An intelligent network threat tracing method and system

Abstract

The present invention relates to the technical field of network intrusion detection and countermeasure processing, and discloses an intelligent network threat tracing method and system, the system comprising a railway network threat monitoring behavior processing module, a railway network attack type identification module, and a railway network attack tracing processing module; intelligent identification of railway network attack types is performed according to real-time data of railway network main operation combined with an intelligent identification algorithm and operation data of different railway network attack types based on big data storage, so as to realize efficient and accurate identification of railway network attack types; accurate analysis of railway network attack source tracing schemes is performed according to network attack type identification information of target railway network main body combined with an intelligent search algorithm and railway network attack source tracing scheme information based on big data storage, so as to realize scientific and refined formulation of railway network attack tracing schemes based on railway network objects and railway network attack types.

Description

Technical Field

[0001] The present invention relates to the technical field of network intrusion detection and countermeasure processing, and in particular to an intelligent network threat tracing method and system. Background Art

[0002] With the development of information technology, railway network security has become an indispensable part of the railway system. With the expansion and complexity of the railway network, railway network security threats refer to threats from outside the railway network, including hacker attacks, virus infections and phishing. Hacker attacks may cause train information to be modified or train signal systems to be destroyed, posing a serious threat to railway operations. Virus infections may paralyze the railway network and cause serious transportation delays. Phishing may lead to the leakage of railway users' personal information and damage user rights. In response to these external security threats, the railway system should strengthen network security protection. Establish an efficient firewall and intrusion detection system to timely discover, trace and prevent network attacks and threats. Regularly check and update system patches to improve the system's anti-attack capabilities. Digitally sign and encrypt train information to ensure the integrity and confidentiality of information. The existing railway network threat tracing system cannot achieve differentiated setting of network threat monitoring action sequences for network entities, nor can it achieve intelligent identification of network attack types and accurately formulate network attack tracing plans.

[0003] A Chinese invention patent with announcement number CN114528548B discloses a network security threat tracing device for an electric power monitoring system. The device accurately determines the impact of faults in the power grid by constructing a fault occurrence tree, scientifically determines the degree of impact of the fault occurrence chain, and marks the corresponding power equipment in the occurrence chain to facilitate the prevention of real-time faults. It performs forward and reverse tracing of faulty equipment both outside and inside the tree, and reduces the scope of maintenance queries through analysis, thereby improving maintenance efficiency. However, the above technical solutions cannot achieve intelligent identification of network security threat types and cannot accurately formulate network security threat tracing solutions. Summary of the invention

[0004] 1. Technical issues to be resolved In order to solve the problems that the above-mentioned existing railway network threat tracing system cannot realize the differentiated setting of network threat monitoring action sequence for network entities, cannot realize intelligent identification of network attack types and cannot accurately formulate network attack tracing plans, the above differentiated setting of railway network threat monitoring action sequence, accurate monitoring of railway network attack status, intelligent identification of railway network attack types, and accurate formulation of railway network attack tracing plans are realized to improve the anti-intrusion capability and stability of railway network operation.

[0005] (II) Technical solution The present invention is implemented by the following technical solution: an intelligent network threat tracing method, the method comprising the following steps: S1. Collecting railway network main feature text data; S2, performing a network threat monitoring operation action timing matching process for the railway network subject based on the railway network subject feature text data and the railway network subject network threat monitoring action timing data, generating the target railway network subject network threat monitoring action timing data and executing the railway network threat monitoring operation; S3, collect real-time data of railway network operation; S4, performing network attack status judgment processing on the railway network subject according to the real-time operation data of the railway network subject and the railway network attack status operation data, generating network attack status judgment data of the target railway network subject, and continuing to perform railway network threat monitoring operations when it is in a normal state; S5. When in the attack state, the network attack type identification processing of the railway network subject is performed according to the real-time operation data of the railway network subject and the operation data of different railway network attack types, and the network attack type identification data of the target railway network subject is generated; S6. Analyze and process the network attack source tracing scheme of the railway network subject according to the network attack type identification data of the target railway network subject and the network attack source tracing scheme data of the railway network subject, and generate the network attack source tracing scheme data of the target railway network subject; S7. Construct railway network main body attack tracing assessment data and perform railway network attack tracing operations.

[0006] Preferably, the operation steps of collecting railway network main feature text data are as follows: S11. Collect the identity feature text information of the target railway network subject online through the railway network supervision platform, and generate railway network subject feature text data The railway network subject includes any one of the train network control system, railway communication system, China train control system, railway power supply telecontrol system, and marshalling yard automation system; the railway network subject feature text data includes the name feature text data, number feature text data, and function information feature text data of the railway network subject.

[0007] Preferably, the operation steps of performing a railway network subject network threat monitoring operation action timing matching process based on the railway network subject feature text data and the railway network subject network threat monitoring action timing data, generating a target railway network subject network threat monitoring action timing data and executing the railway network threat monitoring operation are as follows: S21. Establish a time series data set of network threat monitoring actions for railway network entities , ;in Indicates The railway network subject network threat monitoring action time series data corresponding to the railway network subject, represents the maximum number of railway network entities; the railway network entity network threat monitoring action time series data represents the standard network threat monitoring action daily time control parameters set for different types of railway network entities; wherein The units are hours, minutes and seconds; S22, using the Boyer-Moore search algorithm to search the railway network main feature text data A collection of network threat monitoring action time series data of the railway network subject The railway network main body network threat monitoring action time series data Perform railway network main feature character matching to search for the railway network main feature text data Corresponding railway network main body network threat monitoring action time series data , and generate the target railway network main body network threat monitoring action time series data through data identification ,in The units are hours, minutes and seconds; S23, the railway network supervision platform monitors the network threat action time series data of the target railway network subject and the railway network main feature text data Perform railway network threat monitoring operations on target railway network entities.

[0008] Preferably, the operation steps of collecting real-time data of railway network operation are as follows: S31. When performing the network threat monitoring operation of the target railway network entity, the real-time operation process data of the target railway network entity is collected online through the railway network supervision platform, and the real-time operation data of the railway network entity is generated. The real-time data of railway network operation includes real-time network traffic data, real-time system log data and real-time intrusion detection system log data of the target railway network operation.

[0009] Preferably, the network attack status of the railway network subject is judged and processed based on the real-time operation data of the railway network subject and the operation data of the railway network attack status, and the network attack status judgment data of the target railway network subject is generated. When it is in a normal state, the operation steps of continuing to perform the railway network threat monitoring operation are as follows: S41. Establishing a railway network attack status operation data set , ;in Indicates Railway network attack status operation data, Indicates the maximum value of the number of railway network attack state operation data; the railway network attack state operation data represents the real-time operation process processing data of the railway network subject under the network attack state; S42, using a breadth-first search algorithm to search the real-time data of the railway network main body Running data collection with the railway cyber attack status Railway network attack status operation data described in Carry out network operation data matching, and generate the target railway network main body network attack status judgment data based on the network operation data matching results ; when and If the network operation data are not matched successfully, it means that the railway network entity is not currently under network attack, then the network attack status judgment data of the target railway network entity is output. It is in normal state, and the railway network threat monitoring operation continues; when and If the network operation data is matched successfully, it means that the railway network entity is currently under network attack, and the network attack status judgment data of the target railway network entity is output. In attack state.

[0010] Preferably, when the attack state is reached, the network attack type identification processing of the railway network subject is performed according to the real-time operation data of the railway network subject and the operation data of different railway network attack types, and the operation steps of generating the target railway network subject network attack type identification data are as follows: S51, when the target railway network main body network attack status judgment data When in attack state, establish a data set of different railway network attack types , ;in Indicates The operation data of different railway network attack types corresponding to the railway network attack types are Indicates the maximum number of railway network attack types; railway network attack types include DDoS attack types, phishing attack types, malware attack types, zero-day attack types and APT attack types; the different railway network attack type operation data represents the standard real-time operation process processing data of the railway network subject under different types of railway network attack states; S52: Real-time operation data of the railway network Data collection related to the different types of railway cyber attacks Operational data of different railway cyber attack types described in Match network operation data and search for real-time operation data of the railway network Matching operation data of different railway cyber attack types The corresponding railway network attack type text information is used to generate the target railway network subject network attack type identification data through data identification. , execute and generate the target railway network subject network attack type identification data The specific steps are as follows: S521, initialization, setting the maximum number of iterations T; S522, after initialization, execute the network attack type search moth to run the data set of the different railway network attack types Select the different railway network attack types in the search space to run data Flame, runs data collection on different railway cyber attack types Initial generation in the solution space Types of network attacks search moth and A flame, and = , running data collection on different railway cyber attack types Search the search space for real-time data related to the operation of the railway network Matching operation data of different railway cyber attack types , the cyber attack type search moth runs a data collection on the different railway cyber attack types The search space runs data around the different railway cyber attack types selected. Flame flying, Types of network attacks search moth and The flames are sorted by quality, and the sorted The flame moves to the front of the optimal position Each network attack type search moth selects a different flame. As the number of iterations increases, the number of flames decreases. The formula for calculating the number of flames is as follows: ,in Indicates The first iteration runs the data set for the different railway cyber attack types The number of flames in the search space, represents a random function with values ​​between 0 and 1, Represents a collection of data on the different types of railway cyber attacks The total number of flames initially generated in the search space; S523, network attack type search moth selects the different railway network attack type operation data Flame Post runs data collection on different railway cyber attack types Running data around the different railway cyber attack types selected in the search space Flame Flight, a search engine for cyber attack types, runs a data collection on different railway cyber attack types Searching for positions in space , Cyber ​​attack type search moths around the flame in the different railway cyber attack types running data collection Searching for positions in space And the network attack type search moth flying around the flame after the different railway network attack types run data collection New position in the search space , the new position calculation formula is as follows: ,in Indicates the type of network attack search moth With flame Running data collection on the different railway cyber attack types The distance value in the search space, represents the exponential function, represents the number of iterations, where The coefficient is 2. Indicates angle value The corresponding cosine value, represents pi; S524, network attack type search moth running data collection of different railway network attack types Running data on different railway cyber attack types described in the search space Flame to run real-time data with the railway network main body Matching position, Only network attack types search moth around After the flames flew, update to new position, calculate this The fitness value of the new position is New locations and Flame basis + The positions are sorted by quality and the ones with good quality are The positions are used as the positions of the flames in the next round, that is, the data sets are run on different railway network attack types. Search the search space for real-time data related to the operation of the railway network The most matching operational data for the different railway cyber attack types ; S525: When the maximum number of iterations is reached, output the real-time data of the railway network operation Matching operation data of different railway cyber attack types , otherwise, the steps S522 to S524 are executed in a loop; S526: Outputting the operation data of different railway network attack types described in step S525 The corresponding railway network attack type text information is used to generate the target railway network subject network attack type identification data through data identification. .

[0011] Preferably, the network attack source tracing scheme data of the target railway network subject is analyzed and processed based on the network attack type identification data of the target railway network subject and the railway network attack source tracing scheme data, and the operation steps of generating the network attack source tracing scheme data of the target railway network subject are as follows: S61. Establish a data set for tracing the source of railway network attacks ,in Indicates Railway network attack source tracing solution data corresponding to the railway network attack types, the railway network attack source tracing solution data represents the optimal network attack tracing solution execution text information for locating the identity information and location information of the network attacker set under different types of railway network attack states, and the network attack tracing solution includes traffic analysis, intrusion detection, honeypot technology, network behavior analysis, IP positioning, ID positioning, attack program analysis, time pattern recognition, IP geographic location positioning and GPS positioning; S62, using a bidirectional search algorithm to identify the network attack type of the target railway network entity Data collection of the railway network attack source tracing solution Data of the railway network attack source tracing solution described in Perform railway network attack type keyword matching to search for the target railway network entity network attack type identification data Corresponding railway network attack source tracing solution data , and construct a target railway network main body network attack source tracing solution data .

[0012] Preferably, the steps of constructing railway network subject attack tracing assessment data and performing railway network attack tracing operations are as follows: S71. Obtaining the railway network main body feature text data , the target railway network entity network attack status judgment data , identification data of the network attack type of the target railway network entity and the target railway network entity network attack source tracing solution data And perform data combination processing to construct railway network main body attack tracing assessment data ,in ; S72. The railway network supervision platform uses the railway network subject attack tracing assessment data Carry out railway network attack tracing operations.

[0013] An intelligent network threat tracing system, used to implement the intelligent network threat tracing method, the system includes a railway network threat monitoring behavior processing module, a railway network attack type identification module, and a railway network attack tracing processing module; The railway network threat monitoring behavior processing module includes a railway network subject feature information collection unit, a railway network subject network threat monitoring action timing storage unit, a target railway network subject network threat monitoring action timing matching unit, and a railway network threat monitoring operation execution unit; The railway network subject characteristic information collection unit collects railway network subject characteristic text data through the railway network supervision platform; the railway network subject network threat monitoring action timing storage unit is used to store the railway network subject network threat monitoring action timing data; the target railway network subject network threat monitoring action timing matching unit performs network threat monitoring operation action timing matching processing of the railway network subject based on the railway network subject characteristic text data and the railway network subject network threat monitoring action timing data, and generates the target railway network subject network threat monitoring action timing data; the railway network threat monitoring operation execution unit executes the railway network threat monitoring operation according to the target railway network subject network threat monitoring action timing data and in combination with the railway network supervision platform; The railway network attack type identification module includes a railway network main body operation real-time information collection unit, a railway network attack status operation information storage unit, a railway network attack status judgment unit, a railway network attack type operation information storage unit, and a railway network attack type identification unit; The railway network main body operation real-time information collection unit collects the railway network main body operation real-time data through the railway network supervision platform; the railway network attack status operation information storage unit is used to store the railway network attack status operation data; the railway network attack status judgment unit performs network attack status judgment processing of the railway network main body according to the railway network main body operation real-time data and the railway network attack status operation data, and generates the target railway network main body network attack status judgment data; the railway network attack type operation information storage unit is used to store different railway network attack type operation data; the railway network attack type identification unit performs network attack type identification processing of the railway network main body according to the railway network main body operation real-time data and different railway network attack type operation data, and generates the target railway network main body network attack type identification data; The railway network attack source tracing processing module includes a railway network attack source tracing solution storage unit, a target railway network subject network attack source tracing solution analysis unit, and a target railway network subject network attack source tracing execution unit; The railway network attack source tracing scheme storage unit is used to store railway network attack source tracing scheme data; the target railway network subject network attack source tracing scheme analysis unit performs network attack source tracing scheme analysis and processing on the railway network subject based on the target railway network subject network attack type identification data and the railway network attack source tracing scheme data to generate target railway network subject network attack source tracing scheme data; the target railway network subject network attack source tracing execution unit constructs railway network subject attack tracing evaluation data based on the characteristic information of the railway network subject, the network attack judgment status, the network attack identification type and the network attack tracing scheme information, and performs railway network attack tracing operations in combination with the railway network supervision platform.

[0014] (III) Beneficial effects The present invention provides an intelligent network threat tracing method and system, which has the following beneficial effects: 1. Obtain the characteristic information of the railway network subject to be monitored online through the railway network supervision platform to provide reliable data support for the scientific matching of the railway network subject network threat monitoring action sequence; flexibly match the railway network subject network threat monitoring operation action sequence based on the railway network subject characteristic text information combined with the intelligent search algorithm and the standard setting of the railway network subject network threat monitoring action sequence information, so as to achieve differentiated and scientific control of the railway network subject network threat monitoring action frequency, and at the same time combine with the railway network supervision platform to autonomously and accurately execute the railway network threat monitoring operation, so as to improve the efficiency and scientificity of railway network threat tracing and processing.

[0015] 2. Accurately obtain the real-time operation data of the target railway network entity through the railway network supervision platform, and combine the intelligent search algorithm with the scientifically preset railway network attack status operation data to accurately detect the railway network entity network attack status, so as to achieve accurate monitoring of the railway network operation status. According to the real-time operation data of the railway network entity combined with the intelligent recognition algorithm and the operation data of different railway network attack types based on big data storage, the railway network attack type is intelligently identified, so as to achieve efficient and accurate identification of railway network attack types and improve the accuracy and effectiveness of railway network threat tracing processing.

[0016] 3. Accurately analyze the railway network attack source tracing scheme based on the target railway network subject network attack type identification information combined with intelligent search algorithms and railway network attack source tracing scheme information based on big data storage, and scientifically and meticulously formulate railway network attack tracing schemes based on railway network objects and railway network attack types, thereby improving the quality and reliability of railway network threat tracing processing; scientifically and timely construct railway network subject attack tracing assessment information based on the characteristic information of railway network subjects, network attack judgment status, network attack identification type and network attack tracing scheme information, and efficiently and accurately perform railway network attack tracing operations in combination with the railway network supervision platform, thereby improving the emergency response efficiency of railway network threat tracing processing and enhancing the anti-intrusion capability and stability of railway network operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A schematic diagram of a module of an intelligent network threat tracing system provided by the present invention; Figure 2 A flowchart of an intelligent network threat tracing method provided by the present invention. DETAILED DESCRIPTION

[0018] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] The embodiments of the intelligent network threat tracing method and system are as follows: Embodiment 1: See also Figure 1 - Figure 2 , an intelligent network threat tracing method, the method comprising the following steps: S1. Collecting railway network main feature text data; S2, based on the railway network subject feature text data and the railway network subject network threat monitoring action time series data, perform network threat monitoring operation action time series matching processing on the railway network subject, generate target railway network subject network threat monitoring action time series data and execute the railway network threat monitoring operation; S3, collect real-time data of railway network operation; S4. Perform network attack status judgment processing on the railway network subject based on the real-time operation data of the railway network subject and the railway network attack status operation data, generate network attack status judgment data of the target railway network subject, and continue to perform railway network threat monitoring operations when it is in a normal state; S5. When in the attack state, the network attack type identification processing of the railway network subject is performed according to the real-time operation data of the railway network subject and the operation data of different railway network attack types, and the network attack type identification data of the target railway network subject is generated; S6. Analyze and process the network attack source tracing scheme of the railway network subject based on the network attack type identification data of the target railway network subject and the network attack source tracing scheme data of the railway network subject, and generate the network attack source tracing scheme data of the target railway network subject; S7. Construct railway network main body attack tracing assessment data and perform railway network attack tracing operations.

[0020] For further information, see Figure 1 - Figure 2 ,The steps for collecting the main feature text data of the railway network are as follows: S11. Collect the identity feature text information of the target railway network subject online through the railway network supervision platform, and generate railway network subject feature text data The railway network subject includes any one of the train network control system, railway communication system, China train control system, railway power supply telecontrol system, and marshalling yard automation system; the railway network subject feature text data includes the name feature text data, number feature text data, and function information feature text data of the railway network subject.

[0021] Based on the railway network subject feature text data and the railway network subject network threat monitoring action time series data, the railway network subject network threat monitoring operation action time series matching processing is performed to generate the target railway network subject network threat monitoring action time series data and execute the railway network threat monitoring operation. The operation steps are as follows: S21. Establish a time series data set of network threat monitoring actions for railway network entities , ;in Indicates The railway network subject network threat monitoring action time series data corresponding to the railway network subject, represents the maximum number of railway network entities; the railway network entity network threat monitoring action time series data represents the standard network threat monitoring action daily time control parameters set for different types of railway network entities; The units are hours, minutes and seconds; S22. Use the Boyer-Moore search algorithm to convert the railway network main feature text data A collection of network threat monitoring actions of railway network entities China Railway Network Entity Network Threat Monitoring Action Time Series Data Perform railway network main feature character matching and search for railway network main feature text data Corresponding railway network main body network threat monitoring action time series data , and generate the target railway network main body network threat monitoring action time series data through data identification ,in The units are hours, minutes and seconds; S23, the railway network supervision platform monitors the network threat action time series data of the target railway network entity and railway network main feature text data Perform railway network threat monitoring operations on target railway network entities.

[0022] Through the railway network subject characteristic information collection unit, the railway network supervision platform is used to obtain the characteristic information of the railway network subject to be monitored online, providing reliable data support for the scientific matching of the railway network subject network threat monitoring action sequence; the target railway network subject network threat monitoring action sequence matching unit and the railway network threat monitoring operation execution unit cooperate with each other, and the railway network subject network threat monitoring action sequence information of the railway network subject is flexibly matched based on the railway network subject characteristic text information combined with the intelligent search algorithm and the standard setting of the railway network subject network threat monitoring action sequence information, so as to realize differentiated and scientific control of the railway network subject network threat monitoring action frequency, and at the same time, combine with the railway network supervision platform to autonomously and accurately execute the railway network threat monitoring operation, so as to improve the efficiency and scientificity of the railway network threat tracing processing.

[0023] For further information, see Figure 1 - Figure 2 The steps for collecting real-time data of railway network operation are as follows: S31. When performing the network threat monitoring operation of the target railway network entity, the real-time operation process data of the target railway network entity is collected online through the railway network supervision platform, and the real-time operation data of the railway network entity is generated. ,The real-time data of railway network main operation includes the real-time network traffic data, real-time system log data and real-time intrusion detection system log data of the target railway network main operation.

[0024] The network attack status of the railway network subject is judged and processed based on the real-time operation data of the railway network subject and the operation data of the railway network attack status, and the network attack status judgment data of the target railway network subject is generated. When it is in a normal state, the operation steps for continuing to perform the railway network threat monitoring operation are as follows: S41. Establishing a railway network attack status operation data set , ;in Indicates Railway network attack status operation data, Indicates the maximum number of railway network attack status operation data; railway network attack status operation data indicates the real-time operation process processing data of the railway network subject under the network attack status; S42, using the breadth-first search algorithm to collect the real-time data of the railway network Running data collection on the status of railway cyber attacks China Railway Network Attack Status Operation Data Carry out network operation data matching, and generate the target railway network main body network attack status judgment data based on the network operation data matching results ; when and If the network operation data is not matched successfully, it means that the railway network entity is not currently under network attack, then the target railway network entity network attack status judgment data is output It is in normal state, and the railway network threat monitoring operation continues; when and If the network operation data is matched successfully, it means that the railway network subject is currently under network attack, and the target railway network subject network attack status judgment data is output. In attack state.

[0025] When in the attack state, the network attack type identification processing of the railway network subject is performed according to the real-time operation data of the railway network subject and the operation data of different railway network attack types, and the operation steps for generating the target railway network subject network attack type identification data are as follows: S51, when the target railway network main body network attack status judgment data When in attack state, establish a data set of different railway network attack types , ;in Indicates The operation data of different railway network attack types corresponding to the railway network attack types are Indicates the maximum number of railway network attack types; railway network attack types include DDoS attack types, phishing attack types, malware attack types, zero-day attack types and APT attack types; different railway network attack types operation data indicates the standard real-time operation process processing data of railway network entities under different types of railway network attack states; S52, real-time data of railway network operation Running data collection with different railway cyber attack types Running data of different railway cyber attack types Match network operation data and search for real-time data related to the main operation of the railway network Matching operation data of different railway network attack types The corresponding railway network attack type text information is used to generate the target railway network subject network attack type identification data through data identification. , execute and generate target railway network subject network attack type identification data The specific steps are as follows: S521, initialization, setting the maximum number of iterations T; S522, after initialization, execute network attack type search moth running data collection in different railway network attack types Select different railway network attack types and run data in the search space Flame, running data collection on different railway cyber attack types Initial generation in the solution space Types of network attacks search moth and A flame, and = , running data collection on different railway cyber attack types Search the search space to find the real-time data related to the operation of the railway network Matching operation data of different railway network attack types , Cyber ​​attack type search moth runs data collection on different railway cyber attack types The search space runs data around different selected railway cyber attack types Flame flying, Types of network attacks search moth and The flames are sorted by quality, and the sorted The flame moves to the front of the optimal position Each network attack type search moth selects a different flame. As the number of iterations increases, the number of flames decreases. The formula for calculating the number of flames is as follows: ,in Indicates The iteration runs the data set on different railway cyber attack types The number of flames in the search space, represents a random function with values ​​between 0 and 1, Represents a collection of running data on different railway network attack types The total number of flames initially generated in the search space; S523, network attack type search moth select different railway network attack type operation data Flame runs data collection on different railway cyber attack types Running data around different selected railway cyber attack types in the search space Flame Flight, a search for cyber attack types by Moth, runs a data collection on different railway cyber attack types Searching for positions in space , Cyber ​​attack type search moths around the flame running data collection on different railway cyber attack types Searching for positions in space And the network attack type search moths flying around the flame after running data collection on different railway network attack types New position in the search space , the new position calculation formula is as follows: ,in Indicates the type of network attack search moth With flame Running data collection on different railway cyber attack types The distance value in the search space, represents the exponential function, represents the number of iterations, where The coefficient is 2. Indicates angle value The corresponding cosine value, represents pi; S524, Network attack type search moth running data collection on different railway network attack types Running data of different railway cyber attack types in flight movement in search space Flame to the real-time data of railway network operation Matching position, Only network attack types search moth around After the flames flew, update to new position, calculate this The fitness value of the new position is New locations and Flame basis + The positions are sorted by quality and the ones with good quality are The positions are used as the positions of the flames in the next round, that is, the data sets are run on different railway network attack types. Search the search space to find the real-time data related to the operation of the railway network The most matching operational data of different railway cyber attack types ; S525: When the maximum number of iterations is reached, the real-time data of the railway network operation is output. Matching operation data of different railway network attack types , otherwise, the steps S522 to S524 are executed in a loop; S526: Outputting the running data of different railway network attack types outputted in step S525 The corresponding railway network attack type text information is used to generate the target railway network subject network attack type identification data through data identification. .

[0026] Through the cooperation of the railway network main body operation real-time information collection unit and the railway network attack status judgment unit, the railway network supervision platform is used to accurately obtain the real-time operation data of the target railway network main body, and the intelligent search algorithm and the scientifically preset railway network attack status operation data are combined to accurately detect the network attack status of the railway network main body, so as to achieve accurate monitoring of the railway network operation status. The railway network attack type identification unit intelligently identifies the railway network attack type according to the real-time operation data of the railway network main body combined with the intelligent identification algorithm and the operation data of different railway network attack types based on big data storage, so as to achieve efficient and accurate identification of railway network attack types and improve the accuracy and effect of railway network threat tracing processing.

[0027] For further information, see Figure 1 - Figure 2 , based on the target railway network subject network attack type identification data and the railway network attack source tracing solution data, the railway network subject network attack source tracing solution analysis and processing are performed, and the operation steps for generating the target railway network subject network attack source tracing solution data are as follows: S61. Establish a data set for tracing the source of railway network attacks ,in Indicates The railway network attack source tracing solution data corresponding to the railway network attack types, the railway network attack source tracing solution data represents the execution text information of the optimal network attack tracing solution for locating the identity information and location information of the network attacker under different types of railway network attack states, and the network attack tracing solution includes traffic analysis, intrusion detection, honeypot technology, network behavior analysis, IP positioning, ID positioning, attack program analysis, time pattern recognition, IP geographic location positioning and GPS positioning; S62, using a two-way search algorithm to identify the network attack type of the target railway network entity Data collection of railway network attack source tracing solutions China Railway Network Attack Source Tracing Solution Data Perform railway network attack type keyword matching to search for target railway network entity network attack type identification data Corresponding railway network attack source tracing solution data , and construct a target railway network main body network attack source tracing solution data .

[0028] The steps to construct railway network attack source tracing assessment data and perform railway network attack source tracing operations are as follows: S71. Obtaining railway network main feature text data , Target railway network entity network attack status judgment data , Target railway network entity network attack type identification data and target railway network subject network attack source tracing solution data And perform data combination processing to construct railway network main body attack tracing assessment data ,in ; S72. Railway network supervision platform based on railway network subject attack tracing assessment data Carry out railway network attack tracing operations.

[0029] Through the target railway network subject network attack source tracing solution analysis unit, the railway network attack source tracing solution is accurately analyzed according to the target railway network subject network attack type identification information combined with the intelligent search algorithm and the railway network attack source tracing solution information based on big data storage, so as to scientifically and meticulously formulate the railway network attack tracing solution based on the railway network object and the railway network attack type, and improve the quality and reliability of the railway network threat tracing processing; the target railway network subject network attack source tracing execution unit scientifically and timely constructs the railway network subject attack tracing assessment information based on the characteristic information of the railway network subject, the network attack judgment status, the network attack identification type and the network attack tracing solution information, and combines the railway network supervision platform to efficiently and accurately perform the railway network attack tracing operation, so as to improve the emergency response efficiency of the railway network threat tracing processing and enhance the anti-intrusion capability and stability of the railway network operation.

[0030] Embodiment 2: See also Figure 1 - Figure 2 , an intelligent network threat tracing system, used to implement an intelligent network threat tracing method, the system includes a railway network threat monitoring behavior processing module, a railway network attack type identification module, and a railway network attack tracing processing module; The railway network threat monitoring behavior processing module includes a railway network subject feature information collection unit, a railway network subject network threat monitoring action timing storage unit, a target railway network subject network threat monitoring action timing matching unit, and a railway network threat monitoring operation execution unit; A railway network subject characteristic information collection unit collects railway network subject characteristic text data through a railway network supervision platform; a railway network subject network threat monitoring action timing storage unit is used to store railway network subject network threat monitoring action timing data; a target railway network subject network threat monitoring action timing matching unit performs railway network subject network threat monitoring operation action timing matching processing based on the railway network subject characteristic text data and the railway network subject network threat monitoring action timing data, and generates target railway network subject network threat monitoring action timing data; a railway network threat monitoring operation execution unit executes railway network threat monitoring operations based on the target railway network subject network threat monitoring action timing data and in combination with the railway network supervision platform; The railway network attack type identification module includes a railway network main body operation real-time information collection unit, a railway network attack status operation information storage unit, a railway network attack status judgment unit, a railway network attack type operation information storage unit, and a railway network attack type identification unit; A railway network subject operation real-time information collection unit, which collects railway network subject operation real-time data through a railway network supervision platform; a railway network attack status operation information storage unit, which is used to store railway network attack status operation data; a railway network attack status judgment unit, which performs network attack status judgment processing of the railway network subject based on the railway network subject operation real-time data and the railway network attack status operation data, and generates target railway network subject network attack status judgment data; a railway network attack type operation information storage unit, which is used to store different railway network attack type operation data; a railway network attack type identification unit, which performs network attack type identification processing of the railway network subject based on the railway network subject operation real-time data and different railway network attack type operation data, and generates target railway network subject network attack type identification data; The railway network attack source tracing processing module includes a railway network attack source tracing solution storage unit, a target railway network subject network attack source tracing solution analysis unit, and a target railway network subject network attack source tracing execution unit; The railway network attack source tracing scheme storage unit is used to store the railway network attack source tracing scheme data; the target railway network subject network attack source tracing scheme analysis unit performs network attack source tracing scheme analysis and processing on the railway network subject based on the target railway network subject network attack type identification data and the railway network attack source tracing scheme data, and generates the target railway network subject network attack source tracing scheme data; the target railway network subject network attack source tracing execution unit constructs the railway network subject attack tracing assessment data based on the railway network subject's characteristic information, network attack judgment status, network attack identification type and network attack tracing scheme information, and performs the railway network attack tracing operation in combination with the railway network supervision platform.

[0031] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. An intelligent network threat tracing method, characterized in that: The method comprises the following steps: S1. Collecting railway network main feature text data; S2, performing a network threat monitoring operation action timing matching process for the railway network subject based on the railway network subject feature text data and the railway network subject network threat monitoring action timing data, generating the target railway network subject network threat monitoring action timing data and executing the railway network threat monitoring operation; S3, collect real-time data of railway network operation; S4, performing network attack status judgment processing on the railway network subject according to the real-time operation data of the railway network subject and the railway network attack status operation data, generating network attack status judgment data of the target railway network subject, and continuing to perform railway network threat monitoring operations when it is in a normal state; S5. When in the attack state, the network attack type identification processing of the railway network subject is performed according to the real-time operation data of the railway network subject and the operation data of different railway network attack types, and the network attack type identification data of the target railway network subject is generated; S6. Analyze and process the network attack source tracing scheme of the railway network subject according to the network attack type identification data of the target railway network subject and the network attack source tracing scheme data of the railway network subject, and generate the network attack source tracing scheme data of the target railway network subject; S7. Construct railway network main body attack tracing assessment data and perform railway network attack tracing operations.

2. The intelligent network threat tracing method according to claim 1 is characterized by: The S1 comprises the following steps: S11. Collect the identity feature text information of the target railway network subject online through the railway network supervision platform, and generate railway network subject feature text data .

3. The intelligent network threat tracing method according to claim 2 is characterized by: The S2 comprises the following steps: S21. Establish a time series data set of network threat monitoring actions for railway network entities , ;in Indicates The railway network subject network threat monitoring action time series data corresponding to the railway network subject, Indicates the maximum number of railway network entities; S22, using the Boyer-Moore search algorithm to With the As stated in Perform railway network main feature character matching and search for the The corresponding , and generate the target railway network main body network threat monitoring action time series data through data identification ,in The units are hours, minutes and seconds; S23. Railway network supervision platform is based on the and stated Perform railway network threat monitoring operations on target railway network entities.

4. The intelligent network threat tracing method according to claim 3 is characterized by: The S3 comprises the following steps: S31. When performing the network threat monitoring operation of the target railway network entity, the real-time operation process data of the target railway network entity is collected online through the railway network supervision platform, and the real-time operation data of the railway network entity is generated. .

5. The intelligent network threat tracing method according to claim 4 is characterized in that: The S4 comprises the following steps: S41. Establishing a railway network attack status operation data set , ;in Indicates Railway network attack status operation data, Indicates the maximum value of the number of railway network attack status operation data; S42, using a breadth-first search algorithm to With the As stated in Carry out network operation data matching, and generate the target railway network main body network attack status judgment data based on the network operation data matching results ; when and If the network operation data fails to match successfully, the output is It is in normal state, and the railway network threat monitoring operation continues; when and If the network operation data is matched successfully, the output is In attack state.

6. The intelligent network threat tracing method according to claim 5 is characterized by: The S5 comprises the following steps: S51, when the target railway network main body network attack status judgment data When in attack state, establish a data set of different railway network attack types , ;in Indicates The operation data of different railway network attack types corresponding to the railway network attack types are Indicates the maximum number of railway network attack types; S52, the With the As stated in Perform network operation data matching and search for Matching the The corresponding railway network attack type text information is used to generate the target railway network subject network attack type identification data through data identification. , execute and generate the target railway network subject network attack type identification data The specific steps are as follows: S521, initialization, setting the maximum number of iterations T; S522, after initialization, execute the network attack type search moth in the Select the search space Flame, in the Initial generation in the solution space Types of network attacks search moth and A flame, and = , in the Search the search space for Matching the , network attack type search moth in the The search space will be around the selected Flame flying, Types of network attacks search moth and The flames are sorted by quality, and the sorted The flame moves to the front of the optimal position Each network attack type search moth selects a different flame, and the number of flames decreases as the number of iterations increases; S523, network attack type search moth select said After the flame The search space is around the selected Flame Flying, Search Moth for Cyber ​​Attack Types in the Searching for positions in space , the type of cyberattack that searches for moths around a flame in the Searching for positions in space And the type of network attack search moths flying around the flame after the New position in the search space ; S524, network attack type search moth in the The search space is a moving flight. Flame to Matching position, Only network attack types search moth around After the flames flew, update to new position, calculate this The fitness value of the new position is New locations and Flame basis + The positions are sorted by quality and the ones with good quality are The position is used as the position of the flame in the next round, that is, in the Search the search space for The best match for ; S525, when the maximum number of iterations is reached, output Matching the , otherwise, the steps S522 to S524 are executed in a loop; S526: Outputting the steps described in step S525 The corresponding railway network attack type text information is used to generate the target railway network subject network attack type identification data through data identification. .

7. The intelligent network threat tracing method according to claim 6 is characterized by: The S6 comprises the following steps: S61. Establish a data set for tracing the source of railway network attacks ,in Indicates Railway network attack source tracing solution data corresponding to the railway network attack types; S62, using a bidirectional search algorithm to With the As stated in Perform railway network attack type keyword matching and search for the following The corresponding , and construct a target railway network main body network attack source tracing solution data .

8. The intelligent network threat tracing method according to claim 7 is characterized by: The S7 comprises the following steps: S71, obtaining the , , and stated And perform data combination processing to construct railway network main body attack tracing assessment data ; S72. Railway network supervision platform is based on the Perform railway network attack tracing operations.

9. An intelligent network threat tracing system, used to implement an intelligent network threat tracing method according to any one of claims 1 to 8, characterized in that: The system includes a railway network threat monitoring behavior processing module, a railway network attack type identification module, and a railway network attack tracing processing module; The railway network threat monitoring behavior processing module includes a railway network subject feature information collection unit, a railway network subject network threat monitoring action timing storage unit, a target railway network subject network threat monitoring action timing matching unit, and a railway network threat monitoring operation execution unit; The railway network subject characteristic information collection unit collects railway network subject characteristic text data through the railway network supervision platform; the railway network subject network threat monitoring action timing storage unit is used to store the railway network subject network threat monitoring action timing data; the target railway network subject network threat monitoring action timing matching unit performs network threat monitoring operation action timing matching processing of the railway network subject based on the railway network subject characteristic text data and the railway network subject network threat monitoring action timing data, and generates the target railway network subject network threat monitoring action timing data; the railway network threat monitoring operation execution unit executes the railway network threat monitoring operation according to the target railway network subject network threat monitoring action timing data and in combination with the railway network supervision platform; The railway network attack type identification module includes a railway network main body operation real-time information collection unit, a railway network attack status operation information storage unit, a railway network attack status judgment unit, a railway network attack type operation information storage unit, and a railway network attack type identification unit; The railway network main body operation real-time information collection unit collects the railway network main body operation real-time data through the railway network supervision platform; The railway network attack status operation information storage unit is used to store railway network attack status operation data; the railway network attack status judgment unit performs network attack status judgment processing of the railway network subject according to the real-time operation data of the railway network subject and the railway network attack status operation data, and generates network attack status judgment data of the target railway network subject; the railway network attack type operation information storage unit is used to store operation data of different railway network attack types; the railway network attack type identification unit performs network attack type identification processing of the railway network subject according to the real-time operation data of the railway network subject and the operation data of different railway network attack types, and generates network attack type identification data of the target railway network subject; The railway network attack tracing processing module includes a railway network attack source tracing solution storage unit, a target railway network subject network attack source tracing solution analysis unit, and a target railway network subject network attack source tracing execution unit; The railway network attack source tracing scheme storage unit is used to store railway network attack source tracing scheme data; the target railway network subject network attack source tracing scheme analysis unit performs network attack source tracing scheme analysis and processing on the railway network subject based on the target railway network subject network attack type identification data and the railway network attack source tracing scheme data to generate target railway network subject network attack source tracing scheme data; the target railway network subject network attack source tracing execution unit constructs railway network subject attack tracing evaluation data based on the characteristic information of the railway network subject, the network attack judgment status, the network attack identification type and the network attack tracing scheme information, and performs railway network attack tracing operations in combination with the railway network supervision platform.

Images