Train control defense method and system based on infectious disease model

Abstract

The invention discloses a train control defense method and system based on an infectious disease model, and the method comprises the steps: S1, building an APT attack propagation model, and describing the node state transition and propagation process of an attack in a train control system; s2, based on an APT attack propagation model, obtaining the performance of a train control system information domain network and the physical domain train operation performance; s3, collecting physical state data and information domain communication state data of train operation, and constructing a multi-dimensional feature vector; s4, performing dynamic detection on the train operation data by using a random forest algorithm and a long short-term memory network, and identifying a pseudo data injection attack; and S5, after the APT attack occurs, optimizing a train operation path and a speed control strategy, and reducing the influence of the attack on the system by adjusting a mobile authorization information flow path. Through dynamic interaction of the information domain and the physical domain, neglect of influence on the physical domain in a traditional defense method is made up.

Description

Technical Field

[0001] The present invention relates to the field of rail transit control systems, and in particular to a train control defense method and system based on an infectious disease model. Background Art

[0002] As train control systems gradually develop towards automation and intelligence, communication-based train control (CBTC) and cyber-physical systems (CPS) are widely used around the world. These systems complete the dispatching, traction, braking and safety of trains through real-time communication between sensors, networks and control units. However, this efficient intelligent system is also facing the threat of APT attacks and pseudo data injection attacks. APT attacks usually disrupt the normal operation of key nodes by gradually infiltrating multiple nodes in the system and expanding horizontally. Pseudo data injection attacks inject forged data packets into the train control system, such as tampering with speed, displacement and acceleration information, causing the train to slow down, speed or stop abnormally, thereby affecting the overall traffic dispatching and operation safety.

[0003] On the one hand, existing technologies focus more on attack detection in the information domain. Although they can effectively detect and protect against a single type of attack, they ignore the direct impact of information domain attacks on the operating behavior of the physical domain when facing complex attacks, and the defense mechanism cannot restore the normal operation of the system. On the other hand, most current defense systems have a certain delay in detecting and responding to attacks, which is particularly fatal when facing high-speed trains. When a train encounters a network attack or false data injection, the existing defense system cannot respond effectively in a short period of time, which may cause accidents or delays in the train. Therefore, it is necessary to propose a train control defense method that can comprehensively model and dynamically protect the information-physical domain. Summary of the invention

[0004] In order to solve the problem that the existing train control defense methods ignore the impact on the physical domain, the present invention proposes a train control defense method and system based on an infectious disease model to solve the above problem.

[0005] The present application discloses a train control defense method based on an infectious disease model, comprising the following steps:

[0006] S1. Establish an APT attack propagation model to describe the node state transfer and propagation process of the attack in the train control system;

[0007] S2. Based on the APT attack propagation model, the performance of the information domain network of the train control system and the train operation performance in the physical domain are obtained;

[0008] S3, collecting the physical state data and information domain communication state data of the train operation, and constructing a multi-dimensional feature vector;

[0009] S4. Use the random forest algorithm and long short-term memory network to dynamically detect train operation data and identify false data injection attacks;

[0010] S5. After an APT attack occurs, optimize the train operation path and speed control strategy, and reduce the impact of the attack on the system by adjusting the mobile authorization information flow path.

[0011] Preferably, the S1 comprises the following steps:

[0012] Time series analysis of multiple attack stages, the time series model is:

[0013]

[0014] Among them, P(i,j) represents the state transition probability, i and j represent the device nodes in the train control system network;

[0015] The relationship between the propagation rate and the attack intensity is defined as:

[0016] β=β0·(1+α·I a );

[0017] Among them, β is the propagation rate, β0 represents the system default propagation rate without the influence of attack intensity, α is the attack intensity coefficient, I a the intensity of resources invested in the attacker;

[0018] The probability of successful infection by virus software is:

[0019] λ=f(β)=1-e -β ;

[0020] The APT attack propagation model is established as follows:

[0021]

[0022] Among them, N(t) is the number of normal nodes at time t, I(t) is the number of infected nodes at time t, P(t) is the number of propagation nodes at time t, C(t) is the number of completed nodes at time t, S(t) is the number of safe nodes at time t, and θ is the probability that the attacker obtains device control authority after the invasion. is the probability of the attacker launching an attack, δ is the false alarm rate of the intrusion product, and M is the total number of devices in the system.

[0023] Preferably, the APT attack propagation model is constrained as follows:

[0024] The direct information flow between node i and node j in the train control system network is:

[0025]

[0026] Among them, I i,j (t) is the flow from node i to node j under normal operation, r i,j (t) is the abnormal information flow generated by the attacker’s behavior, δ i (t) is the false alarm rate of the intrusion product at node i at time t;

[0027] The link capacity constraint is:

[0028] 0≤f i,j (t)≤c i,j (t);

[0029] Among them, c i,j (t) is the link capacity;

[0030] The node flow conservation constraints are as follows:

[0031]

[0032] Where E is the set of edges between any two nodes i and j in the network, S r is the source node, T r is the transmission node, S i is the sink node.

[0033] Preferably, the performance of the train control system information domain network is as follows:

[0034]

[0035] ε is S r To S i The set of all feasible flow paths between, N is the number of feasible flows in the set, e l is the lth feasible path;

[0036] C P (t) is normalized to obtain:

[0037]

[0038] in, Indicates c p (t) minimum value, If it is 0, it means there is no feasible path in the network. C p (t) maximum value, indicating that all information transmission paths in the network are available, Cy(t)∈[0,1], the closer it is to 0, the greater the impact of the attack on the information domain network of the train control system;

[0039] Taking the train speed deviation and train delay time as indicators to measure the train running performance, the train running performance loss under APT attack is as follows:

[0040] Δp(t)=Δv+Δt=[v(d)-v norm (d)]+[t(d)-t schedule (d)];

[0041] Among them, Δv is the speed deviation of the train, Δt is the train delay time, v(d) is the actual speed of the train at position d, t(d) is the time when the train arrives at position d, and v norm (d) is the speed of the train at position d obtained according to the optimal speed-distance curve and timetable, t schedule (d) is the time when the train arrives at position d according to the optimal speed-distance curve and the timetable;

[0042] The physical domain train operation performance is obtained through normalization as follows:

[0043]

[0044] Among them, when Py(t) is smaller, it means that the APT attack has less impact on the performance of train operation. Among them, when Py(t) is smaller, it means that the APT attack has less impact on the performance of train operation. Δv(d) is the actual speed deviation of the train at position d, Δv min (d) is the minimum deviation of the actual speed of the train at position d, Δv max (d) is the maximum deviation of the actual speed of the train at position d, Δt(d) is the delay time of the train arriving at position d, and Δt min (d) is the minimum delay time of the train arriving at position d, Δt max (d) is the maximum delay time of the train arriving at position d.

[0045] Preferably, S3 comprises the following steps:

[0046] The hierarchical analysis method is used to solve the network performance in the information domain and the train operation performance in the physical domain, and the information security analysis model of the train control system is obtained as follows:

[0047] Sy(t)=w1Cy(t)+w2Py(t);

[0048] Among them, w1 is the weight of the network performance Cy(t) in the information domain, and w2 is the weight of the train operation performance Py(t) in the physical domain.

[0049] Preferably, S4 comprises the following steps:

[0050] Multi-classifier fusion, the output fusion of random forest algorithm and long short-term memory network is realized through weighted averaging:

[0051] M final =η1M RF +η2M LSTM ;

[0052] Among them, M final represents the output of the random forest algorithm and the long short-term memory network, M RF is the classification probability of random forest, M LSTM is the classification probability of the long short-term memory network, η1 and η2 are adjustable weights used to balance the contribution of the random forest algorithm and the long short-term memory network.

[0053] Use statistical models to verify the fusion results and reduce the false alarm rate:

[0054]

[0055] Among them, S represents the false alarm rate, a t is the current acceleration value, is the average value of acceleration, σ a is the standard deviation of acceleration. If S exceeds the threshold, it is marked as abnormal;

[0056] Multimodal feature fusion, through multimodal feature fusion random forest algorithm and long short-term memory network input data:

[0057] X=[X time ,X network ,X behavior ];

[0058] Among them, X time is the time series characteristics including velocity, acceleration and displacement, X network is the network characteristics including communication delay and packet loss rate, X behavior Device behavior characteristics including device CPU usage and memory usage;

[0059] Modeling time series data using Transformer-based deep learning architecture:

[0060] H t = Transformer(X t );

[0061] Among them, X t is the input feature of the current time window, H t High-dimensional features extracted for the Transformer model;

[0062] Adaptive Learning Updates:

[0063] Update the classifier weights through online learning to adapt to the changing attack patterns. Online learning includes the following steps:

[0064] The detected abnormal samples are stored in a temporary cache;

[0065] Retrain the model at fixed intervals to incorporate the latest attack samples.

[0066] Preferably, S5 comprises the following steps:

[0067] S51. Dynamic weight allocation for path optimization:

[0068] In path optimization, a weight-based dynamic adjustment mechanism is introduced:

[0069]

[0070] Among them, r 容量 is the remaining capacity of the path, is the probability of a path node being attacked, ρ1 and ρ2 are adjustable weights, and W 路径 is the weight of the path.

[0071] The weights are adjusted dynamically as follows:

[0072]

[0073] in, represents the time rate of change of the path capacity, It represents the rate of change of the probability of a path node being attacked, α is the coefficient weighing the change in capacity, and β is the coefficient weighing the change in attack probability.

[0074] The path optimization goal is to minimize the path weight:

[0075]

[0076] Among them, J 路径 is the path optimization target, K is the number of all optional paths, W 路径,k is the weight of the kth path.

[0077] Model the path remaining capacity as a function of the link capacity,

[0078]

[0079] Among them, C l is the total capacity of link l, F l is the current traffic of link l;

[0080] The probability of a path node being attacked is modeled as a time series module based on historical attack behaviors, and predicted using a long short-term memory network:

[0081]

[0082] represents the probability of the path being attacked;

[0083] Real-time path optimization is achieved by dynamically adjusting ρ1 and ρ2. When the system detects that the remaining capacity of the path decreases rapidly, the weight of ρ1 is increased.

[0084] S52, coordinated train dispatching strategy:

[0085] In multi-train operation scenarios, coordinate the speed and paths between trains to reduce global scheduling disorders caused by attacks.

[0086] Under APT attacks, train scheduling optimization needs to consider speed, time, and path at the same time, and the optimization objectives are:

[0087]

[0088] Among them, J 调度 is the scheduling optimization objective, Δv i is the deviation between the actual speed of train i and the optimal speed, Δt I is the deviation between the actual arrival time and the planned time of train i, φ i is the attack probability of the path where train i is located, and λ1, λ2, and λ3 are weight parameters.

[0089] The actual running time of a train is determined by its speed and acceleration:

[0090]

[0091] Among them, t i is the actual running time of train i, L i is the total running distance of train i, v i (s) represents the speed of train i at position s, and the train speed v is adjusted by i Achieve time optimization and combine train delay time constraints:

[0092]

[0093] Among them, T 容忍 is the maximum tolerable delay time, is the planned arrival time of train i.

[0094] S53, Attack Isolation Mechanism:

[0095] After an APT attack occurs, while isolating the infected nodes, communication is restored through redundant paths and backup equipment, and the backup signal equipment on the trackside takes over the communication tasks.

[0096] Considering the communication capability of the backup device, the communication recovery capability is defined as:

[0097]

[0098] Among them, C m is the communication capacity of the device, φ m is the probability of the device being attacked, by maximizing the communication recovery capability R 恢复 , determine the optimal allocation of redundant devices.

[0099] The objective function of isolation optimization is defined as:

[0100]

[0101] Among them, J 隔离 To optimize the isolation target, For redundant path combination, is the attack probability of path k, R 恢复,m is the recovery capability of the backup device, and γ is the coefficient used to balance the weight between path selection and device recovery.

[0102] To ensure the effectiveness of attack isolation, path selection needs to meet the following constraints:

[0103] R 容量 (P)≥R 阈值 ;

[0104] R 容量 (P) represents the remaining capacity of path P, R 阈值 is the minimum path capacity.

[0105] S54, Real-time defense and prediction model:

[0106] Use LSTM to dynamically predict the attack probability:

[0107]

[0108] Combining the characteristics of the physical domain and the information domain, the Transformer model is used to analyze multimodal data:

[0109] H = Transformer(X);

[0110] Among them, X is the multimodal feature vector and H is the high-dimensional feature.

[0111] In order to cope with the changes in APT attack patterns, the defense model needs to store the detected abnormal data in the cache and retrain the defense model every ΔT:

[0112]

[0113] Among them, L is the loss function, f(x i ; θ) is the predicted value of the defense model.

[0114] S55, comprehensive optimization framework:

[0115] Combining path optimization, coordinated train scheduling, and attack isolation mechanism, a complete optimization framework is formed. The overall optimization goal is:

[0116] J 总 =τ1·J 路径 +τ2·J 调度 +τ3·J 隔离 ;

[0117] Among them, τ1, τ2, and τ3 are weight parameters.

[0118] The present application also discloses a train control defense system based on an infectious disease model, which is used to implement the train control defense method based on an infectious disease model, including:

[0119] Data acquisition module: used to collect train physical domain and information domain data in real time. The physical domain data includes dynamic operation information such as the train's real-time speed, acceleration, and displacement; the information domain data includes the status of control signals, the communication status of data packets, and the communication health of sensor networks.

[0120] Detection module: Real-time detection of fake data injection attacks based on random forest algorithm and long short-term memory network;

[0121] Analysis module: used to simulate the APT attack propagation process and evaluate the potential impact of the attack on the train control system;

[0122] Defense module: used to dynamically adjust the train path and control strategy to improve the robustness of the train control system.

[0123] Beneficial effects of the present invention:

[0124] (1) Full coverage defense framework: From APT propagation modeling to fake data injection detection, it provides an end-to-end system defense method.

[0125] (2) Information-physical coupling analysis: Through the dynamic interaction between the information domain and the physical domain, it makes up for the neglect of the impact of the physical domain in traditional defense methods.

[0126] (3) Real-time and robustness: Dynamic detection and rapid response mechanism based on machine learning algorithm triggers defense within 0.2 seconds after the attack occurs.

[0127] (4) Efficient optimization: The path optimization algorithm is used to reduce the impact of attacks on the communication path and maximize the safety of train operation.

[0128] (5) Attack detection accuracy reaches 96%, communication path recovery capability is improved to 80%, and train scheduling delays are reduced by 70%. BRIEF DESCRIPTION OF THE DRAWINGS

[0129] Figure 1 A flow chart of a train control defense method based on an infectious disease model according to an embodiment of the present invention;

[0130] Figure 2 A physical information coupling model diagram of an embodiment of the present invention;

[0131] Figure 3 A dynamic response diagram of a defense strategy according to an embodiment of the present invention;

[0132] Figure 4 A speed variation diagram of a train system according to an embodiment of the present invention;

[0133] Figure 5 A schematic diagram of the structure of a train control defense system based on an infectious disease model according to an embodiment of the present invention;

[0134] Figure 6 It is a schematic diagram of the defense effect of an embodiment of the present invention. DETAILED DESCRIPTION

[0135] In order to make the objectives, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below with reference to the accompanying drawings and examples.

[0136] The embodiment of the present invention discloses a train control defense method based on an infectious disease model, such as Figure 1 As shown in the figure, by establishing an APT attack propagation model, the node state transfer and propagation process of the attack in the train control system is described. At the same time, the physical state data of the train operation and the information domain communication state data are collected to construct a multi-dimensional feature vector. The machine learning algorithm is used to dynamically detect the train operation data to identify pseudo data injection attacks. Finally, after the APT attack occurs, the train operation path and speed control strategy are optimized, and the impact of the attack on the system is reduced by adjusting the mobile authorization information flow (MA) path, realizing the comprehensive modeling of the information physical domain and dynamically protecting the train control system. Specifically, the following steps are included:

[0137] S1. Establish an APT attack propagation model to describe the node state transfer and propagation process of the attack in the train control system.

[0138] Time series analysis of multiple attack stages, the time series model is:

[0139]

[0140] Among them, P(i,j) represents the state transition probability, i and j represent the device nodes in the train control system network, and the Markov chain is used to analyze the dynamic behavior of the state transition.

[0141] Analyze the impact of attack intensity on propagation rate, and define the relationship between propagation rate and attack intensity as:

[0142] β=β0·(1+α·I a );

[0143] Where β is the propagation rate, β0 represents the default propagation rate of the system when there is no influence of attack intensity, and in this embodiment, the value is 0.01 to 0.1, α is the attack intensity coefficient, I a The intensity of resources invested in the attacker.

[0144] The train control system can simulate the changes in the propagation rate under low, medium and high intensity attacks. The simulation is based on the propagation rate β0. When β0 is 0.01, it is low intensity, when β0 is 0.05, it is medium intensity, and when β0 is 0.1, it is high intensity. As the attacker's resource investment increases, the propagation rate increases significantly, enhancing the adaptability to real scenarios. The probability of successful infection by the virus software is:

[0145] λ=f(β)=1-e -β ;

[0146] The APT attack propagation model is established as follows:

[0147]

[0148] Among them, N(t) is the number of normal nodes at time t, I(t) is the number of infected nodes at time t, P(t) is the number of propagation nodes at time t, C(t) is the number of completed nodes at time t, S(t) is the number of safe nodes at time t, and θ is the probability that the attacker obtains device control authority after the invasion. is the probability of the attacker launching an attack, δ is the false alarm rate of the intrusion product, and M is the total number of devices in the system.

[0149] The direct information flow between node i and node j in the train control system network is:

[0150]

[0151] Among them, I i,j(t) is the flow from node i to node j under normal operation, r i,j (t) is the abnormal information flow generated by the attacker’s behavior, δ i (t) is the false alarm rate of the intrusion product at node i at time t;

[0152] The link capacity constraint is:

[0153] 0≤f i,j (t)≤c i,j (t);

[0154] Among them, c i,j (t) is the link capacity.

[0155] The node flow conservation constraints are as follows:

[0156]

[0157] Where E is the set of edges between any two nodes i and j in the network, S r is the source node, T r is the transmission node, S i is the sink node.

[0158] S2. Based on the APT attack propagation model, the performance of the information domain network of the train control system and the physical domain train operation performance are obtained.

[0159] The performance of the information domain network of the train control system is the product of the maximum feasible flow and its number in the network at time t, and the expression is as follows:

[0160]

[0161] ε is S r To S i The set of all feasible flow paths between, N is the number of feasible flows in the set, e l is the lth feasible path.

[0162] C P (t) is normalized to obtain:

[0163]

[0164] in, Represents C p (t) minimum value, If it is 0, it means there is no feasible path in the network. C p The maximum value of (t) indicates that all information transmission paths in the network are available, Cy(t)∈[0,1]. The closer it is to 0, the greater the impact of the attack on the information domain network of the train control system.

[0165] Taking the train speed deviation and train delay time as indicators to measure the train running performance, the train running performance loss under APT attack is as follows:

[0166] Δp(t)=Δv+Δt=[v(d)-v norm (d)]+[t(d)-t schedule (d)];

[0167] Among them, Δv is the speed deviation of the train, Δt is the train delay time, v(d) is the actual speed of the train at position d, t(d) is the time when the train arrives at position d, and v norm (d) is the speed of the train at position d obtained according to the optimal speed-distance curve and timetable, t schedule (d) is the time when the train arrives at position d according to the optimal speed-distance curve and the timetable;

[0168] The physical domain train operation performance is obtained through normalization as follows:

[0169]

[0170] Among them, when Py(t) is smaller, it means that the APT attack has less impact on the performance of train operation, Δv(d) is the actual speed deviation of the train at position d, Δv min (d) is the minimum deviation of the actual speed of the train at position d, Δv max (d) is the maximum deviation of the actual speed of the train at position d, Δt(d) is the delay time of the train arriving at position d, and Δt min (d) is the minimum delay time of the train arriving at position d, Δd max (d) is the maximum delay time of the train arriving at position d.

[0171] S3, collect the physical state data of train operation and the communication state data of information domain, construct a multi-dimensional feature vector, and the interaction between physical domain and information domain is as follows: Figure 2 shown.

[0172] The hierarchical analysis method is used to solve the network performance in the information domain and the train operation performance in the physical domain, and the information security analysis model of the train control system is obtained as follows:

[0173] Sy(t)=w1Cy(t)+w2Py(t);

[0174] Among them, w1 is the weight of the network performance Cy(t) in the information domain, and w2 is the weight of the train operation performance Py(t) in the physical domain.

[0175] S4. Use the random forest algorithm and long short-term memory network (LSTM) to dynamically detect train operation data and identify pseudo data injection attacks. The random forest algorithm can quickly detect specific patterns of pseudo data injection, and the long short-term memory network can process time series data and identify time dependencies in attack behaviors.

[0176] Random forest is a machine learning algorithm based on an ensemble of multiple decision trees that can quickly detect specific pseudo data injection patterns.

[0177] The prediction loss of each decision tree is defined as:

[0178]

[0179] Among them, Loss represents the loss function, which is the cross entropy loss, y i is the true value, is the predicted value of the g-th tree, and N is the number of data points.

[0180] The final predicted value is:

[0181]

[0182] Here, G is the number of trees in the forest.

[0183] The LSTM network is an improved model of recurrent neural network that can capture long-term and short-term dependencies in time series data. The key to the LSTM network lies in its unique gate mechanism, including forget gate, input gate and output gate, which work together on the cell state.

[0184] The information that needs to be discarded is controlled by the forget gate:

[0185] f t =σ(W f ·[h t-1 ,x t ]+b f );

[0186] Among them, f t is the output of the forget gate, σ is the activation function, and the activation function is used in this embodiment: W f is the weight matrix of the forget gate, b f is the bias of the forget gate, h t-1 is the hidden state at the previous moment, x t is the current input.

[0187] The information that needs to be added is determined by the input gate:

[0188]

[0189] Among them, it is the input gate output, is the candidate cell state, tanh is the hyperbolic tangent activation function, W i is the weight matrix of the input gate, W C is the weight matrix of the candidate cell state, b C is the bias term of the candidate cell state.

[0190] Update cell status:

[0191]

[0192] Among them, C t is the cell state at the current moment.

[0193] Output gate and hidden state update:

[0194]

[0195] Among them, t is the output of the output gate, h t is the hidden state at the current moment, W o is the weight matrix of the output gate, b o is the bias of the output gate.

[0196] Using long short-term memory networks to capture complex dependencies in time series can capture the dynamic changes in acceleration, velocity, displacement, and changing patterns of communication delays.

[0197] Multi-classifier fusion improves the accuracy of detecting pseudo data injection and attack behaviors by combining the random forest algorithm and the long short-term memory network. The outputs of the random forest algorithm and the long short-term memory network are fused through weighted averaging:

[0198] M final =η1M RF +η2M LSTM ;

[0199] Among them, M final represents the output of the random forest algorithm and the long short-term memory network, M RF is the classification probability of random forest, M LSTM is the classification probability of the long short-term memory network, η1 and η2 are adjustable weights used to balance the contribution of the random forest algorithm and the long short-term memory network.

[0200] Use statistical models to verify the fusion results and reduce the false alarm rate:

[0201]

[0202] Among them, S represents the false alarm rate, a t is the current acceleration value, is the average value of acceleration, σ a is the standard deviation of acceleration. If S exceeds the threshold, it is marked as abnormal;

[0203] Multimodal feature fusion, through multimodal feature fusion random forest algorithm and long short-term memory network input data:

[0204] X=[X time ,X network ,X behavior ];

[0205] Among them, X time is the time series characteristics including velocity, acceleration and displacement, X network is the network characteristics including communication delay and packet loss rate, X behavior The device behavior characteristics include the CPU usage and memory usage of the device.

[0206] Introducing the Transformer model, using a Transformer-based deep learning architecture (such as BERT or Time Series Transformer) to model time series data:

[0207] H t = Transformer(X t );

[0208] Among them, X t is the input feature of the current time window, H t High-dimensional features extracted for the Transformer model. This captures data dependencies across time steps and is used to monitor multi-stage behavior patterns in APT attacks.

[0209] Adaptive learning updates, which update the weights of the random forest algorithm and the long short-term memory network through online learning to adapt to the changing attack patterns. Online learning includes the following steps:

[0210] The detected abnormal samples are stored in a temporary cache;

[0211] The model is retrained at fixed intervals (24 hours in this embodiment), that is, repeated training is performed based on the propagation rates under low, medium, and high intensity attacks, and the latest attack samples are incorporated.

[0212] S5. After an APT attack occurs, optimize the train operation path and speed control strategy, and reduce the impact of the attack on the system by adjusting the mobile authorization information flow path.

[0213] S51. Dynamic weight allocation for path optimization:

[0214] In path optimization, a weight-based dynamic adjustment mechanism is introduced:

[0215]

[0216] Among them, R 容量 is the remaining capacity of the path, is the probability of a path node being attacked, ρ1 and ρ2 are adjustable weights, and W 路径 is the weight of the path.

[0217] The weights are adjusted dynamically as follows:

[0218]

[0219] in, represents the time rate of change of the path capacity, It represents the rate of change of the probability of a path node being attacked, α is the coefficient weighing the change in capacity, and β is the coefficient weighing the change in attack probability.

[0220] The path optimization goal is to minimize the path weight:

[0221]

[0222] Among them, J 路径 is the path optimization target, K is the number of all optional paths, W 路径,k is the weight of the kth path.

[0223] Model the path remaining capacity as a function of the link capacity,

[0224]

[0225] Among them, C l is the total capacity of link l, F l is the current traffic of link l;

[0226] The probability of a path node being attacked is modeled as a time series module based on historical attack behaviors, and predicted using a long short-term memory network:

[0227]

[0228] Indicates the probability of a path being attacked.

[0229] Real-time path optimization is achieved by dynamically adjusting ρ1 and ρ2. When the system detects that the remaining capacity of the path decreases rapidly, the weight of ρ1 is increased.

[0230] S52, coordinated train dispatching strategy:

[0231] In multi-train operation scenarios, coordinate the speed and paths between trains to reduce global scheduling disorders caused by attacks.

[0232] Under APT attacks, train scheduling optimization needs to consider speed, time, and path at the same time, and the optimization objectives are:

[0233]

[0234] Among them, J 调度 is the scheduling optimization objective, Δv i is the deviation between the actual speed of train i and the optimal speed, Δt i is the deviation between the actual arrival time and the planned time of train i, φ i is the attack probability of the path where train i is located, and λ1, λ2, and λ3 are weight parameters.

[0235] The actual running time of a train is determined by its speed and acceleration:

[0236]

[0237] Among them, t i is the actual running time of train i, L i is the total running distance of train i, v i (s) represents the speed of train i at position s, and the train speed v is adjusted by i Achieve time optimization and combine train delay time constraints:

[0238]

[0239] Among them, T 容忍 is the maximum tolerable delay time, is the planned arrival time of train i.

[0240] S53, Attack Isolation Mechanism:

[0241] After an APT attack occurs, while isolating the infected nodes, communication is restored through redundant paths and backup equipment, and the backup signal equipment on the trackside takes over the communication tasks.

[0242] Considering the communication capability of the backup device, the communication recovery capability is defined as:

[0243]

[0244] Among them, C m is the communication capacity of the device, φ m is the probability of the device being attacked, by maximizing the communication recovery capability R 恢复 , determine the optimal allocation of redundant devices.

[0245] The objective function of isolation optimization is defined as:

[0246]

[0247] Among them, J 隔离 To optimize the isolation target, For redundant path combination, is the attack probability of path k, R 恢复,m is the recovery capability of the backup device, and γ is the coefficient used to balance the weight between path selection and device recovery.

[0248] To ensure the effectiveness of attack isolation, path selection needs to meet the following constraints:

[0249] R 容量 (P)≥R 阈值 ;

[0250] R 容量 (P) represents the remaining capacity of path P, R 阈值 is the minimum path capacity.

[0251] S54, Real-time defense and prediction model:

[0252] Use LSTM to dynamically predict the attack probability:

[0253]

[0254] Combining the characteristics of the physical domain and the information domain, the Transformer model is used to analyze multimodal data:

[0255] H = Transformer(X);

[0256] Among them, X is the multimodal feature vector and H is the high-dimensional feature.

[0257] In order to cope with the changes in APT attack patterns, the defense model needs to store the detected abnormal data in the cache and retrain the defense model every ΔT:

[0258]

[0259] Among them, L is the loss function, f(x i ; θ) is the predicted value of the defense model.

[0260] S55, comprehensive optimization framework:

[0261] Combining path optimization, coordinated train scheduling, and attack isolation mechanism, a complete optimization framework is formed. The overall optimization goal is:

[0262] J 总 =τ1·J 路径 +τ2·J 调度 +τ3·J 隔离 ;

[0263] Among them, τ1, τ2, and τ3 are weight parameters.

[0264] Defense strategies dynamically respond to Figure 3 As shown, the train detected the attack at 0.2 seconds, and the system recovered at 1.2 seconds. The picture shows the dynamic response of the defense strategy, reflecting the system's fast real-time and robustness.

[0265] The changes of train defense speed are as follows Figure 4 As shown. Figure 4 It can be seen that the train speed under normal operation varies between 55km / h and 65km / h, which shows that under normal operation, the train runs according to the predetermined speed mode, and the speed changes are regular and predictable. After the train was attacked, the train speed showed significant fluctuations and abnormalities. At about 3 seconds, the train speed dropped sharply and even dropped to 0km / h, which shows that the attack had a serious impact on the operation of the train, which may cause the train to stop running or other failures. After taking defensive measures, the train speed gradually returned to normal operation. Although there were still some fluctuations in the speed at the beginning of the defense, the speed gradually stabilized over time and returned to the normal periodic fluctuation mode. The following conclusions can be drawn: when the train is operating normally, the speed changes are regular and predictable. When the train is attacked, the speed will have serious abnormal fluctuations, which may cause operational failures. After taking effective defensive measures, the train speed can gradually return to normal operation, ensuring the safety and normal operation of the train.

[0266] Another embodiment of the present application also discloses a train control defense system based on an infectious disease model, which is used to implement the above-mentioned train control defense method based on an infectious disease model. Figure 5 As shown, including:

[0267] Data acquisition module: used to collect train physical domain and information domain data in real time. The physical domain data includes dynamic operation information such as the train's real-time speed, acceleration, and displacement; the information domain data includes the status of control signals, the communication status of data packets, and the communication health of sensor networks.

[0268] Detection module: Real-time detection of fake data injection attacks based on random forest algorithm and long short-term memory network;

[0269] Analysis module: used to simulate the APT attack propagation process and evaluate the potential impact of the attack on the train control system;

[0270] Defense module: used to dynamically adjust the train path and control strategy to improve the robustness of the train control system.

[0271] In a specific embodiment, the SUMO simulation tool is used to conduct a joint test of APT attacks and pseudo data injection to evaluate the detection accuracy, response time and recovery capability of the defense system. The results are as follows: Figure 6 As shown, the communication path recovery capability is improved to 80%, the response time triggers the defense within 0.2 seconds after the attack occurs, and the monitoring accuracy is as high as 96%.

[0272] This application takes cyber-physical coupling as the core, and comprehensively solves the security issues of modern rail transit systems under advanced threat attacks through innovative APT propagation modeling, machine learning detection, path optimization and dynamic defense strategies. Through modular design and cross-system integration, it demonstrates extremely high adaptability and practicality, and can significantly improve the robustness and scheduling efficiency of rail transit.

[0273] The above shows and describes the basic principles, main features and advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A train control defense method based on an infectious disease model, characterized in that: The following steps are involved: S1. Establish an APT attack propagation model to describe the node state transfer and propagation process of the attack in the train control system; S2. Based on the APT attack propagation model, the performance of the information domain network of the train control system and the train operation performance in the physical domain are obtained; S3, collecting the physical state data and information domain communication state data of the train operation, and constructing a multi-dimensional feature vector; S4. Use the random forest algorithm and long short-term memory network to dynamically detect train operation data and identify false data injection attacks; S5. After an APT attack occurs, optimize the train operation path and speed control strategy, and reduce the impact of the attack on the system by adjusting the mobile authorization information flow path.

2. The train control defense method based on the infectious disease model according to claim 1 is characterized in that: The S1 comprises the following steps: Time series analysis of multiple attack stages, the time series model is: Among them, P(i,j) represents the state transition probability, i and j represent the device nodes in the train control system network; The relationship between the propagation rate and the attack intensity is defined as: β＝β0·(1+α·I a )； Among them, β is the propagation rate, β0 represents the system default propagation rate without the influence of attack intensity, α is the attack intensity coefficient, I a the intensity of resources invested in the attacker; The probability of successful infection by virus software is: λ=f(β)=1-e -β ; The APT attack propagation model is established as follows: Among them, N(t) is the number of normal nodes at time t, I(t) is the number of infected nodes at time t, P(t) is the number of propagation nodes at time t, C(t) is the number of completed nodes at time t, S(t) is the number of safe nodes at time t, and θ is the probability that the attacker obtains device control authority after the invasion. is the probability of the attacker launching an attack, δ is the false alarm rate of the intrusion product, and M is the total number of devices in the system.

3. The train control defense method based on the infectious disease model according to claim 2 is characterized in that: The APT attack propagation model constraints are as follows: The direct information flow between node i and node j in the train control system network is: Among them, I i,j (t) is the flow from node i to node j under normal operation, r i,j (t) is the abnormal information flow generated by the attacker’s behavior, δ i (t) is the false alarm rate of the intrusion product at node i at time t; The link capacity constraint is: 0≤f i,j (t)≤c i,j (t); Among them, c i,j (t) is the link capacity; The node flow conservation constraints are as follows: Where E is the set of edges between any two nodes i and j in the network, S r is the source node, T r is the transmission node, S i is the sink node.

4. The train control defense method based on the infectious disease model according to claim 3 is characterized in that: The performance of the train control system information domain network is as follows: ε is S r To S i The set of all feasible flow paths between, N is the number of feasible flows in the set, e l is the lth feasible path; C P (t) is normalized to obtain: in, Represents C p (t) minimum value, If it is 0, it means there is no feasible path in the network. C p (t) maximum value, indicating that all information transmission paths in the network are available, Cy(t)∈[0,1], the closer it is to 0, the greater the impact of the attack on the information domain network of the train control system; Taking the train speed deviation and train delay time as indicators to measure the train running performance, the train running performance loss under APT attack is as follows: Δp(t)=Δv+Δt=[v(d)-v norm (d)]+[t(d)-t schedule (d)]; Among them, Δv is the speed deviation of the train, Δt is the train delay time, v(d) is the actual speed of the train at position d, t(d) is the time when the train arrives at position d, and v norm (d) is the speed of the train at position d obtained according to the optimal speed-distance curve and timetable, t schedule (d) is the time when the train arrives at position d according to the optimal speed-distance curve and the timetable; The physical domain train operation performance is obtained through normalization as follows: Among them, when Py(t) is smaller, it means that the APT attack has less impact on the performance of train operation. Among them, when Py(t) is smaller, it means that the APT attack has less impact on the performance of train operation. Δv(d) is the actual speed deviation of the train at position d, Δv min (d) is the minimum deviation of the actual speed of the train at position d, Δv max (d) is the maximum deviation of the actual speed of the train at position d, Δt(d) is the delay time of the train arriving at position d, and Δt min (d) is the minimum delay time of the train arriving at position d, Δt max (d) is the maximum delay time of the train arriving at position d.

5. The train control defense method based on the infectious disease model according to claim 4 is characterized in that: The S3 comprises the following steps: The hierarchical analysis method is used to solve the network performance in the information domain and the train operation performance in the physical domain, and the information security analysis model of the train control system is obtained as follows: Sy(t)=w1Cy(t)+w2Py(t); Among them, w1 is the weight of the network performance Cy(t) in the information domain, and w2 is the weight of the train operation performance Py(t) in the physical domain.

6. The train control defense method based on the infectious disease model according to claim 5 is characterized in that: The S4 comprises the following steps: Multi-classifier fusion, the output fusion of random forest algorithm and long short-term memory network is realized through weighted averaging: M final =η1M RF +η2M LSTM ; Among them, M final represents the output of the random forest algorithm and the long short-term memory network, M RF is the classification probability of random forest, M LSTM is the classification probability of the long short-term memory network, η1 and η2 are adjustable weights; Use statistical models to verify the fusion results and reduce the false alarm rate: Among them, S represents the false alarm rate, a t is the current acceleration value, is the average value of acceleration, σ a is the standard deviation of acceleration. If S exceeds the threshold, it is marked as abnormal; Multimodal feature fusion, through multimodal feature fusion random forest algorithm and long short-term memory network input data: X=[X time ,X network ,X behavior ]; Among them, X time is the time series characteristics including velocity, acceleration and displacement, X network is the network characteristics including communication delay and packet loss rate, X behavior Device behavior characteristics including device CPU usage and memory usage; Modeling time series data using Transformer-based deep learning architecture: H t =Transformer(X t ); Among them, X t is the input feature of the current time window, H t High-dimensional features extracted for the Transformer model; Adaptive learning update: Update the weight of the classifier through online learning to adapt to the changing attack mode. Online learning includes the following steps: The detected abnormal samples are stored in a temporary cache; Retrain the model at fixed intervals to incorporate the latest attack samples.

7. The train control defense method based on the infectious disease model according to claim 6 is characterized in that: The S5 comprises the following steps: S51. The path optimization goal is to minimize the path weight: Among them, J 路径 is the path optimization target, K is the number of all optional paths, W 路径,k is the weight of the kth path; Model the path remaining capacity as a function of the link capacity, Among them, C l is the total capacity of link l, F l is the current traffic of link l; The probability of a path node being attacked is modeled as a time series module based on historical attack behaviors, and predicted using a long short-term memory network: Indicates the probability of a path being attacked; Real-time path optimization is achieved by dynamically adjusting ρ1 and ρ2; S52. Under APT attack, considering speed, time and path at the same time, the optimization goal is: Among them, J 调度 is the scheduling optimization objective, Δv i is the deviation between the actual speed of train i and the optimal speed, Δt i is the deviation between the actual arrival time and the planned time of train i, φ i is the probability of being attacked on the path where train i is located, λ1, λ2, λ3 are weight parameters; S53, the objective function of isolation optimization is defined as: Among them, J 隔离 To optimize the isolation target, For redundant path combination, is the attack probability of path k, R 恢复,m is the recovery capability of the backup device, γ is the coefficient used to balance the weight between path selection and device recovery; To ensure the effectiveness of attack isolation, path selection needs to meet the following constraints: R 容量 (P)≥R 阈值 ; R 容量 (P) represents the remaining capacity of path P, R 阈值 is the minimum path capacity; S54, Real-time defense and prediction model: Use LSTM to dynamically predict the attack probability: Combining the characteristics of the physical domain and the information domain, the Transformer model is used to analyze multimodal data: H = Transformer(X); Among them, X is the multimodal feature vector, H is the high-dimensional feature; In order to cope with the changes in APT attack patterns, the defense model needs to store the detected abnormal data in the cache and retrain the defense model every ΔT: Among them, L is the loss function, f(x i ; θ) is the predicted value of the defense model; S55, comprehensive optimization framework: Combining path optimization, coordinated train scheduling, and attack isolation mechanism, a complete optimization framework is formed. The overall optimization goal is: mice 总 =τ1·J 路径 +τ2·J 调度 +τ3·J 隔离 ; Among them, τ1, τ2, and τ3 are weight parameters.

8. A train control defense system based on an infectious disease model, characterized in that: The train control defense method based on the infectious disease model for implementing any one of claims 1 to 7 comprises: Data acquisition module: used to collect train physical domain and information domain data in real time. The physical domain data includes dynamic operation information such as the train's real-time speed, acceleration, and displacement; the information domain data includes the status of control signals, the communication status of data packets, and the communication health of sensor networks. Detection module: Real-time detection of fake data injection attacks based on random forest algorithm and long short-term memory network; Analysis module: used to simulate the APT attack propagation process and evaluate the potential impact of the attack on the train control system; Defense module: used to dynamically adjust the train path and control strategy to improve the robustness of the train control system.

Images