each response to determine the effectiveness and key deficiencies of the response, where: represents the effect evaluation error, is the expected response indicator, is the current response indicator, is the weight of multiple indicators, is the total number of events.

[0013] The present invention is improved in that the steps of obtaining the network protection optimization information are specifically as follows: S421: Analyze the security measures and rules that frequently have problems according to the identification results, and make preliminary adjustments to the mandatory access rules for railway network security to generate preliminary adjustment data; S422: Based on the preliminary adjustment data, combined with the impact of network security vulnerabilities and response delays, the formula is used: ; Evaluate the urgency and improvement of each security rule to obtain network protection optimization information, including: represents the total optimization score, is the severity of the security flaw, is the frequency of security defects, is the improvement weight of the corresponding rule, is the number of rules evaluated.

[0014] A network security digital avatar protection system, the system comprising: The behavior monitoring module records the equipment status and communication anomalies based on the data stream from the railway network, extracts the network behavior characteristics, and uses the LSTM network to analyze the normal and abnormal network behavior patterns to obtain a virtual copy of the network; The deviation identification module monitors and compares the real-time railway network behavior based on the network virtual copy, identifies the behavior pattern that deviates from the normal, refines the identification capability for unknown attacks, and generates a behavior deviation identification configuration; The exception handling module detects behaviors that conform to abnormal patterns according to the behavior deviation recognition configuration, automatically triggers mandatory access rules for railway network security, restricts or terminates abnormal behaviors, blocks the spread of potential threats, and generates emergency response instruction sets; The effect evaluation module evaluates the effect of the emergency response process based on the emergency response instruction set, identifies the effectiveness and defects of the response, and generates a response evaluation result; Based on the response evaluation results, the protection optimization module adjusts and optimizes the mandatory access rules of the railway network security, refines the anti-attack performance of the railway network, blocks potential attacks in the future period, and generates network protection optimization information.

[0015] Compared with the prior art, the advantages and positive effects of the present invention are: In the present invention, by real-time monitoring of the data flow of the railway network and recording the equipment status and communication anomalies, the network security dynamics are effectively captured, the immediate response capability to abnormal behavior is improved, and the LSTM network is used to analyze and extract complex network behavior characteristics, strengthen the parsing of complex data patterns, ensure efficient identification of unknown threats, and the automated behavior deviation identification configuration and emergency response instruction set can quickly and accurately respond to potential threats, reduce the probability of network security accidents, achieve efficient risk management, greatly improve the safety performance of the railway network, and ensure the continuous safety and data integrity of key operations, thereby achieving comprehensive protection and immediate safety feedback of the railway system. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A flowchart of a network security digital avatar protection method is proposed for the present invention; Figure 2 A flowchart of real-time monitoring and recording of network activities in the present invention; Figure 3 A flowchart of obtaining a network virtual copy in the present invention; Figure 4 A flow chart for identifying a behavior pattern that deviates from the conventional one in the present invention; Figure 5 A flowchart for obtaining a behavior deviation identification configuration in the present invention; Figure 6 It is a flowchart of obtaining the emergency response instruction set in the present invention; Figure 7 A flow chart for identifying the effectiveness and deficiencies of the responses in the present invention; Figure 8 This is a flow chart for obtaining network protection optimization information in the present invention. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0018] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating positions or positional relationships, are based on the positions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, the meaning of "multiple" is two or more, unless otherwise clearly and specifically defined.

[0019] Example See also Figure 1 The present invention provides a technical solution: a network security digital double protection method, comprising the following steps: S1: Based on the data stream from the railway network, the network activities are monitored and recorded in real time, including equipment status and communication anomalies. The LSTM network is used to analyze normal and abnormal network behavior patterns, extract behavior features, and establish a virtual copy of the network. S2: Based on the network virtual copy, the real-time network behavior of the railway is continuously compared. By analyzing the simulated data and behavior in the virtual copy, the behavior patterns that deviate from the norm are identified, and the recognition capability of unknown attacks is refined to generate the behavior deviation recognition configuration; S3: Based on the behavior deviation identification configuration, it detects behaviors that conform to abnormal patterns, automatically triggers the mandatory access rules for railway network security, restricts or terminates abnormal behaviors, blocks the spread of potential threats, and generates emergency response instruction sets; The specific mandatory access rules are as follows: When there are potential security risks between different services or devices in the network, such as the signal system may be infected by devices connected to the public Internet, by implementing mandatory access control rules, the signal system devices can only communicate with other authorized devices in the internal network, blocking all unauthorized external access attempts; If critical data in the railway system (such as train timetables and control commands) is accessed or tampered with without authorization, mandatory rules can be set to ensure that only specific roles (such as dispatchers and administrators) have the authority to access or modify critical data. Role-based permission management ensures data integrity and security. If the railway network is subject to unauthorized intrusion, such as hackers trying to insert malware through network interfaces, deploy automated network intrusion detection and automatically block communications from suspicious or known malicious sources through mandatory access rules, such as blocking all packets from specific IP addresses; If malicious or unauthorized applications may run in the railway control system and cause security threats, by implementing an application whitelist, only pre-verified and authorized software will be allowed to run on the system. When any software not on the whitelist attempts to execute, it will be automatically blocked and the security incident will be reported.

[0020] S4: Conduct an effectiveness evaluation based on the emergency response instruction set to identify the effectiveness and defects of the response, and adjust the mandatory access rules for railway network security based on the identification results to optimize the security of the railway network and generate network protection optimization information.

[0021] For adjusting the mandatory access rules for railway network security, it is necessary to evaluate the execution results of the current emergency response instruction set, including analyzing which security measures successfully prevented threats, which did not achieve the expected results, and the potential reasons. For example, if an access control rule fails to prevent unauthorized access, it is necessary to identify whether the rule is set improperly or the execution mechanism is flawed; Utilize the collected data, such as the frequency, type, source and target of intrusion attempts, as well as the timeliness and effectiveness of response measures, to make decisions. Based on the analysis results, adjust the existing access control rules, which may include the following: For example, if the data shows that some access attempts are initiated from the internal network, it is necessary to impose stricter restrictions on the access rights of internal users; expand the coverage of the rules, and add new rules to prevent newly discovered attack paths or technologies. Before implementing new or modified rules, they need to be tested to verify their effectiveness and potential impact on the operation of the railway network.

[0022] The network virtual copy includes a behavioral feature set, a status monitoring diagram, and abnormal pattern recognition results. The behavioral deviation recognition configuration includes a pattern deviation mark, attack prediction information, and behavioral comparison analysis information. The emergency response instruction set includes an access control protocol, an activity blocking mechanism, and an alarm triggering mechanism. The network protection optimization information includes security vulnerability correction results, protection update results, and access rule adjustment results.

[0023] See also Figure 2 , the steps to monitor and record network activities in real time are as follows: S111: Based on the data stream from the railway network, extract the equipment status and communication anomaly information, perform preliminary data classification, and generate a preliminary monitoring data set; Capture the data stream transmitted in the railway network, including information collected from sensors and monitoring equipment, and classify and record the data in real time. The process involves capturing signals and preliminary noise filtering to ensure that the acquired equipment status and communication anomaly information is accurate. The data set will be marked and stored for further analysis.

[0024] S112: Analyze the preliminary monitoring data set using the formula: ; Calculate the analysis results of key equipment status and communication anomalies to obtain network activity records, including: Indicates the device status change indicator. Indicates communication abnormality indicators. and is to adjust the weight, and It is a nonlinear adjustment coefficient used to handle the interaction between device status and communication anomalies; At a certain point in time , device status indicators 50, communication abnormality indicator is 10, the weight parameter is 0.7, is 0.3, nonlinear adjustment coefficient is 0.5, Set to 1, the formula is calculated as follows: ; The results showed that at the time point , comprehensive analysis results It is 39.35, which reflects the network activity status of the current monitoring point, where the impact of device status is greater than communication anomalies, which is helpful for further decision support and the formulation of abnormal response measures.

[0025] See also Figure 3 , the specific steps for obtaining a network virtual copy are: S121: Analyze network activity data using LSTM network, identify normal and abnormal network behavior patterns, extract behavior features, and obtain network feature sets; The LSTM network is used to analyze network activity data. Real-time data is collected by monitoring pole network traffic, including transmission packets, response time and abnormal alarms of each node. The collected data is then processed to remove duplicate and invalid data. The processed data set is then divided into training set and test set. The training set is trained with the LSTM network. During the training process, feature selection technology is used to extract important features related to network behavior, such as packet size, transmission delay and traffic pattern. Combined with time series characteristics, the data is decomposed into time series to extract periodicity and trend information. The effectiveness of the model is evaluated through cross-validation, and the extracted features are combined into a network feature set to provide a basis for subsequent network behavior analysis.

[0026] S122: Based on the network feature set, simulate the changes of normal and abnormal behaviors, using the formula: ; Evaluating Virtual Copy Performance , establish a network virtual copy, where, Representative The weight coefficient of each behavior feature, Indicates behavioral characteristics, is the dynamic change rate, is the total number of features; There are three network behavior characteristics , and The weights are 0.5, 0.3 and 0.2 respectively. , and 1, 0.8 and 0.5 respectively, dynamic change rate is 0.05, then the formula is as follows: ; The results show that the performance index of the network virtual replica calculated by integrating the characteristic values, weights and dynamic response rates is 0.04, which reflects the overall performance of the simulated network considering all given characteristics and conditions.

[0027] See also Figure 4 , the specific steps for identifying behavior patterns that deviate from the norm are: S211: Based on the network virtual copy, the real-time network behavior data of the railway is continuously collected, including the transmission time, frequency and flow characteristics of the data packets, to generate a real-time network behavior data set; Based on the network virtual copy, the real-time network behavior data of the railway is continuously collected, including the transmission time, frequency and flow characteristics of the data packets, and the real-time activity data of each network node is obtained, including its corresponding timestamp and transmission delay. At the same time, the abnormal signal frequency and related traffic patterns are recorded. The data is then preprocessed to eliminate duplicate and invalid data, and the data deviation is corrected by matching the real-time data and the typical network characteristics stored in the virtual copy to ensure that the subsequent comparison and analysis has reference value. The real-time network behavior data set formed is used for deviation analysis.

[0028] S212: Continuously compare the real-time network behavior data set with the simulated data in the virtual replica, using the formula: ; Calculate the similarity and deviation of each behavior feature, set the judgment threshold to identify the significantly deviated behavior pattern, and generate the deviated behavior mark, where: represents the behavior deviation value, and are the real-time data and the simulated data, respectively. eigenvalues, To adjust the index, is the total number of eigenvalues ​​involved in the comparison; Considering real-time data feature values and the corresponding simulated data characteristic values ​​in the virtual copy For the following three sample data: , , ; , , , and take , the calculation process is as follows: ; This result shows that the deviation If the value is 2 and the judgment threshold is 1, then a value greater than 1 indicates a significant deviation and a value less than 1 indicates normal, indicating that the current real-time network behavior deviates significantly from the virtual copy, which will be used to further identify and mark the deviation behavior pattern.

[0029] S213: analyzing the deviant behavior mark, combining the feature extraction and pattern recognition technology of the virtual copy, calculating the distance between the cluster center of the marked behavior and the normal behavior, and generating a deviant behavior recognition result; Conduct in-depth analysis on the marked deviant behaviors and use clustering algorithms to cluster all identified abnormal behavior data points. The algorithm classifies similar abnormal behaviors based on the distance measurement of the behavior pattern and classifies the data points according to their degree of deviation. For each type of deviant behavior, analyze its commonality and frequency to obtain statistical information about each type of abnormal behavior. This information helps to further understand the root causes and potential impacts of the abnormal behavior. At the same time, by comparing the clustering results with the normal behavior patterns, unknown attack modes or fault types can be identified to form deviant behavior identification results.

[0030] See also Figure 5 ,The steps for obtaining the behavior deviation identification configuration are as follows: S221: Analyze the identified behavioral patterns that deviate from the norm, evaluate the threats to railway network security for unknown or abnormal attack types, and generate network security threat results; Through in-depth analysis of the identified deviations from normal behavior patterns, especially those unclassified or abnormal network behaviors, we can identify which behavior patterns are normal and which are potential threats. Then we analyze the potential threats, identify their sources and attack methods to ensure that the harmfulness of each behavior pattern can be accurately identified and evaluated. For each type of potential attack behavior, determine its specific impact on railway network security, evaluate the degree of damage caused by the behavior, and summarize and organize the analysis results into a network security threat report, which lists the characteristics, frequency of occurrence and recommended defense measures of various potential attacks.

[0031] S222: Based on the network security threat results, by simulating potential attack scenarios in a real network environment, the formula is used: ;

[0032] Calculate the attack recognition rate , we get the behavior deviation identification configuration, where Indicates the number of attacks successfully identified, Indicates the total number of attacks. Represents the weight factor, which is used to adjust the importance of different attack types in the identification process; If you have the following data, Successfully identified 20 attacks, For 100 attacks, Set it to 0.5 and substitute it into the formula: ;

[0033] The result shows that the generated behavior deviation identification configuration has a recognition rate of 0.3, or 30%, which means that the configuration can effectively identify a portion of unknown attacks.

[0034] See also Figure 6 ,The specific steps for obtaining the emergency response instruction set are: S311: Based on the behavior deviation identification configuration, detect behaviors that conform to abnormal patterns, including abnormal data packet sending frequency or unauthorized data access requests, record the characteristic values ​​and timestamps of the associated behaviors, and obtain abnormal behavior characteristic records; Based on the identified abnormal behavior patterns, by monitoring the abnormal frequency of data packets or detecting unauthorized data access requests, the detailed characteristic values ​​and accurate timestamps of the behavior are recorded. Monitoring technology is used in the process to ensure accurate data collection. The analysis of behavior characteristic values ​​can mine potential security threats and abnormal behavior patterns, thereby obtaining abnormal behavior characteristic records; S312: Based on the abnormal behavior feature records, match with the security rules, using the formula: ; Calculate the matching degree between each abnormal behavior and the security rule, and obtain the result matching list, where: Representative The matching degree of the behavior, It is behavior No. Features, It is the first of the safety rules Features, Indicates The weight factor of a feature is used to specify the criticality of the feature in the matching process. is the total number of features; Consider three features, among which , , , the characteristic value of abnormal behavior is , , , the characteristic value of the safety rule is , , , the calculation process is as follows: ; This result shows that the calculated matching degree It is 0.67, indicating that the abnormal behavior has a high degree of match with the safety rules, thus an effective risk assessment is performed.

[0035] S313: The evaluation result matches the potential risk of each behavior in the list, automatically triggering the mandatory access rules for railway network security, such as disconnecting and restricting permissions, and generating an emergency response instruction set; Evaluate the potential risk of each behavior in the matching result list, classify the risk level using quantitative analysis methods, and formulate corresponding emergency response instructions according to different risk levels, such as cutting off the connection for high-risk behaviors and restricting the permissions for medium-risk behaviors, to ensure that various threats can be dealt with in a targeted manner and generate emergency response instruction sets; See also Figure 7 , the steps for identifying the effectiveness of the response and defects are as follows: S411: extract monitoring response time and successful resolution rate data according to the emergency response instruction set to obtain effect evaluation information; According to the emergency response instruction set, data extraction is carried out to collect key data on response time and successful resolution rate. Through data collection, the processing time and results of each response event are monitored, and the end status and user feedback of each event are recorded in real time to ensure the integrity and accuracy of the data. Events with response times exceeding the preset threshold and situations where the resolution rate is lower than the standard requirement are identified from the data. The data will be further analyzed to evaluate the effectiveness of the current response strategy and provide a basis for formulating improvement measures. The whole process ensures that the implementation effect of the response instruction set can be accurately evaluated and the effect evaluation information can be obtained.

[0036] S412: Based on the effect evaluation information, multiple indicators are analyzed using the formula: ; Calculate the deviation of each response to determine the effectiveness and key deficiencies of the response, where: represents the effect evaluation error, is the expected response indicator, is the current response indicator, is the weight of multiple indicators, is the total number of events; A total of 100 security incidents were handled in a specific period, and the expected response indicators The incident should be resolved within 1 minute, the current response indicator are the actual resolution time of each incident, Depending on the urgency of the event, which ranges from 0.1 to 1.0, for the three events, 1 minute respectively. They are 1.2 minutes, 0.8 minutes and 1.5 minutes respectively. They are 0.5, 1.0 and 0.8 respectively.

[0037] The calculation process is as follows: ; The results showed that the overall response error was 0.087, indicating that there was a slight delay in processing events and further optimization was needed to improve the speed and accuracy of the response.

[0038] See also Figure 8 , the specific steps for obtaining network protection optimization information are as follows: S421: Analyze the security measures and rules that frequently have problems based on the identification results, make preliminary adjustments to the mandatory access rules for railway network security, and generate preliminary adjustment data; By reviewing the security incidents and illegal access records of the railway network, we can locate the security measures and rules with frequent problems, such as unauthorized access and abuse of authority. We will conduct data analysis on the problems, identify the commonalities and particularities of security vulnerabilities, integrate the analysis results, and make preliminary adjustments to the security rules, such as modifying access permission control, strengthening the identity authentication process, and optimizing security configurations including encryption and monitoring strategies, so as to generate preliminary adjustment data. The data will be used for further security policy review and optimization to ensure that the railway network security system is more rigorous and effective.

[0039] S422: Based on preliminary adjustment data, combined with the impact of cybersecurity vulnerabilities and response delays, the formula is used: ; Evaluate the urgency and improvement of each security rule to obtain network protection optimization information, including: represents the total optimization score, is the severity of the security flaw, is the frequency of security defects, is the improvement weight of the corresponding rule, is the number of rules evaluated; There are three security rules to be evaluated, , specify the following values ​​for each rule: , , ; , , ; , , ; Substitute into the formula to calculate: ; This result shows that the total optimization score , reflects the parameters based on current settings and can be used to guide further security measure adjustments and implementation, ensuring that key areas are prioritized and improving overall network security.

[0040] A network security digital avatar protection system, the system comprising: The behavior monitoring module records the equipment status and communication anomalies based on the data stream from the railway network, extracts the network behavior characteristics, and uses the LSTM network to analyze the normal and abnormal network behavior patterns to obtain a virtual copy of the network; The deviation identification module monitors and compares the real-time railway network behavior based on the network virtual copy, identifies the behavior patterns that deviate from the norm, refines the identification capabilities for unknown attacks, and generates the behavior deviation identification configuration; The exception handling module detects behaviors that match abnormal patterns based on behavior deviation identification configuration, automatically triggers mandatory access rules for railway network security, restricts or terminates abnormal behaviors, blocks the spread of potential threats, and generates emergency response instruction sets; The effect evaluation module evaluates the effect of the emergency response process based on the emergency response instruction set, identifies the effectiveness and defects of the response, and generates response evaluation results; Based on the response evaluation results, the protection optimization module adjusts and optimizes the mandatory access rules for railway network security, refines the anti-attack performance of the railway network, blocks potential attacks in the future, and generates network protection optimization information.

[0041] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A network security digital avatar protection method, characterized in that: The following steps are involved: Based on the data stream from the railway network, the network activities are monitored and recorded in real time, including equipment status and communication anomalies. The LSTM network is used to analyze normal and abnormal network behavior patterns, extract behavior features, and establish a virtual copy of the network. Based on the network virtual copy, the real-time network behavior of the railway is continuously compared, and the behavior patterns that deviate from the normal are identified by analyzing the simulated data and behaviors in the virtual copy, and the identification capability of unknown attacks is refined to generate a behavior deviation identification configuration; Based on the behavior deviation identification configuration, the behavior that meets the abnormal pattern is detected, and the mandatory access rules of railway network security are automatically triggered to restrict or terminate the abnormal behavior, block the spread of potential threats, and generate an emergency response instruction set; According to the emergency response instruction set, an effect evaluation is conducted to identify the effectiveness and defects of the response, and the mandatory access rules for railway network security are adjusted according to the identification results to optimize the security of the railway network and generate network protection optimization information.

2. The network security digital avatar protection method according to claim 1, characterized in that: The steps of real-time monitoring and recording of network activities are specifically as follows: Based on the data stream from the railway network, extract the equipment status and communication anomaly information, perform preliminary data classification, and generate a preliminary monitoring data set; The preliminary monitoring data set was analyzed using the formula: ； Calculate the analysis results of key equipment status and communication anomalies to obtain network activity records, including: Indicates the device status change indicator. Indicates communication abnormality indicators. and is to adjust the weight, and It is a nonlinear adjustment coefficient used to handle the interaction between device status and communication anomalies.

3. The network security digital avatar protection method according to claim 1, characterized in that: The steps of obtaining the network virtual copy are specifically as follows: Analyze network activity data using the LSTM network, identify normal and abnormal network behavior patterns, extract behavior features, and obtain a network feature set; Based on the network feature set, the changes in normal and abnormal behaviors are simulated using the formula: ； Evaluating Virtual Copy Performance , establish a network virtual copy, where, Representative The weight coefficient of each behavior feature, Indicates behavioral characteristics, is the dynamic change rate, is the total number of features, is the base of natural logarithms.

4. The network security digital avatar protection method according to claim 1, characterized in that: The steps for identifying the behavior pattern that deviates from the normal are specifically: Based on the network virtual replica, continuously collect real-time network behavior data of the railway, including transmission time, frequency and flow characteristics of data packets, to generate a real-time network behavior data set; Continuously compare the real-time network behavior data set with the simulated data in the virtual copy, using the formula: ； Calculate the similarity and deviation of each behavior feature and generate a deviation behavior tag, where: represents the behavior deviation value, and are the real-time data and the simulated data, respectively. eigenvalues, To adjust the index, is the total number of eigenvalues ​​involved in the comparison; The deviant behavior mark is analyzed, and the distance between the cluster center of the marked behavior and the normal behavior is calculated by combining the feature extraction and pattern recognition technology of the virtual copy to generate the deviant behavior recognition result.

5. The network security digital avatar protection method according to claim 1, characterized in that: The steps for obtaining the behavior deviation identification configuration are specifically as follows: Analyze the identified deviating behavior patterns, evaluate the threats to railway network security for unknown or abnormal attack types, and generate network security threat results; Based on the network security threat results, by simulating potential attack scenarios in a real network environment, the formula is used: ； Calculate the attack recognition rate , we get the behavior deviation identification configuration, where Indicates the number of successfully identified attacks, Indicates the total number of attacks. Represents the weight factor.

6. The network security digital avatar protection method according to claim 1, characterized in that: The steps for obtaining the emergency response instruction set are specifically as follows: Based on the behavior deviation identification configuration, detect behaviors that conform to abnormal patterns, including abnormal data packet sending frequency or unauthorized data access requests, record characteristic values ​​and timestamps of associated behaviors, and obtain abnormal behavior characteristic records; Based on the abnormal behavior feature records, matching is performed with security rules using the formula: ； Calculate the matching degree between each abnormal behavior and the security rule, and obtain the result matching list, where: Representative The matching degree of the behavior, It is behavior No. Features, It is the first of the safety rules Features, Indicates The weight factor of the feature, is the total number of features; Evaluate the potential risk of each behavior in the result matching list, automatically trigger the mandatory access rules for railway network security, and generate an emergency response instruction set.

7. The network security digital avatar protection method according to claim 1, characterized in that: The steps for identifying the effectiveness and defects of the response are specifically: According to the emergency response instruction set, extract monitoring response time and successful resolution rate data to obtain effect evaluation information; Based on the effect evaluation information, multiple indicators are analyzed using the formula: ； Calculate the deviation of each response to determine the effectiveness and key deficiencies of the response, where: represents the effect evaluation error, is the expected response indicator, is the current response indicator, is the weight of multiple indicators, is the total number of events.

8. The network security digital avatar protection method according to claim 1, characterized in that: The steps for obtaining the network protection optimization information are specifically as follows: Based on the identification results, analyze the security measures and rules that frequently have problems, make preliminary adjustments to the mandatory access rules for railway network security, and generate preliminary adjustment data; Based on the preliminary adjustment data, combined with the impact of network security vulnerabilities and response delays, the formula is used: ； Evaluate the urgency and improvement of each security rule to obtain network protection optimization information, including: represents the total optimization score, is the severity of the security flaw, is the frequency of security defects, is the improvement weight of the corresponding rule, is the number of rules evaluated.

9. A network security digital avatar protection system, characterized in that: According to any one of claims 1 to 8, the network security digital avatar protection method is implemented, and the system comprises: The behavior monitoring module records the equipment status and communication anomalies based on the data stream from the railway network, extracts the network behavior characteristics, and uses the LSTM network to analyze the normal and abnormal network behavior patterns to obtain a virtual copy of the network; The deviation identification module monitors and compares the real-time railway network behavior based on the network virtual copy, identifies the behavior pattern that deviates from the normal, refines the identification capability for unknown attacks, and generates a behavior deviation identification configuration; The exception handling module detects behaviors that conform to abnormal patterns according to the behavior deviation recognition configuration, automatically triggers mandatory access rules for railway network security, restricts or terminates abnormal behaviors, blocks the spread of potential threats, and generates emergency response instruction sets; The effect evaluation module evaluates the effect of the emergency response process based on the emergency response instruction set, identifies the effectiveness and defects of the response, and generates a response evaluation result; Based on the response evaluation results, the protection optimization module adjusts and optimizes the mandatory access rules of the railway network security, refines the anti-attack performance of the railway network, blocks potential attacks in the future period, and generates network protection optimization information.

Images