Train communication network intrusion detection method based on multi-scale residual network

Abstract

The invention discloses a train communication network intrusion detection method based on a multi-scale residual network, and the method comprises the following steps: building a train communication network topological structure model, and building a traffic model for the mixed transmission of normal traffic and intrusion traffic; collecting a flow data packet in a link as an original data sample in the intrusion detection data set, and performing preprocessing to obtain a data sample containing statistical characteristics; a train communication network intrusion detection MSRNet-GLAM model is constructed, and the performance of the train communication network intrusion detection MSRNet-GLAM model is checked and evaluated, so that the MSRNet-GLAM model can learn key feature information of a data sample in a multi-scale manner; and training and optimizing the MSRNet-GLAM model by using the improved focus loss function, and performing intrusion detection on the traffic data of the train communication network to be detected to obtain a traffic detection result of the train communication network. The method can effectively solve the problems of low security and difficulty in detection of intrusion traffic under the trend of mass data communication of the train communication network, and ensures the security of the train network.

Description

Technical Field

[0001] The present invention belongs to the technical field of train communication networks, and in particular relates to a train communication network intrusion detection method based on a multi-scale residual network. Background Art

[0002] The communication security of trains is closely related to the life safety and information security of passengers, and is also an important guarantee for the safe and high-speed operation of trains. With the expansion of the railway network and the increase in intelligent on-board equipment, the openness of train communication networks has been continuously enhanced, and the amount of data transmission has also increased sharply, which has brought severe challenges to the security of train communication networks. Faced with an increasingly complex network environment, intrusion detection technology can provide a proactive defense strategy for the security of train communication networks. By monitoring the traffic in the network in real time, it can effectively identify network intrusions. Intrusion detection technology is crucial to ensuring the security of train communication networks.

[0003] With the increase in the amount of communication data, data-driven intrusion detection technology has ushered in new developments. Among them, machine learning-based intrusion detection technology relies on domain knowledge and experience to manually extract relevant features from historical network traffic data so that the intrusion detection model can learn the difference between normal and intrusion traffic, thereby detecting potential intrusion behaviors in real-time traffic. However, with the continuous evolution of intrusion methods, the boundary between some covert intrusion traffic and normal traffic has become increasingly blurred. Since traditional machine learning-based intrusion detection methods rely too much on manually extracted features, their identification and detection effects are often unsatisfactory when faced with these difficult-to-classify intrusion traffic.

[0004] In the real train communication network environment, intrusion events are usually low-probability events, and the class distribution of intrusion detection datasets is objectively unbalanced. In class-imbalanced tasks, the results based on data-driven algorithms are more biased towards majority class samples, thereby ignoring the detection accuracy of minority class samples. Therefore, in the train communication network scenario with unbalanced traffic data classes and fuzzy class boundaries, the development of a reliable and accurate intrusion detection method is imminent. Summary of the invention

[0005] The purpose of the present invention is to provide a train communication network intrusion detection method based on a multi-scale residual network to solve the problem of low intrusion detection accuracy in the scenario of class imbalance and fuzzy class boundaries in the prior art. In order to achieve the above purpose, the present invention adopts the following technical solutions:

[0006] The present invention provides a train communication network intrusion detection method based on a multi-scale residual network and a global and local attention mechanism, comprising the following steps:

[0007] S01: Establish a train communication network topology model and define the performance parameters of the switching nodes, terminal devices and links in the train communication network topology model;

[0008] S02: Under the train communication network topology model, a traffic model for mixed transmission of normal traffic and intrusion traffic is established;

[0009] S03: Collecting traffic data packets in the link as original data samples in the intrusion detection data set, and performing data packet parsing, normalization and time window preprocessing on the original data samples to obtain data samples containing statistical features;

[0010] S04: All data samples are combined in chronological order as an intrusion detection data set, and the data set is randomly shuffled and divided into a training set and a test set in a ratio of 6:4; the training set is used for the subsequent training of the MSRNet-GLAM model for train communication network intrusion detection, and the test set is used for the evaluation of the inspection performance of the MSRNet-GLAM model for train communication network intrusion detection;

[0011] S05: Construct the MSRNet-GLAM model for train communication network intrusion detection, input the data samples of the training set into the MSRNet-GLAM model for training, output the detection results of the data samples in each round of training, and input the data samples of the test set into the MSRNet-GLAM model for intrusion detection of the train communication network to perform intrusion detection, and check and evaluate the performance of the MSRNet-GLAM model for intrusion detection of the train communication network. If it shows good intrusion detection performance, the intrusion detection of the train communication network is realized.

[0012] Through the combination of multi-scale residual network and global and local attention mechanism, the MSRNet-GLAM model can learn the key feature information of data samples at multiple scales; when the data samples are input into the MSRNet-GLAM model for training, an improved focal loss function is constructed to measure the difference between the detection results of these data samples and the actual labels; with the minimization of the loss function output as the optimization goal, the difference between the output of the MSRNet-GLAM model and the actual label is gradually reduced through multiple rounds of training to optimize the detection performance of the MSRNet-GLAM model. Finally, the trained MSRNet-GLAM model that fully learns the feature patterns of the data samples of the intrusion detection dataset is obtained, and the difference between the detection results and the actual labels in each round of training. With the minimization of this difference as the optimization goal, the detection performance of the MSRNet-GLAM model on the training set data samples is optimized in each round of training. Finally, a trained MSRNet-GLAM model is obtained that has fully learned the characteristic patterns of the data samples in the intrusion detection dataset; the test set data samples to be detected are input into the trained MSRNet-GLAM model, and the MSRNet-GLAM model detects each sample in the test set based on the characteristic patterns of the data samples learned in the training set, and evaluates the performance of the MSRNet-GLAM intrusion detection model with the indicators of accuracy, recall, precision, and F1 score. If the MSRNet-GLAM intrusion detection model shows good accuracy, recall, precision, and F1 score indicators in the test set, it is used to realize intrusion detection of the train communication network.

[0013] The above scheme is further preferred. In the step S01, the train communication network topology is constructed by interconnecting the train backbone network and the vehicle marshaling network. The switching nodes of each vehicle marshaling network are respectively connected to the subordinate terminal devices ED, which are responsible for data transmission; the definition of the switching nodes mainly includes the number of switching nodes, the number of switching node ports and the IP address configuration; the definition of the terminal devices mainly includes the number of terminal nodes and the IP address configuration of the terminal nodes; the definition of the link parameters mainly includes the number of links, link bandwidth and link delay. In the present invention, a train communication network topology model is established, and the performance parameters of the switching nodes, terminal devices and links in the train communication network topology model are defined. Specifically, the train communication network topology is first constructed, which is composed of the train backbone network and the vehicle marshaling network interconnected up and down. The switching nodes of each vehicle marshaling network are respectively connected to the subordinate terminal devices ED, which are responsible for data transmission; and then the performance parameters of the switching nodes, terminal devices and links in the train communication network topology model are defined.

[0014] The above scheme is further preferred, in step S02, the normal traffic includes monitoring data, process data, message data, flow data and best effort delivery data; the intrusion traffic includes: sniffing intrusion traffic, denial of service traffic, address resolution protocol spoofing traffic and replay intrusion traffic, and establishing a traffic model for mixed transmission of normal traffic and intrusion traffic includes the following sub-steps:

[0015] S0201: In accordance with the International Electrotechnical Commission standard IEC 61375, the business traffic for normal train operation is configured in the train communication network as a normal sample in the normal traffic data set; wherein the normal traffic includes monitoring data, process data, message data, stream data and best-effort delivery data. Among these data, the functions of monitoring data and process data are to transmit key information such as train control commands and train safety status information. These two types of data are real-time periodic data. The main function of message data is to transmit fault diagnosis information, and it has a higher priority and real-time requirements. Stream data mainly transmits audio and video data related to train video monitoring and passenger entertainment activities, which is non-periodic low-real-time data. Best-effort delivery data involves data configuration and file transfer, and there is no real-time requirement;

[0016] S0202: Configure sniffing intrusion traffic (Probe) in the train communication network. The sniffing intrusion Probe is a detection-type intrusion method. Through IP scanning and port scanning, it sends request packets to the link indiscriminately, obtains reply packets fed back in the link, and then parses these reply packets to detect active hosts and available ports in the network, providing feasible intrusion targets for subsequent intrusions;

[0017] S0203: Configure Denial of Service (DoS) intrusion traffic in the train communication network. Denial of Service (DoS) is a flooding intrusion method that consumes the resources of the target device by sending a large number of invalid data packets, causing the target device to have a huge delay or even crash, making it unable to provide services for normal requests, thus achieving the purpose of "denial of service" for normal requests;

[0018] S0204: Configure Address Resolution Protocol Spoofing (ARP Spoofing) and Replay intrusion traffic in the train communication network. Address Resolution Protocol Spoofing (ARPSpoofing) and Replay intrusion are man-in-the-middle intrusion methods.

[0019] S0205: Address Resolution Protocol spoofing traffic achieves identity spoofing by sending false ARP replies to the switching node, overwriting the identity information of the target terminal in the switching node cache; after receiving the data packet originally sent to the target host, the switching node forwards it to the intruder. After the intruder intercepts the data packet, it implements a replay attack, that is, delaying or repeatedly injecting the intercepted data packet into the network, thereby invading the train communication network without cracking the information in the data packet; during data transmission, the Address Resolution Protocol (ARP) broadcasts the Address Resolution Protocol ARP request containing the target IP address in the network, and determines the physical address of the target terminal through the Address Resolution Protocol ARP reply sent by the target terminal corresponding to the target IP address. Address Resolution Protocol Spoofing (ARP Spoofing) achieves identity deception by sending false Address Resolution Protocol ARP replies to the switching node, overwriting the identity information of the target terminal in the switching node cache; after the switching node receives the data packet originally sent to the target host, it will send it to the intruder. After intercepting the data packet, the intruder can implement a replay attack, that is, delaying or repeatedly injecting the intercepted data packet into the network, thereby invading the train communication network without cracking the information in the data packet.

[0020] The above solution is further preferred, in step S03, performing data packet parsing, normalization and time window preprocessing on the original data sample includes the following sub-steps:

[0021] S0301: Collect traffic data packets in the link, use the network data packet parsing program framework Scapy to parse the information in the data packets, and then perform integer encoding on the discrete features of each data packet, such as IP address, port number, etc.; normalize the continuous features, such as data packet length, etc.;

[0022] S0302: Time window the data packet information in the link. The set of all data flows in the link is represented by F:

[0023] F={f1,f2,...,f m},f i ∈F (1)

[0024] Where i = 1, 2, ..., m, m represents the number of data flows on the link, f i Represents a separate data stream, each data stream f i Can be defined as a collection of packets:

[0025]

[0026] in Represents the data flow f i The jth packet in, for j∈1,2,...,n i , n i Indicates the number of packets per data stream. There is a timestamp

[0027] S0303: Transform the data stream f i It is divided into a series of time windows, each of which contains data packets within the time interval Δt. Define f i The kth time window in is W (i,k) :

[0028]

[0029] in Indicates d i The starting timestamp of the kth time window in , Δt represents the duration of the time window. Within the time window, the data packet Only included in W (i,k) middle.

[0030] S0304: Taking a time window as the minimum unit, perform independent statistical analysis on the discrete features of the data packets within the time window. These discrete features include the number, length, transmission time, transmission rate and identifier counting statistical analysis of the data packets. After statistical analysis, a data sample containing statistical features is obtained, and the statistical information is extracted as sample feature information for MSRNet-GLAM model training.

[0031] S0305: All data samples are combined in chronological order as an intrusion detection data set, and the data set is randomly shuffled and divided into a training set and a test set in a ratio of 6:4. The training set is used for the subsequent training of the MSRNet-GLAM model for train communication network intrusion detection, and the test set is used to evaluate the inspection performance of the MSRNet-GLAM model for train communication network intrusion detection.

[0032] The above scheme is further preferred, in step S05, constructing the train communication network intrusion detection MSRNet-GLAM model specifically includes the following sub-steps:

[0033] S0501: As the input of the MSRNet-GLAM model for train communication network intrusion detection, the data samples of the training set are firstly multi-scaled through the multi-scale residual network to obtain the multi-scale feature information of the data samples; the structure of the multi-scale residual network consists of multiple layers of convolutional neural network layers with different convolution kernel sizes. Let the size of the convolution kernel be k, first there is 1 layer of point-by-point convolution layer, followed by 3 convolution network branches, and the number of convolution layers stacked in these branches is 1, 3, and 1 respectively. Among them, the single layer of point-by-point convolution layer with k=1 of the first branch is used to extract the input features of the shallow layer; the k of the 3 layers of convolution layers of the second branch is equal to 3, 5, and 3 respectively, which is used to extract the input features of the deep layer; the single layer of convolution layer of the third branch is k=3, which is used to extract the input features of the middle layer. Then, the outputs of the 3 branches are superimposed and input to another layer of point-by-point convolution layer, and residually connected with the output of the first layer of point-by-point convolution layer. All the above convolution layers contain 1 layer of batch normalization layer, which increases the stability of MSRNet-GLAM model training by standardizing the input.

[0034] In the multi-scale residual module, the first point-by-point convolution layer is used to adjust the dimension of the feature. The dimension-adjusted features are input into each convolutional network branch, which has different numbers of convolutional layers and convolution kernels of different sizes, which is conducive to extracting multi-scale information of different granularities such as deep and shallow layers in high-dimensional features.

[0035] S0502: The input of the MSRNet-GLAM model for train communication network intrusion detection is subjected to a multi-scale residual module to extract multi-scale feature information. The multi-scale feature information of the data samples is input into the global and local attention modules for weighted processing to enhance the attention to important information in the multi-scale feature information. The multi-scale feature information is input into the global and local attention modules to enhance the MSRNet-GLAM model's ability to capture key information between features and channels.

[0036] In the above scheme, it is further preferred that the multi-scale feature information of the data sample is input into the global and local attention modules for weighted processing respectively, which comprises the following steps:

[0037] First, the local attention module (LAM) and the global attention module (GAM) are constructed, and then the multi-channel output feature information of the data samples is simultaneously input into the local attention module LAM and the global attention module GAM. Finally, the outputs of the local attention module LAM and the global attention module GAM are concatenated through the concatenation layer.

[0038] Among them, the local attention module LAM transforms the input through a pointwise convolution network (Pointwise Convolution) or a dilated convolution network (Dilation Convolution) to generate different representations of the input and map it to a subspace, which is defined as the "attention head". That is, the input is mapped to local features through the dilated convolution layer to generate a query vector and a key vector; the input is mapped through pointwise convolution to generate a value vector:

[0039]

[0040] where q j , k j and v j They represent the query vector, key vector, and value vector obtained after transforming the input. The query vector, key vector, and value vector are mapped to a subspace as different representations of the input, which is defined as an "attention head". The dilated convolution layer in each attention head uses a different dilation rate d j =(d1,d2,...,d m ,d j ∈R), which is used to extract local correlations between different features of the input at multiple scales, where m is the number of attention heads.

[0041] Through q j and k j Perform dot product and scaling operations to obtain the attention weight matrix of each feature in the input to the other features; after the weight matrix is ​​normalized by the activation function softmax, it is compared with v j Perform weighted operations:

[0042]

[0043] Where: d q ,d k and d v Respectively represent q j , k j and v j The vector dimension of head j Represents the output of the attention head, head j ∈{head1,head2,...,head m}. Finally, the head is concatenated through the concatenation layer j , get the local attention output LAM output :

[0044] LAM output =Concatenate{head1,head2,...,headm} (6)

[0045] Again, in the multi-scale features output by the multi-scale residual network module, the output of each convolution kernel represents a channel, and each channel carries feature maps of different granularities of data samples; the global attention module (Global Attention Module, GAM) inputs the feature map of each channel into the global average pooling layer (GAP) and the global maximum pooling layer (GMP) to extract the overall features and key features of each channel as the global features of each channel; the global attention module GAM focuses on the correlation between global features and channels from a global level: point-by-point convolution is used to perform a convolution transformation on the feature map with a convolution kernel of 1 to achieve channel expansion:

[0046] x′=Pointwise Conv(x) (7)

[0047] Among them: x′ represents the output after point-by-point convolution processing; the average and maximum values ​​of the feature information of each channel are output through the global average pooling layer GAP and the global maximum pooling layer GMP as the global features of the channel. The multilayer perceptron (MLP) composed of multiple layers of fully connected layers integrates the global features of the channel and extracts the correlation information between the global features between channels:

[0048] x′ p =MLP(GAP(x′))+MLP(GMP(x′)) (8)

[0049] x′ p It represents the correlation information between the overall features and key features after fusion by the multi-layer perceptron MLP. Then, the output is upsampled to restore the data dimension of the features to maintain the consistency of the data structure of the input and output of the attention module.

[0050] Finally, the global feature correlation information of each channel is normalized through the activation function softmax as the correlation weight of the global feature between each channel. And these weights are weighted to each channel of the input through element multiplication to recalibrate the importance of each channel in the global feature:

[0051] GAM output =σ(Upsample(x′ p ))⊙x′ (9)

[0052] GAM output represents the output of the global attention module; σ represents the Sigmoid activation function; ⊙ represents element-wise multiplication.

[0053] S0506: Concatenate the outputs of local attention and global attention using the concatenation layer:

[0054] Attention = Concatenate {LAM output ,GAM output} (10)

[0055] Among them, Attention represents the output after the local attention and global attention are spliced ​​together. The output of Attention integrates the local feature information between multi-scale features and the global feature information across channels, which improves the MSRNet-GLAM model's attention to the key feature information of data samples and reduces the fitting of non-key features.

[0056] S0507: Transform the data dimension of the multi-scale feature information output by the multi-scale residual network through a point-by-point convolution layer to match the data dimension of the local feature information output by Attention and the global feature information across channels; Perform residual connection between the output of the multi-scale residual network after the dimension transformation and the output of Attention, and fuse the original multi-scale features output by the multi-scale residual network into the output of Attention; Perform layer normalization on the output after the residual connection to prevent extreme values ​​from appearing in the output after the residual connection;

[0057] S0508: The output after layer normalization is integrated with the original multi-scale features, local feature information and global feature information through a multi-layer perceptron (MLP) with a Softmax activation function, and the probability distribution of the possibility that each sample belongs to each category is output. These probability distributions will be used as the final output of the MSRNet-GLAM model.

[0058] In the above scheme, the multi-scale residual network is further preferably composed of multiple layers of convolutional neural network layers with different convolution kernel sizes, and the process of performing multi-scale learning through the multi-scale residual network includes the following process:

[0059] First, let the size of the convolution kernel be k, the first layer is a point-by-point convolution layer with k=1, followed by three convolution layer branches; in the multi-scale residual network, the first layer of the point-by-point convolution layer is used to adjust the dimension of the feature, and the dimension-adjusted features are input into each convolution network branch to extract deep and shallow multi-scale information from the high-dimensional features;

[0060] Secondly, let the number of convolutional layers stacked in the three branches be 1, 3, and 1 respectively; among them, the single-layer point-by-point convolutional layer with k=1 of the first branch is used to extract the input features of the shallow layer; the three-layer convolutional layer with k=3, 5, and 3 of the second branch is used to extract the input features of the deep layer; the single-layer convolutional layer with k=3 of the third branch is used to extract the input features of the middle layer;

[0061] Finally, the outputs of the three convolutional layer branches are superimposed and input into another point-by-point convolutional layer, and residually connected with the output of the first point-by-point convolutional layer. All of the above convolutional layers contain a batch normalization layer to increase the stability of MSRNet-GLAM model training by standardizing the input.

[0062] The above scheme is further preferred, in step S05, inputting the data samples of the training set into the MSRNet-GLAM model for training includes using the improved focal loss function IFL to perform multiple rounds of training optimization on the MSRNet-GLAM model, taking the minimization of the loss function output as the optimization goal, and outputting the detection results of the MSRNet-GLAM model on the data samples in each round of optimization training. The present invention measures the difference between the detection results of these data samples and the actual labels by constructing an improved focal loss function; taking the minimization of the loss function output as the optimization goal, gradually reducing the difference between the MSRNet-GLAM model output and the actual label through multiple rounds of training, and optimizing the detection performance of the MSRNet-GLAM model.

[0063] The above scheme is further preferred, using the improved focal loss function IFL to perform multiple rounds of training optimization on the MSRNet-GLAM model and perform intrusion detection on the train communication network traffic data to be detected, specifically including the following sub-steps:

[0064] S0501: Input the data samples of the training set into the MSRNet-GLAM model for training, output the detection results of the MSRNet-GLAM model on the data samples in each round of training, and construct an improved focal loss (Improved FocalLoss Function, IFL) function. The loss function takes the minimization of the difference between the detection result of the MSRNet-GLAM model and the actual value as the optimization goal, which is used to optimize the training process of the MSRNet-GLAM model; in order to solve the problem that some hidden intrusion traffic has high feature similarity and fuzzy boundaries with normal traffic, which makes these hidden intrusion traffic easily confused with normal traffic during detection, this improved focal loss function IFL introduces a category balance factor α tThe focusing parameter γ is used to reduce the loss weight of easy-to-classify samples, guiding the intrusion detection model to focus on minority class samples that are difficult to classify, thereby alleviating the problem of difficult classification of minority samples caused by class imbalance.

[0065] S0510: The similarity coefficient ω is introduced to increase the weight of easily confused samples to alleviate the problem of blurred boundaries between some intrusion traffic and normal traffic, and meet the following requirements:

[0066]

[0067] The MSRNet-GLAM model outputs the possibility that each sample belongs to each category through the activation function softmax. These outputs are expressed as probability distribution P, P = {p1, p2, ..., p n}, n is the number of categories. j Represents the probability corresponding to the true category in the probability distribution P; p i,max represents the maximum probability of the error category. i,max and p j The relative distance of is used as a measure of the degree of confusion of the classification result. t represents the category balance factor, which is used to adjust the weights between different categories; γ represents an adjustable focusing parameter, which is used to smoothly adjust the contribution of easy-to-classify samples to the loss function.

[0068] S0511: Each intrusion type is labeled with a different label, the labeled intrusion detection dataset is randomly shuffled, and then the labeled intrusion dataset is divided into a training set and a test set in a ratio of 6:4;

[0069] S0512: Use the improved focal loss function to optimize the training process of the MSRNet-GLAM model to obtain the trained MSRNet-GLAM model;

[0070] S0513: Input the test set into the MSRNet-GLAM model to evaluate the intrusion performance indicators. If the intrusion detection model of MSRNet-GLAM shows good intrusion detection evaluation results on both the training set and the test set, the intrusion detection model based on MSRNet-GLAM will be used to implement intrusion detection of the train communication network.

[0071] The above scheme is further preferred, wherein the intrusion performance indicators include accuracy, recall, precision and F1 score indicators to evaluate the performance of the intrusion detection model of MSRNet-GLAM.

[0072] In summary, since the present invention adopts the above technical solution, the present invention has the following beneficial technical effects:

[0073] (1) In the process of data processing, the present invention proposes a time window data processing method to extract the dynamic characteristics of the train communication network traffic within a certain time window, thereby enhancing the data expression ability and facilitating the system to detect hidden intrusion traffic from the perspective of time and space characteristics;

[0074] (2) In the present invention, a multi-scale residual network is constructed to alleviate the network degradation problem that occurs during the stacking of deep neural networks and promote the flow of gradients in the deep network;

[0075] (3) In this invention, an attention mechanism based on global and local feature attention is proposed, which enhances the ability of the MSRNet-GLAM model to capture key information at the local and global levels and reduces the interference of redundant feature information on the training of the MSRNet-GLAM model;

[0076] (4) In the present invention, by constructing an improved focal loss function, the detection ability of the intrusion detection model for difficult-to-classify samples is enhanced, and the intrusion detection accuracy of the MSRNet-GLAM model is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] Figure 1 It is a flow chart of the train communication network intrusion detection method described in the present invention.

[0078] Figure 2 It is a schematic diagram of the train communication network topology structure described in the present invention.

[0079] Figure 3 It is a schematic diagram of the time windowing of train communication network flow data provided by the present invention.

[0080] Figure 4 It is a schematic diagram of the overall structure of the train communication network intrusion detection model provided by the present invention.

[0081] Figure 5 It is a schematic diagram of the multi-scale residual network module in the MSRNet-GLAM model for train communication network intrusion detection provided by the present invention.

[0082] Figure 6 It is a schematic diagram of the global and local attention mechanism module provided by the present invention. DETAILED DESCRIPTION

[0083] In order to make the purpose, technical scheme and advantages of the present invention more clearly understood, the present invention will be described clearly and completely by enumerating preferred embodiments with reference to the accompanying drawings of the present invention. However, it should be noted that the examples in the specification are preferred embodiments, not all embodiments. In addition, many details listed in the specification are only for the purpose of enabling the reader to have a deep understanding of the key issues of the present invention, and the content of the present invention can be realized even without these specific details.

[0084] The present invention provides a train communication network intrusion detection method based on a multi-scale residual network and a global and local attention mechanism. The flowchart is shown in Figure 1 , the method comprising:

[0085] S01: defining the performance parameters of the switching nodes, terminal devices and links in the train communication network topology model; the train communication network topology is composed of the train backbone network and the vehicle marshaling network interconnected up and down, and each switching node of the vehicle marshaling network is connected to the subordinate terminal device ED respectively, which is responsible for data transmission; the definition of the switching node mainly includes the number of switching nodes, the number of switching node ports and the IP address configuration; the definition of the terminal device mainly includes the number of terminal nodes and the IP address configuration of the terminal node; the definition of the link parameters mainly includes the number of links, link bandwidth and link delay; the definition of performance parameters specifically includes the following sub-steps:

[0086] S0101: Build the train communication network topology, which is connected to the train backbone network node (ETB) of the train backbone network (ETB) and the vehicle constituting network node (Ethernet Consist Network Node, ECNN) of the vehicle constituting network (ECN) to form a two-layer network structure. Each vehicle constituting network node ECNN is connected to the subordinate terminal device ED and is responsible for data transmission. For a schematic diagram of the train communication network topology, see Figure 2 ;

[0087] S0102: defining the performance parameters of the switching nodes, terminal devices and links in the train communication network topology model; the definition of the switching nodes mainly includes the number of switching nodes, the number of switching node ports and the IP address configuration; the definition of the terminal devices mainly includes the number of terminal nodes and the IP address configuration of the terminal nodes; the definition of the link parameters mainly includes the number of links, link bandwidth and link delay;

[0088] S02: Under the train communication network topology model, a traffic model with mixed transmission of normal traffic and intrusion traffic is established. Normal traffic includes: monitoring data, process data, message data, flow data and best effort delivery data; intrusion traffic includes: sniffing intrusion probe, denial of service DoS intrusion, address resolution protocol spoofing ARP Spoofing and replay intrusion traffic;

[0089] S03: Collect traffic data packets in the link as original data samples in the intrusion detection data set, and obtain data samples containing statistical features after performing data packet parsing, normalization and time window preprocessing on the original data samples.

[0090] S04: All data samples are merged in chronological order as an intrusion detection data set, and the data set is randomly shuffled and divided into a training set and a test set in a ratio of 6:4. The training set is used for the subsequent training of the MSRNet-GLAM model for train communication network intrusion detection, and the test set is used to evaluate the inspection performance of the MSRNet-GLAM model for train communication network intrusion detection. The MSRNet-GLAM model is mainly composed of a multi-scale residual module and a global and local attention module, which is used to learn the key feature information of data samples at multiple scales and output the intrusion detection results based on the key feature information of the data samples.

[0091] S05: The MSRNet-GLAM model is trained, and the detection results of the data samples are output in each round of training of the MSRNet-GLAM model. The data samples of the test set are input into the MSRNet-GLAM model for train communication network intrusion detection to perform intrusion detection, so as to check and evaluate the performance of the MSRNet-GLAM model for train communication network intrusion detection. If good intrusion detection performance is shown, intrusion detection of the train communication network is achieved. The data samples of the training set are input into the MSRNet-GLAM model for training, and the detection results of the MSRNet-GLAM model for the data samples are output in each round of training. During the training process, an improved focal loss function IFL is combined to output the difference between the detection results output by the MSRNet-GLAM model in each round of training and the actual label. The minimization of this difference is used as the optimization goal to optimize the training process of the MSRNet-GLAM model. The test set is input into the trained MSRNet-GLAM model for intrusion detection, and the performance of the intrusion detection model is evaluated by accuracy, recall, precision and F1 score. If the MSRNet-GLAM model can identify different types of intrusion traffic on the test set and shows good intrusion detection performance, the MSRNet-GLAM model will be used to realize intrusion detection in the train communication network.

[0092] In step S02 of the embodiment of the present invention, under the train communication network topology model, establishing a traffic model for mixed transmission of normal traffic and intrusion traffic specifically includes the following sub-steps:

[0093] S0201: According to the International Electrotechnical Commission standard IEC 61375, the business traffic of normal train operation is configured in the topology architecture of the train communication network as the normal sample in the data set, including monitoring data, process data, message data, stream data and best effort delivery data. The function of monitoring data and process data is to transmit key information such as train control commands and train safety status information. The main function of message data is to transmit fault diagnosis information. Stream data mainly transmits audio and video data related to train video monitoring and passenger entertainment activities. Best effort delivery data involves data configuration and file transfer;

[0094] S0202: Configure sniffing (Probe) intrusion traffic in the train communication network. Sniffing Probe intrusion is a detection-type intrusion method. Through high-frequency or low-frequency IP scanning and port scanning, request packets are sent to the link indiscriminately to obtain reply packets fed back in the link. By parsing these reply packets, active hosts and available ports in the network are detected to provide feasible intrusion targets for subsequent intrusions.

[0095] S0203: Configure Denial of Service (DoS) intrusion traffic in the train communication network. DoS intrusion is a flooding intrusion method that consumes the resources of the target device by sending a large number of invalid data packets, causing the target device to have huge delays or even crash, making it unable to provide services for normal requests. According to the type of attack packet protocol, DoS traffic based on UDP and TCP data is configured;

[0096] S0204: Configure Address Resolution Protocol Spoofing (ARP Spoofing) and replay intrusion traffic in the train communication network; Address Resolution Protocol Spoofing ARPSpoofing and Replay intrusion are man-in-the-middle intrusion methods. In data transmission, the Address Resolution Protocol (ARP) broadcasts the Address Resolution Protocol ARP request containing the target IP address in the network, and determines the physical address of the target terminal through the Address Resolution Protocol ARP reply sent by the target terminal corresponding to the target IP address;

[0097] S0205: Address Resolution Protocol Spoofing (ARP Spoofing) achieves identity spoofing by sending false Address Resolution Protocol (ARP) replies to the switching node, overwriting the identity information of the target terminal in the switching node cache. After receiving the data packet originally sent to the target host, the switching node will send it to the intruder instead. After intercepting the data packet, the intruder can implement a replay attack, that is, delaying or repeatedly re-injecting the intercepted data packet into the network, thereby invading the train communication network without cracking the information in the data packet.

[0098] In the present invention, the train communication network data packet refers to the basic unit of data transmission in the link of the train communication network, which includes the five-tuple of the data packet (source IP address, destination IP address, source port number, destination port number and transmission protocol) and header information such as data length, as well as the carried payload information. The five-tuple information of the data packet forms a unique identifier of a data connection. The train communication network flow data time windowing method provided by the present invention extracts features from a series of data packets with the same five-tuple within a time window. The time windowing schematic diagram is shown in FIG. Figure 3 In the present invention, the data packet parsing, normalization and time window preprocessing of the original data sample include the following sub-steps:

[0099] S0301: Collect traffic data packets in the link, use the network data packet parsing program framework Scapy to parse the information in the data packets, perform integer encoding on the discrete features of each data packet, such as IP address, port number, etc.; perform normalization on continuous features, such as data packet length, etc.;

[0100] S0302: Time window the data packet information in the link. The set of all data flows in the link is represented by F:

[0101] F={f1,f2,...,f m},f i ∈F (1)

[0102] Where i = 1, 2, ..., m, m represents the number of data flows on the link, f i Represents a separate data stream, each data stream f i Can be defined as a collection of packets:

[0103]

[0104] in Represents the data flow f i The jth packet in, for j∈1,2,...,n i , n i Indicates the number of packets per data stream. There is a timestamp

[0105] S0303: Transform the data stream f i It is divided into a series of time windows, each of which contains data packets within the time interval Δt. Define f i The kth time window in is W (i,k) :

[0106]

[0107] in Indicates d i The starting timestamp of the kth time window in , Δt represents the duration of the time window. Within the time window, the data packet Only included in W (i,k) middle.

[0108] S0304: Taking a time window as the minimum unit, perform independent statistical analysis on the discrete features of the data packets within the time window. These discrete features include the number, length, transmission time, transmission rate and identifier count of the data packets. After statistical analysis, data samples containing statistical features are obtained. The specific feature information of these data samples is shown in Table 1;

[0109] Table 1 Sample characteristics

[0110]

[0111] S0305: All data samples are combined in chronological order as an intrusion detection data set, and the data set is randomly shuffled and divided into a training set and a test set in a ratio of 6:4. The training set is used for the subsequent training of the MSRNet-GLAM model for train communication network intrusion detection, and the test set is used to evaluate the inspection performance of the MSRNet-GLAM model for train communication network intrusion detection.

[0112] In the present invention, Figure 4 : is a schematic diagram of the overall structure of the train communication network intrusion detection model provided by the present invention. The construction of the train communication network intrusion detection model specifically includes the following sub-steps:

[0113] S0401: The input of the MSRNet-GLAM model for train communication network intrusion detection is firstly subjected to multi-scale feature extraction through a multi-scale residual network to obtain multi-scale feature information of data samples. The structure of the multi-scale residual network consists of multiple layers of convolutional neural network layers with different convolution kernel sizes. Figure 5It is a schematic diagram of a multi-scale residual network in a train communication network intrusion detection model provided by the present invention. The process of multi-scale learning through a multi-scale residual network includes the following process: let the size of the convolution kernel be k, first there is 1 layer of point-by-point convolution layer, followed by 3 convolution network branches, the number of convolution layers stacked in these branches is 1, 3, and 1 respectively, in the multi-scale residual network, the point-by-point convolution layer of the first layer is used to adjust the dimension of the feature, and the dimensionally adjusted features are input into each convolution network branch to extract the deep and shallow multi-scale information in the high-dimensional features, these branches have different numbers of convolution layers and different sizes of convolution kernels, which are conducive to extracting the deep and shallow information in the high-dimensional features as the multi-scale features of the output data samples. Among them, the single-layer k=1 point-by-point convolution layer of the first branch is used to extract the input features of the shallow layer; the k of the 3-layer convolution layer of the second branch is equal to 3, 5, and 3 respectively, which is used to extract the input features of the deep layer; the single-layer convolution layer of the third branch has k=3, which is used to extract the input features of the middle layer. Then, the outputs of the three branches are superimposed and input into another point-by-point convolution layer, and residually connected with the output of the first point-by-point convolution layer. All convolution layers contain a batch normalization layer to increase the stability of MSRNet-GLAM model training by standardizing the input.

[0114] S0402: The input of the MSRNet-GLAM model for train communication network intrusion detection is extracted by the multi-scale residual module. The multi-scale feature information is input into the global and local attention modules to enhance the MSRNet-GLAM model's ability to capture key information between features and channels.

[0115] First, we build the Local Attention Module (LAM) and the Global Attention Module (GAM). Figure 6 This is a schematic diagram of the global and local attention mechanism module provided by the present invention. The multi-channel output feature information of the data sample is simultaneously input into the local attention module LAM and the global attention module GAM, and finally the outputs of the local attention module LAM and the global attention module GAM are concatenated through the concatenation layer Concatenate.

[0116] Among them, the local attention module LAM transforms the input through a pointwise convolution network (Pointwise Convolution) or a dilated convolution network (Dilation Convolution), that is, the input is locally mapped through the dilated convolution layer to generate a query vector and a key vector; the input is mapped through pointwise convolution to generate a query vector and a key vector, and then the input is mapped through pointwise convolution to generate a value vector:

[0117]

[0118] where q j , k j and v j They represent the query vector, key vector, and value vector obtained after transforming the input. The query vector, key vector, and value vector are mapped to a subspace as different representations of the input. This subspace is called the definition "attention head". The dilated convolution layer in each attention head uses a different dilation rate d j =(d1,d2,...,d m ,d j ∈R), which is used to extract local correlations between different features in the input at multiple scales, where m is the number of attention heads. The number of attention heads m is selected as 4, and the expansion rate d of the dilated convolution layer in each attention head is j The selected values ​​are 1, 2, 3 and 5 respectively.

[0119] Through q j and k j Perform dot product and scaling operations to obtain the attention weight matrix of each feature in the data sample to the other features; after the weight matrix is ​​normalized by the activation function softmax, it is compared with v j Perform weighted operations:

[0120]

[0121] Where: d q d k and d v Respectively represent q j , k j and v j The vector dimension of head j Represents the output of the attention head, head j ∈{head1,head2,...,head m}, concatenate the attention head through the Concatenate layer j The output of local attention is obtained by LAM output :

[0122] LAM output =Concatenate{head1,head2,...,head m} (6)

[0123] In the multi-scale features output by the multi-scale residual network module, the output of each convolution kernel represents a channel, and each channel carries feature maps of different granularities of data samples; the global attention module (Global Attention Module, GAM) inputs the feature map of each channel into the global average pooling layer (GAP) and the global maximum pooling layer (GMP) respectively to extract the overall features and key features of each channel, and use the overall features and key features as the global features of each channel. The global attention module GAM focuses on the correlation between global features and channels from a global level: point-by-point convolution is used to perform a convolution transformation on the feature map with a convolution kernel of 1 to achieve channel expansion:

[0124] x′=Pointwise Conv(x) (7)

[0125] Among them: x′ represents the output after point-by-point convolution processing; the average value and maximum value of the feature information of each channel are output through the global average pooling layer GAP and the global maximum pooling layer GMP respectively as the global feature of the channel. Through the multi-layer perceptron (MLP) composed of multiple layers of fully connected layers, the multi-layer perceptron MLP integrates the global features of the channel and extracts the correlation information between the global features between channels:

[0126] x′ p =MLP(GAP(x′))+MLP(GMP(x′)) (8)

[0127] x′ p Represents the correlation information between the overall features and key features after fusion by the multi-layer perceptron MLP; then, the output is upsampled to restore the data dimension of the features and keep the consistency of the data structure before and after the attention module is processed. Finally, the global feature correlation information of each channel is normalized by the activation function softmax as the correlation weight of the global feature between each channel. And these weights are weighted to each channel of the input through element multiplication to recalibrate the importance of each channel in the global feature:

[0128] GAM output =σ(Upsample(x′ p ))⊙x′ (9)

[0129] GAM output represents the output of the global attention module GAM; σ represents the Sigmoid activation function; ⊙ represents element-wise multiplication.

[0130] S0403: Concatenate the outputs of the local attention module LAM and the global attention module GAM using the concatenation layer:

[0131] Attention = Concatenate {LAM output ,GAM output} (10)

[0132] Among them, Attention represents the output after the local attention and global attention are spliced ​​together. The output of Attention integrates the local feature information between multi-scale features and the global feature information across channels, which improves the MSRNet-GLAM model's attention to the key feature information of data samples and reduces the fitting of non-key features.

[0133] S0404: Transform the multi-scale feature information of the multi-scale residual network output in S0401 through a point-by-point convolutional layer to match the data dimension of the Attention output; perform residual connection between the multi-scale feature information of the multi-scale residual network output after dimension transformation and the Attention output, and fuse the original multi-scale features output by the multi-scale residual module into the Attention output; perform layer normalization on the output after residual connection to prevent extreme values ​​from appearing in the output after residual connection; integrate the original multi-scale features, local feature information, and global feature information through a multi-layer perceptron MLP with a Softmax activation function after layer normalization, and output the probability distribution of the possibility that each sample belongs to each category. The category probability distribution of each data sample will be the final output of the MSRNet-GLAM model.

[0134] In the present invention, inputting the data samples of the training set into the MSRNet-GLAM model for training includes using the improved focal loss function IFL to perform multiple rounds of training optimization on the MSRNet-GLAM model, taking the minimization of the loss function output as the optimization goal, and outputting the detection results of the MSRNet-GLAM model on the data samples in each round of optimization training. The multiple rounds of training optimization on the MSRNet-GLAM model using the improved focal loss function IFL specifically include the following sub-steps:

[0135] S0501: Construct an improved focal loss function (IFL). The focal loss function takes the minimization of the difference between the detection result of the MSRNet-GLAM model and the actual value as the optimization goal, and optimizes the training process of the MSRNet-GLAM model. Some hidden intrusion traffic has high feature similarity with normal traffic and fuzzy boundaries, which is easy to be confused with normal traffic and difficult to detect. In order to solve the problem of detecting hidden intrusion traffic, the improved focal loss function IFL introduces a category balance factor α t The focus parameter γ is used to reduce the loss weight of easy-to-classify samples, and guide the intrusion detection model to focus on the minority class samples that are difficult to classify, thereby alleviating the problem of difficult classification of minority samples caused by class imbalance; and the similarity coefficient ω is introduced to increase the weight of easily confused samples to alleviate the problem of blurred boundaries between some intrusion traffic and normal traffic:

[0136]

[0137] The MSRNet-GLAM model outputs the possibility that each sample belongs to each category through the activation function softmax. These outputs are expressed as probability distribution P, P = {p1, p2, ..., p n}, n is the number of categories. j Represents the probability corresponding to the true category in the probability distribution P; p i,max represents the maximum probability of the error category. i,max and p j The relative distance of is used as a measure of the degree of confusion of the classification result. t represents the category balance factor, which is used to adjust the weights between different categories; γ represents an adjustable focusing parameter, which is used to smoothly adjust the contribution of easy-to-classify samples to the loss function. The value of the focusing parameter γ is 2; the category balance factor α t According to the normalized class imbalance, adjust the weight of each class on the basis value:

[0138]

[0139] Where N i is the number of samples in the i-th category, N max and N min Indicates the maximum and minimum values ​​of the number of samples of each type, N i ′ represents the normalized value of the number of samples in the i-th category; let the category balance factor Where n is the number of categories, i∈{1,2,...,n}, is the category weight of the i-th category, As The basic value of , let 1-Ni ′ is used as a compensation factor for the degree of imbalance to adjust the weight of each category based on the basic value.

[0140] S0502: Use different labels to mark each intrusion type, randomly shuffle the labeled intrusion detection data set, and then divide the labeled intrusion data set into two parts: training set and test set according to the ratio of 6:4. Use the training set and the improved focal loss function to train and optimize the MSRNet-GLAM model to obtain the trained MSRNet-GLAM model. Input the test set into the MSRNet-GLAM model to evaluate the intrusion performance indicators. If the MSRNet-GLAM intrusion detection model shows good intrusion detection evaluation results on both the training set and the test set, the intrusion detection model based on MSRNet-GLAM will be used to realize intrusion detection of train communication networks. The evaluation of the intrusion performance indicators is mainly carried out through the evaluation indicators of accuracy, recall, precision and F1 score. The calculation process of each evaluation indicator is as follows:

[0141]

[0142] Among them, TP (True Positive) represents the number of true positive examples, that is, the number of correctly predicted positive examples. TN (True Negative) represents the number of true negative examples, that is, the number of correctly predicted negative examples. FP (False Positive) represents the number of false positive examples, that is, the number of incorrectly predicted positive examples. FN (False Negative) represents the number of false negative examples, that is, the number of incorrectly predicted negative examples. Among these evaluation indicators, accuracy focuses on the overall classification accuracy, but it may be misleading in imbalanced classes. Precision focuses on the false alarm rate of detection. High precision is suitable for scenarios where false alarms need to be reduced; while recall focuses on the coverage of samples of the correct category. High recall is suitable for scenarios where missed alarms need to be avoided as much as possible. In intrusion detection of train communication networks, both missed alarms and excessive false alarms should be avoided. Missed alarms may lead to abnormal traffic intrusion, while excessive false alarms will cause resource waste and alarm fatigue. The F1 score is the harmonic mean of precision and recall, which comprehensively considers the accuracy and coverage of the classifier. If the MSRNet-GLAM model has good performance in terms of accuracy, recall, precision and F1 score on both the training set and the test set, the intrusion detection model based on MSRNet-GLAM will be used to implement intrusion detection in the train communication network.

[0143] For the above step S05, normal traffic and five types of intrusion traffic are marked. Specifically, the label of normal traffic is 0, the label of UDP DoS intrusion traffic is 1, the label of SYN DoS intrusion traffic is 2, the label of ARP Spoofing intrusion traffic is 3, the label of Replay intrusion traffic is 4, and the label of Probe intrusion traffic is 5; the category distribution of the data set after data preprocessing is shown in Table 2.

[0144] Table 2. Dataset sample category distribution

[0145]

[0146] The data set is randomly shuffled and divided into a training set and a test set in a ratio of 6:4; in order to verify the effectiveness of the train communication network intrusion detection method proposed in the present invention, the method is compared with the existing deep learning methods, namely AlexNet-GRU, CNN-LSTM, Temporal CNN, TGA and Res-TranBiLSTM. In addition, in order to verify that the proposed improved focal loss function IFL function is effective, the intrusion detection method (MSRNet-GLAM-IFL) configured with the improved focal loss function IFL function proposed in the present invention is compared with the intrusion detection method (With-CE and With-FL) configured with the Focal Loss function and the cross entropy loss function. Table 3 shows the performance comparison of each deep learning intrusion detection model in train communication network intrusion detection.

[0147] Table 3 Performance comparison of different methods in train communication network intrusion detection

[0148]

[0149] It can be seen from Table 3 that in the process of train communication network intrusion detection, the detection accuracy, precision, recall rate and F1 score of the MSRNet-GLAM-IFL model proposed in the present invention are the highest, which are 99.51%, 98.98%, 99.54% and 99.26% respectively, which are better than other deep learning-based intrusion detection models used for comparison.

[0150] Through the performance comparison of different methods in train communication network intrusion detection, it is verified that the train communication network intrusion detection method based on multi-scale residual network and global and local attention mechanism proposed in the present invention is superior, can effectively detect the intrusion traffic of the train communication network, and the accuracy also meets the actual application requirements.

[0151] The above is only a preferred embodiment of the present invention and is not intended to limit the present invention. It should be noted that for those skilled in the art, several improvements, equivalent substitutions and modifications made without departing from the principles of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A train communication network intrusion detection method based on a multi-scale residual network, characterized in that: The intrusion detection method comprises the following steps: S01: Establish a train communication network topology model and define the performance parameters of the switching nodes, terminal devices and links in the train communication network topology model; S02: Under the train communication network topology model, a traffic model for mixed transmission of normal traffic and intrusion traffic is established; S03: Collecting traffic data packets in the link as original data samples in the intrusion detection data set, and performing data packet parsing, normalization and time window preprocessing on the original data samples to obtain data samples containing statistical features; S04: All data samples are combined in chronological order as an intrusion detection data set, and the data set is randomly shuffled and divided into a training set and a test set in a ratio of 6:4; S05: Construct the MSRNet-GLAM model for train communication network intrusion detection, input the data samples of the training set into the MSRNet-GLAM model for training, output the detection results of the data samples in each round of training of the MSRNet-GLAM model, and input the data samples of the test set into the MSRNet-GLAM model for train communication network intrusion detection for intrusion detection, and check and evaluate the performance of the MSRNet-GLAM model for train communication network intrusion detection. If it shows good intrusion detection performance, the intrusion detection of the train communication network is realized.

2. According to claim 1, a train communication network intrusion detection method based on a multi-scale residual network is characterized in that: In the step S01, the train communication network topology structure is composed of a train backbone network and a vehicle marshaling network interconnected in an upper and lower manner. The switching nodes of each vehicle marshaling network are respectively connected to the subordinate terminal devices ED, which are responsible for data transmission; the definition of the switching nodes mainly includes the number of switching nodes, the number of switching node ports and the IP address configuration; the definition of the terminal devices mainly includes the number of terminal nodes and the IP address configuration of the terminal nodes; the definition of the link parameters mainly includes the number of links, link bandwidth and link delay.

3. According to claim 1, a train communication network intrusion detection method based on a multi-scale residual network is characterized in that: In the step S02, the normal traffic includes monitoring data, process data, message data, flow data and best effort delivery data; Intrusion traffic includes: sniffing intrusion traffic, denial of service traffic, address resolution protocol spoofing traffic and replay intrusion traffic. Establishing a traffic model for mixed transmission of normal traffic and intrusion traffic includes the following sub-steps: S0201: configure the business flow of normal train operation in the train communication network as a normal sample in the normal flow data set; S0202: Configure sniffing intrusion traffic in the train communication network. Sniffing intrusion is a detection-type intrusion method. Through IP scanning and port scanning, request packets are sent to the link indiscriminately to obtain reply packets fed back in the link. These reply packets are then parsed to detect active hosts and available ports in the network, providing feasible intrusion targets for subsequent intrusions. S0203: Configure denial of service intrusion traffic in the train communication network. Denial of service intrusion DoS is a flooding intrusion method. It consumes the resources of the target device by sending a large number of invalid data packets, causing the target device to have a huge delay or even crash, making it unable to provide services for normal requests; S0204: Configure address resolution protocol spoofing traffic and replay intrusion traffic in the train communication network; S0205: Address Resolution Protocol spoofing traffic achieves identity spoofing by sending false ARP replies to the switching node, overwriting the identity information of the target terminal in the switching node cache; after the switching node receives the data packet originally sent to the target host, it forwards it to the intruder. After the intruder intercepts the data packet, it implements a replay attack, that is, delaying or repeatedly injecting the intercepted data packet into the network, thereby invading the train communication network without cracking the information in the data packet.

4. According to claim 1, a train communication network intrusion detection method based on a multi-scale residual network and a global and local attention mechanism is characterized in that: In step S03, the data packet parsing, normalization and time window preprocessing of the original data sample include the following sub-steps: S0301: Collect traffic data packets in the link, use the network data packet parser framework to parse the information in the data packets, and perform integer encoding on the discrete features of each data packet, such as IP address, port number, etc.; then normalize the continuous features; S0302: Time-window the data packet information in the link. The set of all data flows in the link is represented by F: F={f1,f2,...,f m },f i ∈F, (1); Where i = 1, 2, ..., m, m represents the number of data flows on the link, f i Represents a separate data stream, each data stream f i Defined as a collection of multiple packets: in Represents the data flow f i The jth packet in, for j∈1,2,...,n i , n i Indicates the number of packets per data stream. There is a timestamp S0303: Transform the data stream f i Divide it into a series of time windows, so that each time window contains the data packets within the time interval Δt, and then define f i The kth time window in is W (i,k) : in Indicates d i The starting timestamp of the kth time window in , Δt represents the duration of the time window, when the timestamp Within the time window, the data packet Included in W (i,k) middle; S0304: Taking a time window as the minimum unit, independently statistically analyzing the discrete features of the data packets within the time window, wherein the discrete features include the number, length, transmission time, transmission rate, and identifier counting statistical analysis of the data packets, and obtaining a data sample containing statistical features; S0305: All data samples are combined in chronological order as an intrusion detection data set, and the data set is randomly shuffled and divided into a training set and a test set in a ratio of 6:

4. The training set is used for the subsequent training of the MSRNet-GLAM model for train communication network intrusion detection, and the test set is used to evaluate the inspection performance of the MSRNet-GLAM model for train communication network intrusion detection.

5. According to claim 1, a train communication network intrusion detection method based on a multi-scale residual network is characterized in that: In the step S05, constructing the train communication network intrusion detection MSRNet-GLAM model specifically includes the following sub-steps: S0501: As the input of the MSRNet-GLAM model for train communication network intrusion detection, the data samples of the training set are firstly subjected to multi-scale learning through a multi-scale residual network to obtain the multi-scale feature information of the data samples; S0502: Input the multi-scale feature information of the data sample into the global and local attention modules for weighted processing respectively, so as to enhance the attention to the important information in the multi-scale feature information.

6. The train communication network intrusion detection method based on a multi-scale residual network according to claim 5 is characterized in that: Inputting the multi-scale feature information of data samples into the global and local attention modules for weighted processing includes the following steps: S0503, constructing a local attention module (LAM) and a global attention module (GAM), and then inputting the multi-scale feature information of the data sample into the local attention module LAM and the global attention module (GAM) at the same time, and then concatenating the outputs of the local attention module LAM and the global attention module GAM through the concatenation layer; The local attention module LAM first transforms the input through a point-by-point convolutional network or a dilated convolutional network to generate different representations of the input and map it to a subspace; S0504, in each attention head, the input is mapped to local features through the dilated convolution layer to generate a query vector and a key vector, and then the input is mapped through point-by-point convolution to generate a value vector: where q j , k j and v j They represent the query vector, key vector, and value vector obtained after transforming the input in the attention head. The dilation convolution layer in each attention head uses a different dilation rate Used to extract local correlations between different features at multiple scales, where m represents the number of attention heads; Through q j and k j Perform dot product and scaling operations to obtain the attention weight matrix of each feature in the data sample to the other features; after normalizing the attention weight matrix through the activation function softmax, it is compared with v j Perform weighted operations: Where: d q d k and d v Respectively represent q j , k j and v j The vector dimension of head j Represents the output of the attention head, head j ∈{head1,head2,...,head m }, concatenate the attention heads through the concatenation layer j The output of local attention is obtained by LAM output : LAM output =Concatenate{head1,head2,...,head m }, (6); Again, the global attention module GAM includes a global average pooling layer and a global maximum pooling layer. In the output of the multi-scale residual network module, the output of each convolution kernel represents a channel; each channel carries feature maps of different granularities of data samples. The global attention module GAM inputs the feature map of each channel into the global average pooling layer and the global maximum pooling layer respectively, and uses the output of the global average pooling layer and the global maximum pooling layer as the overall features and key features of each channel, that is, the global features of each channel. The global attention module GAM focuses on the correlation of global features between channels from a global level, and uses point-by-point convolution to perform convolution transformation on the feature map with a convolution kernel of 1 to achieve channel expansion, specifically satisfying: x′=Pointwise Conv(x), (7); Among them: x′ represents the output after point-by-point convolution processing; the average value and maximum value of the feature information of each channel are output through the global average pooling layer GAP and the global maximum pooling layer as the global feature of the channel; the multi-layer perceptron composed of multiple layers of fully connected layers integrates the global features of the channel and extracts the correlation information between the global features between channels: x′ p =MLP(GAP(x′))+MLP(GMP(x′)), (8); x′ p It represents the correlation information between the overall features and key features in the channels after being integrated by the multi-layer perceptron. Then, the output is upsampled to restore the data dimension of the features. S0505, through the activation function softmax, the correlation information of the global features between channels is normalized as the correlation weight of the global features between each channel. And these weights are weighted to each input channel through element multiplication to recalibrate the importance of each channel in the global features: GAM output =σ(Upsample(x′ p ))⊙x′, (9); GAM output represents the output of the global attention module GAM; σ represents the Sigmoid activation function; ⊙ represents element-wise multiplication; S0506: Concatenate the outputs of local attention and global attention using the concatenation layer, and the concatenation satisfies: Attention=Concatenate{LAM output ,GAM output }, (10); Among them, Attention represents the output after the local attention and global attention are spliced ​​together. The output of Attention integrates the local feature information between multi-scale features and the global feature information across channels. S0507: Transform the data dimension of the multi-scale feature information output by the multi-scale residual network through a point-by-point convolution layer to match the data dimension of the Attention output; perform residual connection on the multi-scale feature information output by the multi-scale residual network after the dimension transformation and the Attention output, fuse the original multi-scale features output by the multi-scale residual module into the Attention output, and perform layer normalization on the output after the residual connection; S0508: The output after layer normalization integrates the original multi-scale features, local feature information and global feature information through a multi-layer perceptron with a Softmax activation function, and outputs the probability distribution of the possibility that each sample belongs to each category, that is, the category probability distribution of each data sample will be used as the final output of the MSRNet-GLAM model.

7. A train communication network intrusion detection method based on a multi-scale residual network according to claim 5 or 6, characterized in that: The multi-scale residual network is composed of multiple layers of convolutional neural network layers with different convolution kernel sizes. The process of multi-scale learning through the multi-scale residual network includes the following process: First, let the size of the convolution kernel be k, the first layer is a point-by-point convolution layer with k=1, followed by three convolution layer branches; in the multi-scale residual network, the first layer of the point-by-point convolution layer is used to adjust the dimension of the feature, and the dimension-adjusted features are input into each convolution network branch to extract deep and shallow multi-scale information from the high-dimensional features; Secondly, let the number of convolutional layers stacked in the three branches be 1, 3, and 1 respectively; among them, the single-layer point-by-point convolutional layer with k=1 of the first branch is used to extract the input features of the shallow layer; the three-layer convolutional layer with k=3, 5, and 3 of the second branch is used to extract the input features of the deep layer; the single-layer convolutional layer with k=3 of the third branch is used to extract the input features of the middle layer; Finally, the outputs of the three convolutional layer branches are superimposed and input into another point-by-point convolutional layer, and residually connected with the output of the first point-by-point convolutional layer. All of the above convolutional layers contain a batch normalization layer to increase the stability of MSRNet-GLAM model training by standardizing the input.

8. The train communication network intrusion detection method based on a multi-scale residual network according to claim 1 is characterized in that: In the step S05, the data samples of the training set are input into the MSRNet-GLAM model for training, including using the improved focal loss function IFL to perform multiple rounds of training optimization on the MSRNet-GLAM model, with minimization of the loss function output as the optimization goal, and outputting the detection results of the MSRNet-GLAM model on the data samples in each round of optimization training.

9. The train communication network intrusion detection method based on a multi-scale residual network according to claim 8 is characterized in that: The multi-round training optimization of the MSRNet-GLAM model using the improved focal loss function IFL includes the following sub-steps: S0509: Construct an improved focal loss function. The focal loss function takes the minimization of the difference between the detection result of the MSRNet-GLAM model and the actual value as the optimization goal, and introduces the improved focal loss function IFL into the category balance factor α t The focusing parameter γ is used to reduce the loss weight of easy-to-classify samples, guiding the MSRNet-GLAM model in training to focus on minority class samples that are difficult to classify, thereby alleviating the problem of difficult classification of minority samples caused by class imbalance. S0510: The similarity coefficient ω is introduced to increase the weight of easily confused samples to alleviate the problem of blurred boundaries between some intrusion traffic and normal traffic, and meet the following requirements: The MSRNet-GLAM model outputs the possibility that each sample belongs to each category through the activation function softmax. These outputs are expressed as probability distribution P, P = {p1, p2, ..., p n }, where n is the number of categories; p j Represents the probability corresponding to the true category in the probability distribution P; p i,max Represents the maximum probability of the error category; α t represents the category balance factor; γ represents the adjustable focusing parameter; S0511: Each intrusion type is labeled with a different label, the labeled intrusion detection dataset is randomly shuffled, and then the labeled intrusion dataset is divided into a training set and a test set in a ratio of 6:4; S0512: Use the improved focal loss function to optimize the training process of the MSRNet-GLAM model to obtain the trained MSRNet-GLAM model; S0513: Input the test set into the MSRNet-GLAM model to evaluate the intrusion performance indicators. If the intrusion detection model of MSRNet-GLAM shows good intrusion detection evaluation results on both the training set and the test set, the intrusion detection model based on MSRNet-GLAM will be used to implement intrusion detection of the train communication network.

10. The train communication network intrusion detection method based on a multi-scale residual network according to claim 9 is characterized in that: The intrusion performance indicators including accuracy, recall, precision and F1 score indicators are used to evaluate the performance of the MSRNet-GLAM intrusion detection model.

Images