C3-level train control system network malicious traffic detection method based on robust auto-encoder

Abstract

The invention discloses a C3-level train control system network malicious traffic detection method based on a robust auto-encoder, and the method specifically comprises the steps: 1, collecting traffic data in a C3-level train control system network, then extracting the features of the collected traffic data, carrying out the feature labeling, and taking the labeled data as original data; 2, preprocessing the original data, taking the preprocessed data as a data set sample, and dividing the data set sample into a training set and a test set; step 3, constructing a malicious traffic detection model robust auto-encoder; step 4, training a malicious traffic detection model robust auto-encoder by using the training set to obtain a classification model; 5, inputting the test set into the classification model, and evaluating the performance of the classification model; and 6, detecting the malicious network traffic of the C3-level train control system by using the evaluated classification model. According to the invention, the problems of high detection false alarm rate and missing report rate caused by weak generalization feature learning capability in the prior art are solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network intrusion detection methods, and relates to a C3-level train control system network malicious traffic detection method based on a robust autoencoder. Background Art

[0002] The C3 (CTCS-3) level train control system is mainly divided into ground subsystem and onboard subsystem. Among them, the ground equipment is mainly composed of radio block center (RBC), track circuit, train control center (TCC), transponder control equipment, computer interlocking (CBI), dispatching centralized center (CTC), etc. The onboard equipment of the train control system includes radio transmission module, track circuit reader, train interface unit, human-machine interface, GSM-R antenna, sensor, etc. The transmission of TCC between data networks is based on UDP protocol. The information transmission between RBC and CBI is based on IP protocol at the network layer and TCP protocol at the transport layer. The operation of the train control system relies on wireless communication as the main means of vehicle-ground information transmission, and the system is widely distributed in a large geographical area. This feature makes the train control system network likely to face some specific attacks. For example, eavesdropping attack, traffic analysis attack, denial of service attack (DOS) and distributed denial of service attack (DDOS).

[0003] At present, most of the existing methods for malicious detection of train control systems are machine learning methods, which use machine learning algorithms to model and classify train control traffic data, such as K-means clustering, support vector machine, random forest, XGBoost, etc. Although the above machine learning-based detection methods can achieve a high accuracy rate, they have problems such as weak learning and generalization feature capabilities, which will lead to increased false alarm and missed alarm rates, over-reliance on specific features of training data, and inability to effectively generalize to unseen attack modes, and poor performance in the face of new threats. Summary of the invention

[0004] The purpose of the present invention is to provide a C3-level train control system network malicious traffic detection method based on a robust autoencoder, which solves the problems of high false alarm rate and missed alarm rate caused by weak learning generalization feature ability in the prior art.

[0005] The technical solution adopted by the present invention is a C3-level train control system network malicious traffic detection method based on a robust autoencoder, which is specifically implemented according to the following steps:

[0006] Step 1: Collect the flow data in the C3-level train control system network, then extract the features of the collected flow data and perform feature annotation, and use the annotated data as the original data;

[0007] Step 2: preprocess the original data, use the preprocessed data as data set samples, and divide the data set samples into a training set and a test set;

[0008] Step 3, construct a robust autoencoder for malicious traffic detection model;

[0009] Step 4, using the training set to train the malicious traffic detection model robust autoencoder constructed in step 4 to obtain a classification model;

[0010] Step 5, input the test set into the classification model to evaluate the performance of the classification model;

[0011] Step 6: Use the evaluated classification model to detect malicious traffic in the C3-level train control system network.

[0012] The present invention is also characterized in that:

[0013] The traffic data collected in the C3-level train control system network in step 1 is as follows:

[0014] Use the Wireshark tool to capture normal business traffic data between subsystems of the C3-level train control system and malicious attack traffic data generated by Kali Linux between virtual machines. The traffic data format is pcap file;

[0015] The features of the collected traffic data extracted in step 1 are as follows:

[0016] The collected flow data is expanded with the open source tool CICFlowmeter. Each flow data contains 84 columns of features and a CSV format file is generated.

[0017] The feature annotation in step 1 is as follows:

[0018] Create a label column for the generated CSV format file, and manually label each flow data in the label column according to the timestamp, that is, mark the flow type. The flow types are: normal business flow data and malicious attack flow data.

[0019] The specific preprocessing of the original quantity in step 2 is as follows:

[0020] Step 2.1, process duplicate values, outliers and missing values ​​in the original data;

[0021] Step 2.2, remove the source address IP, destination address IP, source address port, destination address port, process identification code, timestamp, and protocol type features from the original data;

[0022] Step 2.3, taking the other features of the original data after processing in step 2.2 except the label column as the input of the Pearson correlation coefficient, obtaining the Pearson correlation coefficient heat map, checking the correlation of each feature column, setting a threshold, if the correlation between two features is greater than the set threshold, then selecting one feature from the two features to retain;

[0023] Step 2.4, using SMOTTENN algorithm to sample the original data processed in step 2.3;

[0024] Step 2.5: Use the LabelEncoder method to encode the label features of the label column of the original data sampled in step 2.4, and convert the traffic type in different labels into a specific value;

[0025] Step 2.6, normalize the original data processed in step 2.5, take all normalized traffic data as data set samples, and divide the data set samples into training set and test set.

[0026] In step 2.6, 80% of the samples in the data set are used as training sets, and 20% of the samples in the data set are used as test sets.

[0027] The malicious traffic detection model robust autoencoder in step 3 includes stacked sparse denoising autoencoders and regularized extreme learning machines optimized by a particle swarm algorithm connected in sequence.

[0028] The training process of step 4 is as follows:

[0029] Step 4.1: Add random noise to the traffic data x in the training data set to generate noisy data x noise , specifically:

[0030] x noise =x+noise(1)

[0031] Among them, the random noise noise is Gaussian noise (noise~N(0,δ 2 ));

[0032] Step 4.2: add the noisy data x after adding noise in step 4.1 noise Input stacked sparse denoising autoencoder training to obtain output feature H (L) ;

[0033] Step 4.3: stack the output features H of the sparse denoising autoencoder (L)The input is into the regularized extreme learning machine optimized by the particle swarm algorithm, and the hidden layer weight and bias of the regularized extreme learning machine optimized by the particle swarm algorithm are set to a particle. The particle has two variables, namely speed and position. The fitness function is defined, and the local optimal solution and the global optimal solution of the particle are continuously adjusted by calculating the fitness function. The speed and position under the global optimal solution are respectively assigned to the hidden layer weight and bias, and the training is continuously iterated to obtain a trained classification model.

[0034] The stacked sparse denoising autoencoder is formed by stacking multiple layers of single-layer sparse denoising autoencoders. The input of the next single-layer sparse denoising autoencoder is the output of the previous single-layer sparse denoising autoencoder. The training process of the stacked sparse denoising autoencoder in step 4.2 is:

[0035] Step 4.2.1: Substitute the noisy data x noise Input the first layer of single-layer sparse denoising autoencoder for training to obtain the hidden potential representation H (1) ;

[0036] Step 4.2.2, H (1) As the input of the next single-layer sparse denoising autoencoder, the second layer of hidden potential representation H is obtained (2) , and so on to get the hidden potential representation H of the Lth layer (L) .

[0037] The specific process of step 4.2.1 is:

[0038] The first layer of single-layer sparse denoising autoencoder forward propagation encoding process, for the input data x noise Encode, assuming that the encoding layer weight and bias of the first layer of single-layer sparse denoising autoencoder are w1 (1) and b1 (1) , the activation function is f, and the hidden potential representation H is obtained (1) :

[0039] H (1) =f(w1 (1) x noise +b1 (1) )(2)

[0040] The decoding process is to transform the hidden potential representation H (1) Decode to obtain the reconstructed data x′. Assume that the decoding layer weight and bias of the first layer single-layer sparse denoising autoencoder are w2 (1) and b2 (1) , the activation function is g, then the reconstructed data x′ is:

[0041] x′=g(w2 (1) H (1) +b2 (1) )(3)

[0042] The error L between the reconstruction error calculation x and the reconstructed data x′ reconstruction :

[0043] L reconstruction =||xx′|| 2 (4)

[0044] Calculate the average activation value of the hidden layer by sampling KL divergence The difference L between the target sparsity p sparsity :

[0045]

[0046] in:

[0047]

[0048] In the formula, is the average activation value of the hidden layer unit, N represents the total number of training samples, d h Represents the number of units in the hidden layer, i.e., the number of neurons, H ij Represents the activation value of the jth hidden layer unit of the i-th sample;

[0049] The total loss function formula is as follows:

[0050] L total =L reconstruction +λL sparsity (7);

[0051] Take the total loss function as the optimization objective, minimize the total loss function, continuously iterate the training, and then back-propagate to adjust the model parameters;

[0052] Step 4.2.2: According to formula (2), H obtained by the first layer of single-layer sparse denoising autoencoder is converted into (1) As the input of the second layer single-layer sparse denoising autoencoder, the second layer hidden potential representation H is obtained (2) :

[0053] H (2) =f(w1 (2) H (1) +b1 (2) )(8)

[0054] Among them, w1 (1) and b1 (1) They are the encoding layer weights and biases of the second-layer single-layer sparse denoising autoencoder respectively;

[0055] By analogy, a total of L layers are stacked, and the hidden potential representation H of the Lth layer (L) for:

[0056]

[0057] Among them, w1 (L) and b1 (L) are the encoding layer weights and biases of the L-th layer single-layer sparse denoising autoencoder, H (L-1) The hidden potential representation is obtained for the L-1th layer single-layer sparse denoising autoencoder.

[0058] Step 4.3 is as follows:

[0059] Assume that the hidden layer weights of the regularized extreme learning machine optimized by the particle swarm algorithm are randomly initialized to w in , the bias is initialized to b in , the activation function is f, then the output of the hidden layer H relm The calculation formula is as follows:

[0060] H relm =f(w in H (L) +b in ) (10)

[0061] Among them, the output weight matrix from the hidden layer to the output layer is W out , then the objective function to be optimized is:

[0062] L relm =||H relm W out -Y|| 2 +λ||W out || 2 (11)

[0063] Among them, λ||W out || 2 is the regularization term, ||H relm W out -Y|| 2 The goal is to minimize the prediction error;

[0064] The hidden layer weights and biases of the regularized extreme learning machine optimized by the particle swarm algorithm are set as a particle. The particle has two variables, namely speed and position. The fitness function is defined. The local optimal solution and the global optimal solution of the particle are continuously adjusted by calculating the fitness function. The speed and position under the global optimal solution are respectively assigned to the hidden layer weights and biases. Through continuous iterative training, a trained classification model is obtained.

[0065] Step 6 is as follows:

[0066] The evaluated classification model is used to detect malicious traffic in the C3-level train control system network. Specifically, the malicious traffic in the C3-level train control system network is input into the trained classification model to obtain the detection result.

[0067] The beneficial effects of the present invention are:

[0068] The present invention adds a certain amount of noise to the original data, and then reconstructs the original non-noised data by stacking multiple layers of autoencoders. By continuously reducing the error between the reconstructed data and the original data, the generalization characteristics of the data are learned, thereby solving the problems of high false alarm rate and missed alarm rate in the prior art caused by weak ability to learn generalization characteristics. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 It is a flow chart of a method for detecting malicious traffic in a C3-level train control system network based on a robust autoencoder of the present invention;

[0070] Figure 2 is the category discrimination graph before generalization in Example 9 of the present invention;

[0071] Figure 3 It is the generalized category discrimination graph in Example 9 of the present invention. DETAILED DESCRIPTION

[0072] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0073] Example 1

[0074] The present invention is based on the C3 level train control system network malicious traffic detection method of the robust autoencoder, and its process is as follows Figure 1 As shown, the specific steps are as follows:

[0075] Step 1: Collect the flow data in the C3-level train control system network, then extract the features of the collected flow data and perform feature annotation, and use the annotated data as the original data;

[0076] Step 2: preprocess the original data, use the preprocessed data as data set samples, and divide the data set samples into a training set and a test set;

[0077] Step 3, construct a robust autoencoder for malicious traffic detection model;

[0078] Step 4, using the training set to train the malicious traffic detection model robust autoencoder constructed in step 4 to obtain a classification model;

[0079] Step 5, input the test set into the classification model to evaluate the performance of the classification model;

[0080] Step 6: Use the evaluated classification model to detect malicious traffic in the C3-level train control system network.

[0081] Example 2

[0082] On the basis of Example 1, the flow data collected in the C3-level train control system network in step 1 is specifically: using the Wireshark tool to capture the normal service flow data between the subsystems of the C3-level train control system and the malicious attack flow data generated by Kali Linux between virtual machines, and the flow data format is pcap file;

[0083] The features of the collected traffic data extracted in step 1 are as follows:

[0084] The collected flow data is expanded with the open source tool CICFlowmeter to generate a CSV format file, where each flow data contains 84 columns of features, including flow ID (Flow ID, string type), source IP address (Src IP, string type), destination IP address (Dst IP, string type), source port number (Src Port, integer type), destination port number (DstPort, integer type), protocol type (Protocol, integer type), timestamp (Timestamp, Object type), flow transmission rate (Flow Packet / s, floating point type), etc.

[0085] The feature annotation in step 1 is as follows:

[0086] Since the CSV file generated by CICFlowmeter does not have a label column, it is necessary to create a label column for the generated CSV format file and manually label each flow data in the label column according to the timestamp, that is, to mark the flow type. The flow types are: normal business flow data and malicious attack flow data.

[0087] Example 3

[0088] Based on Example 2, the preprocessing of the original quantity in step 2 is specifically as follows:

[0089] Step 2.1, process the original data for duplicate values, outliers and missing values, that is, replace the complex values, outliers and missing values ​​with the mean; duplicate value samples will cause the later model to be more inclined to fit the samples with a high proportion, which is prone to overfitting problems; the existence of outliers and missing values ​​will make it impossible to perform some mathematical analysis on the data, so they are replaced;

[0090] Step 2.2: Since some features may change randomly in actual scenarios, these features need to be removed. Therefore, the source IP address, destination IP address, source port address, destination port address, process identification code, timestamp, and protocol type features in the original data are removed.

[0091] Step 2.3, taking the other features of the original data after processing in step 2.2 except the label column as the input of the Pearson correlation coefficient, obtaining the Pearson correlation coefficient heat map, checking the correlation of each feature column, setting a threshold, if the correlation between two features is greater than the set threshold, then selecting one feature from the two features to retain;

[0092] Step 2.4, use the SMOTTENN algorithm to sample the original data processed in step 2.3, so that all categories of the entire data set are in an approximately balanced state;

[0093] In step 2.5, since the manually added labels are of string type, and machine learning and robust autoencoders usually sample numerical features, the label column of the original data sampled in step 2.4 is encoded using the LabelEncoder method to convert the traffic type in different labels into a specific numerical value;

[0094] In step 2.6, the numerical values ​​of each feature vary greatly, so it is necessary to normalize the original data processed in step 2.5, scale the values ​​to a specific range, speed up the model training, use all the normalized traffic data as data set samples, and divide the data set samples into training set and test set.

[0095] In step 2.6, 80% of the samples in the data set are used as training sets, and 20% of the samples in the data set are used as test sets.

[0096] Example 4

[0097] Based on Example 3, the malicious traffic detection model robust autoencoder in step 3 includes a stacked sparse denoising autoencoder (SSDAE) and a regularized extreme learning machine (RELM) optimized by a particle swarm algorithm (PSO) connected in sequence.

[0098] The training process of step 4 is as follows:

[0099] Step 4.1: Add random noise to the traffic data x in the training data set to generate noisy data x noise , specifically:

[0100] x noise =x+noise(1)

[0101] Among them, the random noise noise is Gaussian noise (noise~N(0,δ 2 ));

[0102] Step 4.2: add the noisy data x after adding noise in step 4.1 noise Input stacked sparse denoising autoencoder training to obtain output feature H (L) ;

[0103] Step 4.3: stack the output features H of the sparse denoising autoencoder (L) The input is into the regularized extreme learning machine optimized by the particle swarm algorithm, and the hidden layer weight and bias of the regularized extreme learning machine optimized by the particle swarm algorithm are set to a particle. The particle has two variables, namely speed and position. The fitness function is defined, and the local optimal solution and the global optimal solution of the particle are continuously adjusted by calculating the fitness function. The speed and position under the global optimal solution are respectively assigned to the hidden layer weight and bias, and the training is continuously iterated to obtain a trained classification model.

[0104] The stacked sparse denoising autoencoder (SSDAE) is formed by stacking multiple layers of single-layer sparse denoising autoencoders (SDAE). The input of the next single-layer sparse denoising autoencoder is the output of the previous single-layer sparse denoising autoencoder. The training process of the stacked sparse denoising autoencoder in step 4.2 is:

[0105] Step 4.2.1: Substitute the noisy data x noise Input the first layer of single-layer sparse denoising autoencoder for training to obtain the hidden potential representation H (1) ;

[0106] Step 4.2.2, H (1) As the input of the next single-layer sparse denoising autoencoder, the second layer of hidden potential representation H is obtained (2) , and so on to get the hidden potential representation H of the Lth layer (L) .

[0107] The specific process of step 4.2.1 is:

[0108] The first layer of single-layer sparse denoising autoencoder forward propagation encoding process, for the input data x noise Encode, assuming that the encoding layer weight and bias of the first layer of single-layer sparse denoising autoencoder are w1 (1) and b1 (1) , the activation function is f, and the hidden potential representation H is obtained (1) :

[0109] H (1) =f(w1 (1) x noise +b1 (1) )(2)

[0110] The decoding process is to transform the hidden potential representation H (1) Decode to obtain the reconstructed data x′. Assume that the decoding layer weight and bias of the first layer single-layer sparse denoising autoencoder are w2 (1) and b2 (1) , the activation function is g, then the reconstructed data x′ is:

[0111] x′=g(w2 (1) H (1) +b2 (1) )(3)

[0112] The error L between the reconstruction error calculation x and the reconstructed data x′ reconstruction :

[0113] L reconstruction =||xx′|| 2 (4)

[0114] Calculate the average activation value of the hidden layer by sampling KL divergence The difference L between the target sparsity p sparsity :

[0115]

[0116] in:

[0117]

[0118] In the formula, is the average activation value of the hidden layer unit, N represents the total number of training samples, d h Represents the number of units in the hidden layer, i.e., the number of neurons, H ij Represents the activation value of the jth hidden layer unit of the i-th sample;

[0119] The total loss function formula is as follows:

[0120] L total =L reconstruction +λL sparsity (7);

[0121] Take the total loss function as the optimization objective, minimize the total loss function, continuously iterate the training, and then back-propagate to adjust the model parameters;

[0122] Step 4.2.2: According to formula (2), H obtained by the first layer of single-layer sparse denoising autoencoder is converted into (1) As the input of the second layer single-layer sparse denoising autoencoder, the second layer hidden potential representation H is obtained (2) :

[0123] H(2) =f(w1 (2) H (1) +b1 (2) )(8)

[0124] Among them, w1 (1) and b1 (1) They are the encoding layer weights and biases of the second-layer single-layer sparse denoising autoencoder respectively;

[0125] By analogy, a total of L layers are stacked, and the hidden potential representation H of the Lth layer (L) for:

[0126]

[0127] Among them, w1 (L) and b1 (L) are the encoding layer weights and biases of the L-th layer single-layer sparse denoising autoencoder, H (L-1) The hidden potential representation is obtained for the L-1th layer single-layer sparse denoising autoencoder.

[0128] Step 4.3 is as follows:

[0129] Assume that the hidden layer weights of the regularized extreme learning machine optimized by the particle swarm algorithm are randomly initialized to w in , the bias is initialized to b in , the activation function is f, then the output of the hidden layer H relm The calculation formula is as follows:

[0130] H relm =f(w in H (L) +b in ) (10)

[0131] Among them, the output weight matrix from the hidden layer to the output layer is W out , then the objective function to be optimized is:

[0132] L relm =||H relm W out -Y|| 2 +λ||W out || 2 (11)

[0133] Among them, λ||W out || 2 is the regularization term, ||H relm W out -Y|| 2 The goal is to minimize the prediction error;

[0134] The hidden layer weights and biases of the regularized extreme learning machine optimized by the particle swarm algorithm are set as a particle. The particle has two variables, namely speed and position. The fitness function is defined. The local optimal solution and the global optimal solution of the particle are continuously adjusted by calculating the fitness function. The speed and position under the global optimal solution are respectively assigned to the hidden layer weights and biases. Through continuous iterative training, a trained classification model is obtained.

[0135] Step 6 is as follows:

[0136] The evaluated classification model is used to detect malicious traffic in the C3-level train control system network. Specifically, the malicious traffic in the C3-level train control system network is input into the trained classification model to obtain the detection result.

[0137] Example 5

[0138] On the basis of Example 4, the traffic data in the C3-level train control system network is specifically: the normal train control service traffic data and the malicious traffic data generated by Kali Linux are captured in the virtual machine through the Wireshark tool, and the traffic data format of the train is a pcap file; the normal service traffic data and malicious attack traffic data captured in the C3-level train control system network simulation environment (simulation platform built in the laboratory) are 6 types in total, namely normal service traffic Bengin, and malicious attack traffic: TCP flood attack, HTTP flood attack, SYN flood attack, port scan and UDP flood attack. Among them, TCP and UDP belong to the transport layer protocol, and HTTP belongs to the application layer protocol.

[0139] Manual labeling is as follows: manually label each flow according to the Timestamp of the malicious attack deployed in the captured pcap file. There are 6 types of traffic after manual labeling. Corresponding to the 6 types of captured traffic, these labeled traffic types are encoded by label encoding, and the encoding results are used to refer to specific traffic types. For example, there are 6 types of data, and the final encoding results include (0, 1, 2, 3, 4, 5). Protocol refers to the type of protocol adopted for interaction. There are three values, namely TCP, UDP, and protocols other than the first two. "TCP" is numbered 6, "UDP" is numbered 17, and the rest of the protocols are numbered 0.

[0140] Example 6

[0141] Based on Example 5, step 5 inputs the test set into the classification model, and the performance of the classification model is evaluated as follows: the test set is input into the trained classification model for classification test, and the classification model is evaluated by using accuracy, false negative rate, and F1 score.

[0142] Example 7

[0143] Based on Example 6, the CICFlowmeter tool used in the present invention is a network traffic analysis tool for monitoring and analyzing traffic data in network communications. It can extract and analyze various features in network traffic. The tool has a Java version and a Python version. The present invention uses the Java version.

[0144] The present invention optimizes the hyperparameters in SSDAE: the number of hidden layers, the number of units, the learning rate, the activation function, the optimizer for calculating the loss, etc., to minimize the loss function.

[0145] The present invention introduces sparse constraints on the denoising autoencoder and uses KL divergence as a penalty for hidden layer activation values. KL divergence, also known as relative entropy, is an indicator used to measure the similarity of two probability distributions, where ρ is a sparsity parameter, is the average activation of the ith hidden layer to all hidden layer inputs, The larger the value, the greater the The larger the distribution difference, the smaller the difference.

[0146] Example 8

[0147] On the basis of Example 6, the present invention uses 80% of the samples in the data set as a training set and 20% of the samples in the data set as a test set.

[0148] Example 9

[0149] Based on Example 8, this example selects normal business data and five types of malicious attack data (TCP Flooding, HTTP Flooding, SYN Flooding, PortScan, and UDP Flooding) captured in the network environment of the C3-level train control system simulation platform. The total number of traffic is 76,479, including 18,123 normal data, 14,549 TCP Flooding malicious attack data, 14,483 HTTP Flooding, 12,508 SYN Flooding malicious attack data, 9,150 Port Scan malicious attack data, and 7,666 UDP Flooding malicious attack data.

[0150] The method of the present invention is used to first extract features and train models on 80% of all data, and then the remaining 20% ​​of the test set is tested and evaluated by multiple models. The test results are shown in Table 1:

[0151] Table 1

[0152] Model Accuracy False negative rate F1 score SVM (Support Vector Machine) 97.08 2.92 96.28 ELM (Extreme Learning Machine) 97.02 2.98 96.20 DT (Decision Tree) 96.90 3.10 96.12 CNN (Convolutional Neural Network) 95.42 4.58 94.35 ResNet (Residual Neural Network) 97.36 2.64 96.67 The present invention 97.57 2.43 97.63

[0153] The malicious traffic classification results of five types of data are evaluated as follows. From the results in Table 1, it can be seen that the accuracy, false negative rate and F1 score of the method of the present invention are ahead of other models. Figure 2 As shown in the figure, the results of the model of this embodiment for generalized features are as follows: Figure 2-3 It can be seen that the original data ( Figure 2 ) already has a high degree of separation, and the model classification will have a high accuracy, but there is still some category overlap, and the generalized data ( Figure 3 ) is further separated based on the original data, reducing some overlap.

Claims

1. A C3-level train control system network malicious traffic detection method based on a robust autoencoder, characterized in that: The specific steps are as follows: Step 1: Collect the flow data in the C3-level train control system network, then extract the features of the collected flow data and perform feature annotation, and use the annotated data as the original data; Step 2: preprocess the original data, use the preprocessed data as data set samples, and divide the data set samples into a training set and a test set; Step 3, construct a robust autoencoder for malicious traffic detection model; Step 4, using the training set to train the malicious traffic detection model robust autoencoder constructed in step 4 to obtain a classification model; Step 5, input the test set into the classification model to evaluate the performance of the classification model; Step 6: Use the evaluated classification model to detect malicious traffic in the C3-level train control system network.

2. According to claim 1, the method for detecting malicious traffic in a C3-level train control system network based on a robust autoencoder is characterized in that: The flow data collected in the C3-level train control system network in step 1 is specifically as follows: Use the Wireshark tool to capture normal business traffic data between subsystems of the C3-level train control system and malicious attack traffic data generated by Kali Linux between virtual machines. The traffic data format is pcap file; The features of the collected traffic data extracted in step 1 are specifically: The collected flow data is expanded with the open source tool CICFlowmeter. Each flow data contains 84 columns of features and a CSV format file is generated. The feature annotation in step 1 is specifically as follows: Create a label column for the generated CSV format file, and manually label each flow data in the label column according to the timestamp, that is, mark the flow type. The flow types are: normal business flow data and malicious attack flow data.

3. According to claim 2, the method for detecting malicious traffic in a C3-level train control system network based on a robust autoencoder is characterized in that: The preprocessing of the original quantity in step 2 is specifically as follows: Step 2.1, process duplicate values, outliers and missing values ​​in the original data; Step 2.2, remove the source address IP, destination address IP, source address port, destination address port, process identification code, timestamp, and protocol type features from the original data; Step 2.3, taking the other features of the original data after processing in step 2.2 except the label column as the input of the Pearson correlation coefficient, obtaining the Pearson correlation coefficient heat map, checking the correlation of each feature column, setting a threshold, if the correlation between two features is greater than the set threshold, then selecting one feature from the two features to retain; Step 2.4, using SMOTTENN algorithm to sample the original data processed in step 2.3; Step 2.5: Use the LabelEncoder method to encode the label features of the label column of the original data sampled in step 2.4, and convert the traffic type in different labels into a specific value; Step 2.6, normalize the original data processed in step 2.5, take all normalized traffic data as data set samples, and divide the data set samples into training set and test set.

4. According to claim 3, the method for detecting malicious traffic in a C3-level train control system network based on a robust autoencoder is characterized in that: In step 2.6, 80% of the samples in the data set are used as training sets, and 20% of the samples in the data set are used as test sets.

5. According to claim 4, the method for detecting malicious traffic in a C3-level train control system network based on a robust autoencoder is characterized in that: The malicious traffic detection model robust autoencoder in step 3 includes stacked sparse denoising autoencoders and regularized extreme learning machines optimized by a particle swarm algorithm connected in sequence.

6. The method for detecting malicious traffic in a C3-level train control system network based on a robust autoencoder according to claim 5 is characterized in that: The training process of step 4 is as follows: Step 4.1: Add random noise to the traffic data x in the training data set to generate noisy data x noise , specifically: x noise =x+noise(1) Among them, the random noise noise is Gaussian noise (noise~N(0,δ 2 )); Step 4.2: add the noise to the noisy data x after step 4.1 noise Input stacked sparse denoising autoencoder training to obtain output feature H (L) ; Step 4.3: stack the output features H of the sparse denoising autoencoder (L) The input is into the regularized extreme learning machine optimized by the particle swarm algorithm, and the hidden layer weight and bias of the regularized extreme learning machine optimized by the particle swarm algorithm are set to a particle. The particle has two variables, namely speed and position. The fitness function is defined, and the local optimal solution and the global optimal solution of the particle are continuously adjusted by calculating the fitness function. The speed and position under the global optimal solution are respectively assigned to the hidden layer weight and bias, and the training is continuously iterated to obtain a trained classification model.

7. The method for detecting malicious traffic in a C3-level train control system network based on a robust autoencoder according to claim 6 is characterized in that: The stacked sparse denoising autoencoder is formed by stacking multiple layers of single-layer sparse denoising autoencoders, and the input of the next layer of single-layer sparse denoising autoencoder is the output of the previous layer of single-layer sparse denoising autoencoder. The training process of the stacked sparse denoising autoencoder in step 4.2 is: Step 4.2.1: Substitute the noisy data x noise Input the first layer of single-layer sparse denoising autoencoder for training to obtain the hidden potential representation H (1) ; Step 4.2.2, H (1) As the input of the next single-layer sparse denoising autoencoder, the second layer of hidden potential representation H is obtained (2) , and so on to get the hidden potential representation H of the Lth layer (L) .

8. The method for detecting malicious traffic in a C3-level train control system network based on a robust autoencoder according to claim 6 is characterized in that: The specific process of step 4.2.1 is as follows: The first layer of single-layer sparse denoising autoencoder forward propagation encoding process, for the input data x noise Encode, assuming that the encoding layer weight and bias of the first layer of single-layer sparse denoising autoencoder are w1 (1) and b1 (1) , the activation function is f, and the hidden potential representation H is obtained (1) : H (1) =f(w1 (1) x noise +b1 (1) )(2) The decoding process is to transform the hidden potential representation H (1) Decode to obtain the reconstructed data x′. Assume that the decoding layer weight and bias of the first layer single-layer sparse denoising autoencoder are w2 (1) and b2 (1) , the activation function is g, then the reconstructed data x′ is: x′=g(w2 (1) H (1) +b2 (1) )(3) The error L between the reconstruction error calculation x and the reconstructed data x′ reconstruction : L reconstruction =||x-x′|| 2 (4) Calculate the average activation value of the hidden layer by sampling KL divergence The difference L between the target sparsity p sparsity : in: In the formula, is the average activation value of the hidden layer unit, N represents the total number of training samples, d h Represents the number of units in the hidden layer, i.e., the number of neurons, H ij Represents the activation value of the jth hidden layer unit of the i-th sample; The total loss function formula is as follows: THE total =L reconstruction +λL sparsity (7); Take the total loss function as the optimization objective, minimize the total loss function, continuously iterate the training, and then back-propagate to adjust the model parameters; Step 4.2.2: According to formula (2), H obtained by the first layer of single-layer sparse denoising autoencoder is converted into (1) As the input of the second layer single-layer sparse denoising autoencoder, the second layer hidden potential representation H is obtained (2) : H (2) =f(w1 (2) H (1) +b1 (2) )(8) Among them, w1 (1) and b1 (1) They are the encoding layer weights and biases of the second-layer single-layer sparse denoising autoencoder respectively; By analogy, a total of L layers are stacked, and the hidden potential representation H of the Lth layer (L) for: Among them, w1 (L) and b1 (L) are the encoding layer weights and biases of the L-th layer single-layer sparse denoising autoencoder, H (L-1) The hidden potential representation is obtained for the L-1th layer single-layer sparse denoising autoencoder.

9. The method for detecting malicious traffic in a C3-level train control system network based on a robust autoencoder according to claim 8, characterized in that: The step 4.3 is specifically as follows: Assume that the hidden layer weights of the regularized extreme learning machine optimized by the particle swarm algorithm are randomly initialized to w in , the bias is initialized to b in , the activation function is f, then the output of the hidden layer H relm The calculation formula is as follows: H relm =f(w in H (L) +b in ) (10) Among them, the output weight matrix from the hidden layer to the output layer is W out , then the objective function to be optimized is: L relm =||H relm W out -Y|| 2 +λ||W out || 2 (11) Among them, λ||W out || 2 is the regularization term, ||H relm W out -Y|| 2 The goal is to minimize the forecast error; The hidden layer weights and biases of the regularized extreme learning machine optimized by the particle swarm algorithm are set as a particle. The particle has two variables, namely speed and position. The fitness function is defined. The local optimal solution and the global optimal solution of the particle are continuously adjusted by calculating the fitness function. The speed and position under the global optimal solution are respectively assigned to the hidden layer weights and biases. Through continuous iterative training, a trained classification model is obtained.

10. The method for detecting malicious traffic in a C3-level train control system network based on a robust autoencoder according to claim 9, characterized in that: The step 6 is specifically as follows: The evaluated classification model is used to detect malicious traffic in the C3-level train control system network. Specifically, the malicious traffic in the C3-level train control system network is input into the trained classification model to obtain the detection result.

Images