Intelligent information protection system for guaranteeing safety of urban rail transit

Abstract

The invention relates to the technical field of information protection, and discloses an intelligent information protection system for guaranteeing the safety of urban rail transit, and the system has remarkable advantages compared with a traditional static protection technology. Through data acquisition, preprocessing and multi-level dynamic analysis, the system can monitor and analyze the safety state of each link in real time, accurately identify possible risk points, and perform early warning in time through a feedback mechanism. Compared with a traditional system, the system has the advantages that the protection precision and efficiency are improved, and the coping capacity for complex security threats is enhanced. Through intelligent data analysis and real-time feedback, the system can achieve careful monitoring and quick response to each link, the intelligent level and the response speed of rail transit information safety protection are greatly improved, and more powerful technical support is provided for guaranteeing safe operation of urban rail transit.

Description

Technical Field

[0001] The present invention relates to the technical field of information protection, and in particular to an intelligent information protection system for ensuring the safety of urban rail transit. Background Art

[0002] With the continuous expansion and development of modern urban rail transit, traffic safety and operational efficiency have become one of the core issues of social concern. In this large field, the information security issues of urban rail transit have become increasingly prominent, especially in terms of data protection and privacy security. Specifically for urban rail transit systems, the security issues involved not only include infrastructure such as traffic flow, vehicle scheduling, and facility equipment monitoring, but also involve a large amount of passenger information and system operation data. With the in-depth application of information technology, the security of data transmission, storage, and access has become the key to ensuring the smooth operation of the entire urban rail transit. Especially in intelligent and digital traffic management systems, how to ensure that these data are not leaked, tampered with, or subjected to malicious attacks is an urgent problem to be solved in the current information security field.

[0003] Traditional urban rail transit information security protection methods usually rely on static monitoring or single rule-based protection mechanisms. The limitations of such methods are mainly reflected in the inability to adapt to changing security threats and respond to complex attack patterns in real time. Since monitoring systems usually rely on manual judgment or simple rules to trigger alarms, they are often unable to fully analyze and process data from multiple links and are easily affected by human errors. In addition, traditional methods have a slow response speed to different security threats, lack intelligent automatic identification and response mechanisms, and cannot detect and resolve potential security risks in a timely manner. Therefore, traditional security protection systems are stretched in the face of increasingly complex and diverse security threats and cannot effectively ensure the continued safe operation of urban rail transit.

[0004] Therefore, we propose an intelligent information protection system for ensuring the safety of urban rail transit in order to solve the above-mentioned problems. Summary of the invention

[0005] The purpose of the present invention is to provide an intelligent information protection system for ensuring the safety of urban rail transit, so as to solve the problem that the above-mentioned background technology cannot adapt to changing security threats and respond to complex attack modes in real time. Since monitoring systems usually rely on manual judgment or simple rules to trigger alarms, they are often unable to fully analyze and process data from multiple links and are easily affected by human error.

[0006] To achieve the above-mentioned object, the present invention provides the following technical solutions: an intelligent information protection system for ensuring the safety of urban rail transit, comprising a data acquisition module, a data preprocessing module, a first analysis module, a second analysis module, a third analysis module, a fourth analysis module, and a feedback module;

[0007] The data acquisition module is used to perform data acquisition and generate a first data set, a second data set and a third data set;

[0008] The data preprocessing module is used to preprocess the first data set, the second data set and the third data set, and to dimensionlessly convert the data in the preprocessed first data set, the second data set and the third data set;

[0009] The first analysis module is used to integrate and calculate the first data set, the second data set, and the third data set to generate an abnormal alarm coefficient YCX, and compare the abnormal alarm coefficient YCX with a preset abnormal alarm threshold Y to generate a first comparison result, and determine whether the current terminal has information risk according to the first comparison result;

[0010] The second analysis module is used to integrate and calculate the first data set to generate a user access anomaly coefficient YX1, and compare the user access anomaly coefficient YX1 with a preset user access anomaly threshold R1 to generate a second comparison result, and determine whether there is an abnormal risk in the user access link according to the second comparison result;

[0011] The third analysis module is used to integrate and calculate the second data set to generate a transmission link abnormality coefficient, and compare the transmission environment abnormality coefficient YX2 with a preset transmission abnormality threshold R2 to generate a third comparison result, and determine whether there is an abnormal risk in the transmission link according to the third comparison result;

[0012] The fourth analysis module is used to integrate and calculate the third data set to generate a storage abnormality coefficient YX3, and compare the storage abnormality coefficient YX3 with a preset storage abnormality threshold R3 to generate a fourth comparison result, and determine whether there is an abnormal risk in the storage environment according to the fourth comparison result;

[0013] The feedback module is used to summarize the first comparison result, the second comparison result, the third comparison result and the fourth comparison result, and generate a visual report and transmit it to the terminal for alarm.

[0014] Preferably, the data acquisition module acquires the security information of the terminal through a distributed sensor network, and classifies the data into a first data set, a second data set and a third data set;

[0015] The first data set includes: user full-level adaptation rate A, user access frequency B, user access success rate C and user access time adaptation rate D;

[0016] The second data set includes: encryption algorithm level adaptation rate E, data transmission frequency F, data transmission path adaptation rate G and data packet integrity H;

[0017] The third data set includes: storage encryption status I, backup frequency J, backup encryption status K and storage access control rate L.

[0018] Preferably, the first analysis module includes a first calculation unit and a first parsing unit, the first calculation unit is used to integrate and calculate the first data set, the second data set and the third data set to generate an abnormal alarm coefficient YCX, and the first parsing unit is used to compare the abnormal alarm coefficient YCX with the abnormal alarm threshold Y to generate a first comparison result, which is as follows:

[0019] When YCX>Y, it means that there is a security problem with the current information and an alarm needs to be issued. When YCX≤Y, it means that there is no security problem with the current information and no alarm needs to be issued.

[0020] Preferably, the first calculation unit calculates and obtains the abnormal alarm coefficient YCX by the following formula:

[0021]

[0022] Where: A is the user full-level adaptation rate, B is the user access frequency, C is the user access success rate, D is the user access time adaptation rate, E is the encryption algorithm level adaptation rate, F is the data transmission frequency, G is the data transmission path adaptation rate, H is the data packet integrity, I is the storage encryption status, J is the backup frequency, K is the backup encryption status, and L is the storage access control rate;

[0023] a1, a2 and a3 are weight values, and the values ​​of a1, a2 and a3 are adjusted and set by the user.

[0024] Preferably, the second analysis module includes a second calculation unit and a second parsing unit, the second calculation unit is used to integrate and calculate the first data set to generate a user access anomaly coefficient YX1, and the second parsing unit is used to compare the user access anomaly coefficient YX1 with a preset user access anomaly threshold R1 to generate a second comparison result, which is as follows:

[0025] When YX1>R1, it means that the current information has a security problem at the user access node and needs to be located abnormally. When YX1≤R1, it means that the current information has no security problem at the user access node and does not need to be located abnormally.

[0026] Preferably, the second calculation unit calculates and obtains the user access abnormality coefficient YX1 through the following formula:

[0027]

[0028] Where: A is the user's full-level adaptation rate, B is the user's access frequency, C is the user's access success rate, D is the user's access time adaptation rate, and ln is a logarithmic function.

[0029] Preferably, the third analysis module includes a third calculation unit and a third analysis unit, the third calculation unit is used to calculate the transmission link abnormality coefficient, and the third analysis unit is used to compare the transmission environment abnormality coefficient YX2 with a preset transmission abnormality threshold R2, thereby generating a third comparison result, specifically as follows:

[0030] When YX2>R2, it means that the current information has a security problem in the transmission environment node and needs to be located. When YX2≤R2, it means that the current information has no security problem in the transmission environment node and does not need to be located.

[0031] Preferably, the third calculation unit is calculated by the following formula:

[0032]

[0033] Where: E is the encryption algorithm level adaptation rate, F is the data transmission frequency, G is the data transmission path adaptation rate, H is the data packet integrity, and ln is the logarithmic function.

[0034] Preferably, the fourth analysis module includes a fourth calculation unit and a fourth analysis unit, the fourth calculation unit is used to calculate the storage abnormality coefficient YX3, and the fourth analysis unit is used to compare the storage abnormality coefficient YX3 with a preset storage abnormality threshold R3, so as to generate a fourth comparison result, which is specifically as follows:

[0035] When YX3>R3, it means that the current information has a security problem in the storage node and needs to be located. When YX3≤R3, it means that the current information has no security problem in the storage node and does not need to be located.

[0036] Preferably, the fourth calculation unit calculates and obtains the storage abnormality coefficient YX3 by the following formula:

[0037]

[0038] Where: I is the storage encryption state, J is the backup frequency, K is the backup encryption state, L is the storage access control rate, and ln is the logarithmic function.

[0039] Compared with the prior art, the present invention has the following beneficial effects:

[0040] 1. Compared with traditional static protection technology, this system has significant advantages. Through data collection, preprocessing and multi-level dynamic analysis, the system can monitor and analyze the security status of each link in real time, accurately identify possible risk points, and issue early warnings in time through feedback mechanisms. Compared with traditional systems, this system not only improves the accuracy and efficiency of protection, but also enhances the ability to respond to complex security threats. Through intelligent data analysis and real-time feedback, the system can achieve detailed monitoring and rapid response to each link, greatly improving the intelligence level and response speed of rail transit information security protection, and providing more powerful technical support for ensuring the safe operation of urban rail transit.

[0041] 2. By comparing the calculated abnormal alarm coefficient YCX with the preset threshold value Y, the first comparison result is generated to determine whether to trigger the alarm. This automated alarm mechanism avoids manual intervention and can accurately determine whether there are security issues in the system in real time. Compared with traditional manual monitoring or alarm mechanisms based on a single rule, the system can process large amounts of data in real time and automatically generate alarm information, reducing errors in human judgment and improving efficiency and response speed. This automated comparison and alarm mechanism not only reduces dependence on operators, but also improves the response speed of the alarm system, ensuring that the system can respond quickly to security issues and take appropriate protective measures in a timely manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a system flow chart of the present invention.

[0043] In the figure: 1. data acquisition module; 2. data preprocessing module; 3. first analysis module; 31. first calculation unit; 32. first parsing unit; 4. second analysis module; 41. second calculation unit; 42. second parsing unit; 5. third analysis module; 51. third calculation unit; 52. third parsing unit; 6. fourth analysis module; 61. fourth calculation unit; 62. fourth parsing unit; 7. feedback module. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0045] Example 1: Please refer to Figure 1, an intelligent information protection system for ensuring the safety of urban rail transit, comprising a data acquisition module 1, a data preprocessing module 2, a first analysis module 3, a second analysis module 4, a third analysis module 5, a fourth analysis module 6, and a feedback module 7;

[0046] The data collection module 1 is used to collect data and generate a first data set, a second data set and a third data set;

[0047] The data preprocessing module 2 is used to preprocess the first data set, the second data set and the third data set, and to dimensionlessly convert the data in the preprocessed first data set, the second data set and the third data set;

[0048] The first analysis module 3 is used to integrate and calculate the first data set, the second data set and the third data set to generate an abnormal alarm coefficient YCX, and compare the abnormal alarm coefficient YCX with a preset abnormal alarm threshold Y to generate a first comparison result, and determine whether the current terminal has information risk according to the first comparison result;

[0049] The second analysis module 4 is used to integrate and calculate the first data set to generate a user access anomaly coefficient YX1, and compare the user access anomaly coefficient YX1 with a preset user access anomaly threshold R1 to generate a second comparison result, and determine whether there is an abnormal risk in the user access link according to the second comparison result;

[0050] The third analysis module 5 is used to integrate and calculate the second data set to generate a transmission link abnormality coefficient, and compare the transmission environment abnormality coefficient YX2 with a preset transmission abnormality threshold R2 to generate a third comparison result, and determine whether there is an abnormal risk in the transmission link according to the third comparison result;

[0051] The fourth analysis module 6 is used to integrate and calculate the third data set to generate a storage abnormality coefficient YX3, and compare the storage abnormality coefficient YX3 with a preset storage abnormality threshold R3 to generate a fourth comparison result, and determine whether there is an abnormal risk in the storage environment according to the fourth comparison result;

[0052] The feedback module 7 is used to summarize the first comparison result, the second comparison result, the third comparison result and the fourth comparison result, and generate a visual report to transmit to the terminal for alarm.

[0053] In this embodiment: Data acquisition module 1 is the basic unit of the system, responsible for collecting data from different links and terminals to generate the first data set, the second data set and the third data set. Through comprehensive real-time data acquisition, it is ensured that the system can obtain key parameters from user access, data transmission and data storage. This module provides high-quality raw data for subsequent analysis and processing, ensures data integrity and timeliness, and provides a solid foundation for the safety warning of the entire system.

[0054] Data preprocessing module 2 is responsible for cleaning, noise removal and dimensionless processing of the collected data. This module removes irrelevant noise data, fills in missing values ​​and standardizes the data, so that subsequent calculations and analysis can more accurately reflect the true situation of the data. Dimensionless data can eliminate the influence of different dimensions, making the comparison and calculation between different data sets more fair and accurate, thereby improving the processing power and accuracy of the entire system.

[0055] The first analysis module 3 integrates various data sets, calculates and generates the abnormal alarm coefficient YCX, and compares it with the preset abnormal alarm threshold Y to generate the first comparison result. This module can comprehensively evaluate the overall security risk of the system, determine whether there is information risk, and provide decision support for subsequent processing. By comparing the threshold, the first analysis module 3 can timely detect potential security risks in the system and issue early warnings to ensure the security of terminal information and enhance the system's protection capabilities.

[0056] The second analysis module 4 focuses on analyzing the first data set and generates a user access anomaly coefficient YX1. This module determines whether there is an abnormal risk in the user access link by calculating the abnormal index of user access and comparing it with the preset user access anomaly threshold R1. Through the analysis of this module, it is possible to accurately monitor and identify behaviors that do not conform to the conventional access mode, and timely discover and prevent possible security vulnerabilities, such as illegal access or unauthorized behavior, thereby enhancing the system's protection capabilities for the user access link.

[0057] The third analysis module 5 integrates and calculates the second data set, generates a transmission link abnormality coefficient, and compares it with the preset transmission abnormality threshold R2 to determine whether there is an abnormal risk in the data transmission process. Through the analysis of this module, potential security issues in the transmission process, such as data tampering, leakage or transmission errors, can be accurately identified. Effectively monitor the integrity and security of data transmission, ensure that the data transmission process is not threatened by the outside world, and improve the protection performance and reliability of the system.

[0058] The fourth analysis module 6 generates a storage anomaly coefficient YX3 by calculating the third data set, and compares it with the preset storage anomaly threshold R3 to determine whether there is an abnormal risk in the data storage environment. This module can effectively evaluate the security of the data storage process, including encrypted storage, backup frequency, and access control, and timely identify potential security risks in the storage process. In this way, data leakage, loss, or unauthorized access can be prevented to ensure the security and integrity of the data.

[0059] Feedback module 7 is responsible for summarizing the first comparison result, the second comparison result, the third comparison result and the fourth comparison result, generating a visual report and transmitting it to the terminal for alarm. This module is the decision support link of the system. By integrating various analysis results and generating actionable feedback information, it helps administrators to understand the security status of the system in a timely manner. Through the real-time feedback mechanism, the system can respond quickly when an anomaly is found, automatically trigger an early warning, and ensure that measures are taken quickly to reduce the impact of potential risks.

[0060] Compared with traditional static protection technology, this system has significant advantages. Through data collection, preprocessing and multi-level dynamic analysis, the system can monitor and analyze the security status of each link in real time, accurately identify possible risk points, and issue early warnings in a timely manner through feedback mechanisms. Compared with traditional systems, this system not only improves the accuracy and efficiency of protection, but also enhances the ability to respond to complex security threats. Through intelligent data analysis and real-time feedback, the system can achieve detailed monitoring and rapid response to each link, greatly improving the intelligence level and response speed of rail transit information security protection, and providing more powerful technical support for ensuring the safe operation of urban rail transit.

[0061] Example 2: Please refer to Figure 1 , the data acquisition module 1 acquires the security information of the terminal through the distributed sensor network, and classifies it into a first data set, a second data set and a third data set;

[0062] The first data set includes: user full-level adaptation rate A, user access frequency B, user access success rate C, and user access time adaptation rate D;

[0063] The second data set includes: encryption algorithm level adaptation rate E, data transmission frequency F, data transmission path adaptation rate G and data packet integrity H;

[0064] The third data set includes: storage encryption status I, backup frequency J, backup encryption status K and storage access control rate L.

[0065] In this embodiment: Data collection of terminal security information is performed through a distributed sensor network. Compared with the traditional single data collection method, this method can fully cover terminal devices in different geographical locations and at different levels. The distributed sensor network not only improves the real-time and comprehensiveness of data collection, but also ensures that large-scale and widely distributed systems can respond in a timely manner, avoiding the problem of insufficient local information. This distributed collection method ensures that the information flow from terminal devices to core systems is smoother, providing a comprehensive and multi-level data monitoring system. In this way, the system can obtain data from each security link in a timely manner, provide an accurate and comprehensive basis for subsequent analysis and processing, and improve the quality and accuracy of data collection.

[0066] The system classifies the collected security information into three data sets according to different types. This classification method can separate data of different security dimensions for targeted analysis. The first data set focuses on the user access link, the second data set focuses on the data transmission process, and the third data set focuses on the data storage link. By classifying the data, the source of the problem can be more accurately identified in the subsequent analysis, and targeted security protection measures can be taken for different links. Independent analysis of various data sets can optimize the protection efficiency of different links while ensuring the overall security of the system. For example, for user access anomalies, the access frequency and success rate can be specifically analyzed; while transmission security can be monitored through encryption algorithms and transmission path parameters. This classification management can significantly improve the accuracy of data analysis and the responsiveness of the system.

[0067] By collecting parameters from multiple dimensions, the system can comprehensively evaluate all aspects of information security. The close connection between these parameters enables the system to comprehensively monitor security threats from different aspects and achieve more refined risk assessment. Multi-dimensional data collection not only enhances the system's ability to identify complex security threats, but also improves the pertinence of information protection. For example, by analyzing the frequency, success rate, and access time adaptation rate of user access, it is possible to determine whether user behavior is abnormal, thereby identifying potential security issues in a timely manner. Similarly, independent monitoring of data encryption, transmission paths, and storage security can effectively reduce the risk of data leakage or tampering, and improve the system's all-round protection capabilities.

[0068] This system seamlessly integrates three major data sets and combines them with subsequent calculation modules for linkage analysis. The system can comprehensively assess risks from multiple data dimensions. This integration and analysis method ensures that every link from collection to processing can be accurately connected, providing real-time and accurate security status assessment. The integrated processing of data enables various types of security data to complement each other and provide a more complete security view. The system can not only monitor the security status of each link individually, but also analyze the mutual influence between each link to ensure that potential vulnerabilities and anomalies in the system can be accurately identified. This deep data fusion further enhances the intelligence of the overall system and enhances the ability of real-time response and risk prediction.

[0069] Example 3: Please refer to Figure 1 The first analysis module 3 includes a first calculation unit 31 and a first analysis unit 32. The first calculation unit 31 is used to integrate and calculate the first data set, the second data set and the third data set to generate an abnormal alarm coefficient YCX. The first analysis unit 32 is used to compare the abnormal alarm coefficient YCX with the abnormal alarm threshold Y to generate a first comparison result, which is as follows:

[0070] When YCX>Y, it means that there is a security problem with the current information and an alarm needs to be issued. When YCX≤Y, it means that there is no security problem with the current information and no alarm needs to be issued.

[0071] The first calculation unit 31 calculates and obtains the abnormal alarm coefficient YCX by the following formula:

[0072]

[0073] Where: A is the user full-level adaptation rate, B is the user access frequency, C is the user access success rate, D is the user access time adaptation rate, E is the encryption algorithm level adaptation rate, F is the data transmission frequency, G is the data transmission path adaptation rate, H is the data packet integrity, I is the storage encryption status, J is the backup frequency, K is the backup encryption status, and L is the storage access control rate;

[0074] a1, a2 and a3 are weight values, and the values ​​of a1, a2 and a3 are adjusted and set by the user.

[0075] In this embodiment: the first calculation unit 31 performs a comprehensive calculation by integrating the multi-dimensional information in the first data set, the second data set and the third data set, thereby obtaining the abnormal alarm coefficient YCX. This calculation method comprehensively integrates various types of security information and can fully reflect the current security status of the system. By integrating multiple data sources, the system can comprehensively evaluate information security risks and avoid the one-sidedness and shortcomings that may be caused by single-dimensional data. This method ensures that the security of the system in multiple dimensions, from user behavior, data transmission security to storage encryption, is considered simultaneously, thereby improving the accuracy and comprehensiveness of the early warning system. Compared with traditional alarm systems with single parameters or simple rules, this multi-dimensional fusion calculation method can provide more accurate risk assessments and avoid possible omissions or false alarms.

[0076] The weight values ​​in the formula are adjusted and set by the user, which means that the system can customize the importance of various types of data according to different environments, needs or changes in specific risk management strategies. This flexibility allows the system to not only adapt to different scenarios, but also to specifically enhance the influence of certain parameters. Users can adjust the weights of different security dimensions according to actual conditions, which greatly facilitates the personalized customization of the system. For example, in some specific scenarios, users may be more concerned about data transmission security, while in other scenarios, access frequency or storage encryption may be more critical. Through the flexible configuration of weight values, the system can be adaptively adjusted according to actual needs, which improves the scalability and applicability of the system and avoids the inadaptability caused by a single fixed weight.

[0077] The first analysis unit 32 generates a first comparison result by comparing the calculated abnormal alarm coefficient YCX with the preset threshold value Y, and then determines whether to trigger an alarm. This automated alarm mechanism avoids manual intervention and can accurately determine whether there is a safety problem in the system in real time. Compared with traditional manual monitoring or alarm mechanisms based on a single rule, the system can process a large amount of data in real time and automatically generate alarm information, reducing errors in human judgment and improving efficiency and response speed. This automated comparison and alarm mechanism not only reduces dependence on operators, but also improves the response speed of the alarm system, ensuring that the system can respond quickly when safety problems arise and take corresponding protective measures in a timely manner.

[0078] When the abnormal alarm coefficient YCX is greater than the preset threshold, the system will automatically issue a safety warning. This threshold-based comparison mechanism ensures the accuracy of the alarm, can effectively reduce unnecessary alarms, and can accurately grasp potential safety issues. By setting reasonable thresholds, the system can balance the accuracy and sensitivity of the alarm to avoid excessive alarms or missed reports. By regularly adjusting the threshold, the system can flexibly adjust according to changes in actual security risks, making the early warning mechanism more accurate and reliable. In addition, the accurate alarm system not only improves safety, but also greatly reduces operation and maintenance costs and the pressure of manual monitoring.

[0079] Example 4: Please refer to Figure 1 The second analysis module 4 includes a second calculation unit 41 and a second analysis unit 42. The second calculation unit 41 is used to perform integrated calculation on the first data set to generate a user access anomaly coefficient YX1. The second analysis unit 42 is used to compare the user access anomaly coefficient YX1 with a preset user access anomaly threshold R1 to generate a second comparison result, which is as follows:

[0080] When YX1>R1, it means that the current information has a security problem at the user access node and needs to be located abnormally. When YX1≤R1, it means that the current information has no security problem at the user access node and does not need to be located abnormally.

[0081] The second calculation unit 41 calculates and obtains the user access abnormality coefficient YX1 by the following formula:

[0082]

[0083] Where: A is the user's full-level adaptation rate, B is the user's access frequency, C is the user's access success rate, D is the user's access time adaptation rate, and ln is a logarithmic function.

[0084] In this embodiment: the second calculation unit 41 integrates the key parameters in the first data set and accurately calculates the user access anomaly coefficient YX1 through the application of logarithmic functions. This calculation method comprehensively evaluates multiple important factors to make anomaly detection more accurate. Through multi-dimensional analysis of user access behavior, the system can accurately evaluate whether the user has abnormal behavior during the access process. Traditional security protection systems often rely on single indicators such as access frequency or success rate, while this system ensures comprehensive identification of potential security threats by integrating multiple access features. This not only improves the system's sensitivity to potential attacks, but also reduces the possibility of false alarms and improves the accuracy of alarms.

[0085] The second parsing unit 42 compares the calculated user access anomaly coefficient YX1 with the preset threshold value to determine whether it is necessary to locate the user access node abnormally. If the anomaly coefficient exceeds the threshold, the positioning mechanism is automatically started to ensure that the potential safety hazards are discovered and resolved in a timely manner. Unlike traditional passive protection systems, this system can detect potential safety risks in a timely manner and automatically trigger responses through active monitoring and intelligent threshold comparison. This intelligent anomaly detection mechanism reduces the need for manual intervention, improves response speed and accuracy, and ensures that the system can take prompt measures when an anomaly occurs. In addition, the threshold setting can be adjusted according to actual conditions to meet the needs of different risk levels, further improving the flexibility and customizability of the system.

[0086] By comparing the calculated user access anomaly coefficient YX1 with the threshold, the system can accurately locate whether there are security issues when the user accesses the node. If it exceeds the threshold, an alarm will be automatically issued to locate the anomaly. This process ensures that the system can promptly discover and handle possible security issues, avoiding the risk of being undetected for a long time. Traditional security protection systems often rely on preset rules to detect anomalies, but these rules may not cover all security risks. However, this system uses multi-dimensional analysis of access behavior, so that anomaly detection is not limited to common attack methods, but can also identify potential complex attacks or abnormal access behaviors, further improving the comprehensiveness and accuracy of security protection.

[0087] When the user access anomaly coefficient YX1 exceeds the preset threshold, the system will automatically sound an alarm and start the anomaly location mechanism without manual intervention. This automated response mechanism can greatly improve the security and response speed of the system. Automated anomaly location and response reduces reliance on manual monitoring and improves the efficiency and timeliness of security incident response. Compared with traditional manual inspection and response methods, the system can locate security incidents as soon as they occur and take corresponding protective measures in a timely manner, reducing the risk of system attacks or damage.

[0088] The various parameters involved in the formula can be flexibly adjusted according to the actual situation. Users can adjust the weights of these parameters according to different needs and security environments to ensure that the system can automatically optimize according to the ever-changing security environment. This flexible adjustment capability enables the system to optimize according to different actual conditions to ensure that the best security protection effect can be provided in various usage environments. This flexibility avoids the limitations brought by fixed rules and parameters and improves the configurability and adaptability of the system.

[0089] Example 5: Please refer to Figure 1The third analysis module 5 includes a third calculation unit 51 and a third analysis unit 52. The third calculation unit 51 is used to calculate the transmission link abnormality coefficient. The third analysis unit 52 is used to compare the transmission environment abnormality coefficient YX2 with the preset transmission abnormality threshold R2, thereby generating a third comparison result, which is specifically as follows:

[0090] When YX2>R2, it means that the current information has a security problem in the transmission environment node and needs to be located. When YX2≤R2, it means that the current information has no security problem in the transmission environment node and does not need to be located.

[0091] The third calculation unit 51 calculates and obtains by the following formula:

[0092]

[0093] Where: E is the encryption algorithm level adaptation rate, F is the data transmission frequency, G is the data transmission path adaptation rate, H is the data packet integrity, and ln is the logarithmic function.

[0094] In this embodiment: the third calculation unit 51 comprehensively considers multiple key parameters such as encryption algorithm level adaptation rate, data transmission frequency, data transmission path adaptation rate and data packet integrity, and uses logarithmic functions to accurately calculate these parameters to obtain the transmission environment abnormality coefficient YX2. This calculation method based on multi-dimensional parameters can fully reflect the potential security risks in the transmission process. Traditional security protection systems often only focus on a single transmission parameter, while this system can more accurately capture abnormal behaviors that may exist in the transmission process by integrating multiple parameters. This comprehensive analysis method can enhance the system's ability to identify transmission risks and ensure that potential security threats can be effectively identified in a variety of transmission environments.

[0095] Through the third analysis unit 52, the transmission environment abnormality coefficient YX2 is compared with the preset transmission abnormality threshold R2. If the abnormality coefficient exceeds the set threshold, the system will automatically generate an alarm and start the abnormality positioning mechanism. This intelligent abnormality detection and positioning mechanism can timely discover potential security problems in the transmission link and avoid the lag of manual inspection. The system can respond quickly when an abnormality occurs, provide real-time security protection, and effectively improve the security of transmitted data. Compared with the traditional static monitoring method, this system can actively identify and respond to dynamic security threats in the transmission environment.

[0096] The parameters involved in the calculation, such as the data transmission path adaptation rate and data packet integrity, can reflect the stability and security of data transmission. The comprehensive calculation of these parameters helps to comprehensively evaluate various potential risks in the transmission process, such as the security of intermediate nodes and the reliability of transmission protocols. By comprehensively considering all aspects of data transmission, this system can more accurately evaluate and prevent various potential safety hazards in the transmission process. This provides a more comprehensive and efficient security protection method for the urban rail transit system, avoiding the blind spots of traditional single monitoring methods.

[0097] The transmission anomaly threshold R2 can be set and adjusted according to the actual situation. In this way, the system can adapt to different transmission environments and security requirements, ensuring that the best security protection can be provided in different application scenarios. The flexible threshold setting enables the system to automatically adjust the detection standards according to different risk levels and security requirements, improving the adaptability and flexibility of the system. This adjustable mechanism ensures the efficient operation of the system in different security environments, and helps to improve the accuracy and stability of overall information protection.

[0098] When the transmission environment abnormality coefficient YX2 exceeds the preset threshold, the system can immediately generate alarm information and locate the abnormal situation to ensure that the security problem can be discovered and resolved in the shortest time. Unlike traditional security protection systems, this system greatly improves the security protection capability of the transmission link through real-time abnormality detection and feedback mechanism. This instant response mechanism reduces the impact of potential security events on data transmission and improves the system's protection efficiency and data security.

[0099] Example 6: Please refer to Figure 1 The fourth analysis module 6 includes a fourth calculation unit 61 and a fourth analysis unit 62. The fourth calculation unit 61 is used to calculate the storage abnormality coefficient YX3. The fourth analysis unit 62 is used to compare the storage abnormality coefficient YX3 with the preset storage abnormality threshold R3, so as to generate a fourth comparison result, which is as follows:

[0100] When YX3>R3, it means that the current information has a security problem in the storage node and needs to be located. When YX3≤R3, it means that the current information has no security problem in the storage node and does not need to be located.

[0101] The fourth calculation unit 61 calculates and obtains the storage abnormality coefficient YX3 by the following formula:

[0102]

[0103] Where: I is the storage encryption state, J is the backup frequency, K is the backup encryption state, L is the storage access control rate, and ln is the logarithmic function.

[0104] In this embodiment: the fourth calculation unit 61 uses key parameters such as storage encryption status, backup frequency, backup encryption status and storage access control rate to perform precise calculations through logarithmic functions to obtain the storage anomaly coefficient YX3. This calculation method can comprehensively evaluate the potential security risks in the storage process. Traditional information protection systems often focus on security protection in the data transmission link and ignore the potential risks in the storage process. This system can comprehensively reflect the security of the storage link by calculating the storage anomaly coefficient YX3 in multiple dimensions. This helps to timely identify abnormal behaviors in the storage process, such as the risk of leakage of unencrypted storage data and backup data, thereby improving the security protection level of stored data.

[0105] The storage anomaly coefficient YX3 is compared with the preset storage anomaly threshold R3 through the fourth analysis unit 62. If the storage anomaly coefficient YX3 exceeds the preset threshold, the system will automatically trigger the anomaly location and take corresponding safety measures. Traditional systems usually lack real-time storage risk detection and processing capabilities, while this system can intelligently monitor potential safety issues in the storage process and locate them in time when anomalies are found. This automated anomaly detection mechanism significantly improves the safety of the storage link and reduces the lag of human intervention and inspection.

[0106] By integrating parameters such as storage encryption status, backup frequency, backup encryption status, and storage access control rate, this system can comprehensively evaluate the security of the storage process, especially the risks related to data encryption and backup security. Traditional storage security protection systems may only focus on data encryption or backup frequency, while ignoring other key factors in the storage process. By integrating these key factors, this system can accurately identify potential threats in the storage process, such as unencrypted backup data or unauthorized access, thereby providing more comprehensive security protection.

[0107] The storage anomaly threshold R3 can be set dynamically according to actual needs. Users can adjust the threshold according to different security requirements and risk tolerance, so that the system can provide the most appropriate protection strategy in different environments. The flexible threshold adjustment mechanism enables the system to adapt to different storage environments and security requirements. Whether it is a scenario with high security requirements or a scenario with general data protection requirements, the system can be adjusted according to specific security standards to ensure the best security protection effect. This enhances the adaptability and flexibility of the system.

[0108] When the storage anomaly coefficient YX3 exceeds the preset threshold, the system can immediately generate an alarm and start abnormal location, ensuring that security issues in the storage link can be identified and handled in the shortest possible time. Unlike traditional storage security protection systems, this system has the ability to detect and respond quickly in real time, and can promptly detect and respond to various security threats during data storage. Through this real-time response mechanism, the system greatly improves the security of stored data and reduces the risk of potential data leakage or tampering.

[0109] The contents not described in detail in this specification belong to the prior art known to professional and technical personnel in this field.

[0110] Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments, or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. An intelligent information protection system for ensuring the safety of urban rail transit, characterized in that: It comprises a data acquisition module (1), a data preprocessing module (2), a first analysis module (3), a second analysis module (4), a third analysis module (5), a fourth analysis module (6), and a feedback module (7); The data acquisition module (1) is used to perform data acquisition and generate a first data set, a second data set and a third data set; The data preprocessing module (2) is used to preprocess the first data set, the second data set and the third data set, and to dimensionlessly convert the data in the preprocessed first data set, the second data set and the third data set; The first analysis module (3) is used to integrate and calculate the first data set, the second data set and the third data set, so as to generate an abnormal alarm coefficient YCX, and compare the abnormal alarm coefficient YCX with a preset abnormal alarm threshold value Y, so as to generate a first comparison result, and determine whether there is an information risk in the current terminal according to the first comparison result; The second analysis module (4) is used to integrate and calculate the first data set to generate a user access anomaly coefficient YX1, and compare the user access anomaly coefficient YX1 with a preset user access anomaly threshold R1 to generate a second comparison result, and determine whether there is an abnormal risk in the user access link based on the second comparison result; The third analysis module (5) is used to integrate and calculate the second data set, thereby generating a transmission link abnormality coefficient, and compare the transmission environment abnormality coefficient YX2 with a preset transmission abnormality threshold R2, thereby generating a third comparison result, and judging whether there is an abnormality risk in the transmission link according to the third comparison result; The fourth analysis module (6) is used to integrate and calculate the third data set to generate a storage abnormality coefficient YX3, and compare the storage abnormality coefficient YX3 with a preset storage abnormality threshold R3 to generate a fourth comparison result, and determine whether there is an abnormal risk in the storage environment according to the fourth comparison result; The feedback module (7) is used to summarize the first comparison result, the second comparison result, the third comparison result and the fourth comparison result, and generate a visual report which is transmitted to the terminal for alarm.

2. The intelligent information protection system for ensuring the safety of urban rail transit according to claim 1 is characterized in that: The data acquisition module (1) acquires the security information of the terminal through a distributed sensor network and classifies the data into a first data set, a second data set and a third data set; The first data set includes: user full-level adaptation rate A, user access frequency B, user access success rate C and user access time adaptation rate D; The second data set includes: encryption algorithm level adaptation rate E, data transmission frequency F, data transmission path adaptation rate G and data packet integrity H; The third data set includes: storage encryption status I, backup frequency J, backup encryption status K and storage access control rate L.

3. The intelligent information protection system for ensuring the safety of urban rail transit according to claim 2 is characterized in that: The first analysis module (3) comprises a first calculation unit (31) and a first analysis unit (32), wherein the first calculation unit (31) is used to integrate and calculate the first data set, the second data set and the third data set, thereby generating an abnormal alarm coefficient YCX, and the first analysis unit (32) is used to compare the abnormal alarm coefficient YCX with the abnormal alarm threshold value Y, thereby generating a first comparison result, which is specifically as follows: When YCX>Y, it means that there is a security problem with the current information and an alarm needs to be issued. When YCX≤Y, it means that there is no security problem with the current information and no alarm needs to be issued.

4. The intelligent information protection system for ensuring the safety of urban rail transit according to claim 3 is characterized in that: The first calculation unit (31) calculates and obtains the abnormal alarm coefficient YCX by the following formula: Where: A is the user full-level adaptation rate, B is the user access frequency, C is the user access success rate, D is the user access time adaptation rate, E is the encryption algorithm level adaptation rate, F is the data transmission frequency, G is the data transmission path adaptation rate, H is the data packet integrity, I is the storage encryption status, J is the backup frequency, K is the backup encryption status, and L is the storage access control rate; a1, a2 and a3 are weight values, and the values ​​of a1, a2 and a3 are adjusted and set by the user.

5. The intelligent information protection system for ensuring the safety of urban rail transit according to claim 4 is characterized in that: The second analysis module (4) comprises a second calculation unit (41) and a second analysis unit (42), wherein the second calculation unit (41) is used to perform integrated calculation on the first data set, thereby generating a user access anomaly coefficient YX1, and the second analysis unit (42) is used to compare the user access anomaly coefficient YX1 with a preset user access anomaly threshold R1, thereby generating a second comparison result, specifically as follows: When YX1>R1, it means that the current information has a security problem at the user access node and needs to be located abnormally. When YX1≤R1, it means that the current information has no security problem at the user access node and does not need to be located abnormally.

6. The intelligent information protection system for ensuring the safety of urban rail transit according to claim 5 is characterized in that: The second calculation unit (41) calculates and obtains the user access abnormality coefficient YX1 through the following formula: Where: A is the user's full-level adaptation rate, B is the user's access frequency, C is the user's access success rate, D is the user's access time adaptation rate, and ln is a logarithmic function.

7. The intelligent information protection system for ensuring the safety of urban rail transit according to claim 6 is characterized in that: The third analysis module (5) comprises a third calculation unit (51) and a third analysis unit (52), wherein the third calculation unit (51) is used to calculate the transmission link abnormality coefficient, and the third analysis unit (52) is used to compare the transmission environment abnormality coefficient YX2 with a preset transmission abnormality threshold R2, thereby generating a third comparison result, specifically as follows: When YX2>R2, it means that the current information has a security problem in the transmission environment node and needs to be located. When YX2≤R2, it means that the current information has no security problem in the transmission environment node and does not need to be located.

8. The intelligent information protection system for ensuring the safety of urban rail transit according to claim 7 is characterized in that: The third calculation unit (51) is calculated by the following formula: Where: E is the encryption algorithm level adaptation rate, F is the data transmission frequency, G is the data transmission path adaptation rate, H is the data packet integrity, and ln is the logarithmic function.

9. The intelligent information protection system for ensuring the safety of urban rail transit according to claim 8 is characterized in that: The fourth analysis module (6) comprises a fourth calculation unit (61) and a fourth analysis unit (62), wherein the fourth calculation unit (61) is used to calculate the storage abnormality coefficient YX3, and the fourth analysis unit (62) is used to compare the storage abnormality coefficient YX3 with a preset storage abnormality threshold R3, thereby generating a fourth comparison result, which is specifically as follows: When YX3>R3, it means that the current information has a security problem in the storage node and needs to be located. When YX3≤R3, it means that the current information has no security problem in the storage node and does not need to be located.

10. The intelligent information protection system for ensuring the safety of urban rail transit according to claim 9, characterized in that: The fourth calculation unit (61) calculates and obtains the storage abnormality coefficient YX3 by the following formula: Where: I is the storage encryption state, J is the backup frequency, K is the backup encryption state, L is the storage access control rate, and ln is the logarithmic function.

Images