Train Ethernet network security anomaly detection method and device

Abstract

The embodiment of the invention discloses a train Ethernet network security anomaly detection method and a train Ethernet network security anomaly detection device. The train Ethernet network security anomaly detection method comprises the following steps: acquiring UDP (User Datagram Protocol) data flow of each switch interface of a train network; the method comprises the following steps: receiving a UDP (User Datagram Protocol) data stream sent by a train network, and analyzing Coded sending information from the UDP data stream, the Coded sending information comprising the sending type and the sending frequency of each port Coded in the train network; and carrying out train network security anomaly detection according to the Comid sending information to obtain an anomaly detection result. According to the method, the abnormal condition of the switch interface data in the train network can be accurately monitored, and safe and stable operation of the train network can be guaranteed.

Description

Technical Field

[0001] The present invention relates to the technical field of train network security monitoring, and in particular to a method and device for detecting anomaly in train Ethernet network security. Background Art

[0002] The EMU onboard control network is an industrial control network. In recent years, network security incidents in the field of industrial control networks have occurred frequently, and it has become a hot topic in the field of network security. As a complex technical equipment, the EMU has the characteristics of high asset value, long service life, and wide application range. It requires frequent maintenance and upgrades throughout its life cycle, and has a high security risk. At present, the research on the security technology of EMU onboard control network is mainly concentrated in the fields of TRDP security protocol. At present, there is a lack of an effective method to accurately monitor the abnormal situation of switch interface data in the train network to ensure the safe and stable operation of the train network. Summary of the invention

[0003] In order to solve at least one technical problem in the above-mentioned background technology, the present invention proposes a method and device for detecting security anomalies in a train Ethernet network.

[0004] In order to achieve the above object, according to one aspect of the present invention, a train Ethernet network security anomaly detection method is provided, the method comprising:

[0005] Obtain the UDP data stream of each switch interface of the train network;

[0006] Parsing the Comid sending information from the UDP data stream, wherein the Comid sending information includes: the sending type and sending frequency of the Comid of each port in the train network;

[0007] According to the information sent by Comid, train network security anomaly detection is performed to obtain an anomaly detection result.

[0008] Optionally, the train Ethernet network security anomaly detection method further includes:

[0009] Continuously monitor the data streams of the switch interfaces, and when a TCP data stream is found, obtain the current speed information of the train;

[0010] If the speed information is not 0, it is determined that the abnormality detection result is that a network security abnormality exists.

[0011] Optionally, the train Ethernet network security anomaly detection method further includes:

[0012] Continuously monitor the data streams of each of the switch interfaces, and when a TCP data stream is found, obtain the current speed information and position information of the train;

[0013] If the speed information is not 0, and / or the position information is not a preset position, it is determined that the abnormality detection result is that a network security abnormality exists.

[0014] Optionally, performing train network security anomaly detection according to the Comid sending information to obtain an anomaly detection result specifically includes:

[0015] The Comid sending information is compared with a preset Comid normal sending standard to obtain the abnormal detection result, wherein the Comid normal sending standard includes: the normal sending type and normal sending frequency of the Comid of each port in the train network.

[0016] Optionally, performing train network security anomaly detection according to the Comid sending information to obtain an anomaly detection result specifically includes:

[0017] Model input data is generated according to the Comid sending information, and then the model input data is input into a preset network security anomaly detection model to obtain the anomaly detection result output by the network security anomaly detection model, wherein the network security anomaly detection model is trained based on training samples and a preset machine learning model, and the training samples are Comid sending information for model training that is marked with anomaly detection results.

[0018] Optionally, the train Ethernet network security anomaly detection method further includes:

[0019] If the UDP data stream has a traffic anomaly, the anomaly detection result is determined to be a network security anomaly.

[0020] Optionally, the train Ethernet network security anomaly detection method further includes:

[0021] If the abnormality detection result is that there is a network security abnormality, an alarm message is generated and sent to the train display screen to remind train staff to handle the network security abnormality.

[0022] In order to achieve the above object, according to another aspect of the present invention, a train Ethernet network security anomaly detection device is provided, the device comprising:

[0023] A UDP data stream acquisition unit, used to acquire UDP data streams of each switch interface of the train network;

[0024] A Comid sending information determining unit, used for parsing Comid sending information from the UDP data stream, wherein the Comid sending information includes: the sending type and sending frequency of the Comid of each port in the train network;

[0025] The first abnormality detection result determining unit is used to perform train network security abnormality detection according to the information sent by the Comid to obtain an abnormality detection result.

[0026] Optionally, the train Ethernet network security anomaly detection device further includes:

[0027] A TCP data flow monitoring unit, used to continuously monitor the data flow of each of the switch interfaces, and when a TCP data flow is found, obtain the current speed information of the train;

[0028] The second abnormality detection result determining unit is configured to determine, if the speed information is not 0, that the abnormality detection result is that a network security abnormality exists.

[0029] In order to achieve the above-mentioned purpose, according to another aspect of the present invention, a computer device is also provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned train Ethernet network security anomaly detection method when executing the computer program.

[0030] In order to achieve the above-mentioned purpose, according to another aspect of the present invention, a computer-readable storage medium is further provided, on which a computer program / instruction is stored, and when the computer program / instruction is executed by a processor, the steps of the above-mentioned train Ethernet network security anomaly detection method are implemented.

[0031] In order to achieve the above-mentioned purpose, according to another aspect of the present invention, a computer program product is also provided, including a computer program / instruction, which, when executed by a processor, implements the steps of the above-mentioned train Ethernet network security anomaly detection method.

[0032] The beneficial effects of the present invention are:

[0033] The embodiment of the present invention obtains the UDP data stream of each switch interface of the train network, and then parses the Comid sending information from the UDP data stream, and then performs train network security anomaly detection based on the Comid sending information to obtain anomaly detection results, thereby achieving the beneficial effect of accurately monitoring the abnormal conditions of the switch interface data in the train network, which helps to ensure the safe and stable operation of the train network. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0035] Figure 1 This is a first flow chart of the train Ethernet network security anomaly detection method according to an embodiment of the present invention;

[0036] Figure 2 is a second flow chart of the train Ethernet network security anomaly detection method according to an embodiment of the present invention;

[0037] Figure 3 is a third flow chart of the train Ethernet network security anomaly detection method according to an embodiment of the present invention;

[0038] Figure 4 This is a first structural block diagram of a train Ethernet network security anomaly detection device according to an embodiment of the present invention;

[0039] Figure 5 This is a second structural block diagram of the train Ethernet network security anomaly detection device according to an embodiment of the present invention;

[0040] Figure 6 It is a schematic diagram of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0041] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0042] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0043] It should be noted that the terms "including" and "having" and any variations thereof in the specification and claims of the present invention and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or apparatus.

[0044] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0045] The switch interface in the train network transmits a large amount of data, among which UDP data and TCP data contain key information. However, there is currently a lack of an effective method that can accurately monitor the abnormal conditions of the switch interface data in the train network in real time to ensure the safe and stable operation of the train network. Traditional network security monitoring methods may not be able to adapt to the specific network environment and operation requirements of the train. For example, the train network environment is relatively single, there are specific requirements for the type and frequency of Comid sending of specific ports, and TCP data streams only appear in specific maintenance stages. Based on this, the present invention provides a method that can monitor the switch interface data in the train network in real time, accurately parse the key information in the TCP and UDP data streams, and combine the actual application scenarios of the train to achieve accurate detection of train network security anomalies, and send alarm information to the train display screen in time to ensure the safe and stable operation of the train network.

[0046] Figure 1 is a first flow chart of the train Ethernet network security anomaly detection method according to an embodiment of the present invention, such as Figure 1 As shown, in one embodiment of the present invention, the train Ethernet network security anomaly detection method of the present invention includes steps S101 to S103.

[0047] Step S101, obtaining the UDP data stream of each switch interface of the train network.

[0048] In one embodiment of the present invention, the present invention deploys an audit module in the train network, and obtains data flow information of each switch interface of the train network in real time through the audit module. The present invention writes a special data extraction program to filter out the UDP data flow of each switch interface from the audit information of the audit module.

[0049] Step S102, parsing the Comid sending information from the UDP data stream, wherein the Comid sending information includes: the sending type and sending frequency of the Comid of each port in the train network.

[0050] In one embodiment of the present invention, the present invention utilizes a data parsing algorithm to parse UDP data and accurately extract the Comid sending information therein.

[0051] Step S103, performing train network security anomaly detection according to the information sent by the Comid to obtain anomaly detection results.

[0052] In one embodiment of the present invention, the present invention can determine the abnormal detection result by analyzing whether there is an abnormal change in the information sent by the Comid. When the analysis shows that there is an abnormal change, the abnormal detection result is determined to be that there is a network security abnormality; otherwise, the abnormal detection result is determined to be that there is no network security abnormality.

[0053] like Figure 2 As shown, in one embodiment of the present invention, the train Ethernet network security anomaly detection method of the present invention further includes step S201 and step S202.

[0054] Step S201, continuously monitor the data streams of the switch interfaces, and when a TCP data stream is found, obtain the current speed information of the train.

[0055] Step S202: If the speed information is not 0, it is determined that the abnormality detection result is that there is a network security abnormality.

[0056] In the present invention, when TCP data flow is detected on each switch interface, it is necessary to analyze it in combination with the current speed of the train. Because TCP data flow can only appear during the train maintenance phase under normal circumstances, it must be determined to be a normal maintenance behavior when the train speed is 0. If TCP data flow is detected when the train speed is not 0, it is determined that there is a network security anomaly.

[0057] like Figure 3 As shown, in another embodiment of the present invention, the train Ethernet network security anomaly detection method of the present invention further includes step S301 and step S302.

[0058] Step S301, continuously monitor the data streams of the switch interfaces, and when a TCP data stream is found, obtain the current speed information and position information of the train.

[0059] Step S302: If the speed information is not 0, and / or the position information is not a preset position, it is determined that the abnormality detection result is that there is a network security abnormality.

[0060] In the present invention, the present invention continuously monitors the data flow of the switch interface, and when a TCP data flow is found, the current speed and position information of the train is obtained. The train speed and position information are analyzed and judged, and if the train speed is not 0, or the train position information is not a preset position (such as a preset normal maintenance position), it is determined that there is a network security anomaly.

[0061] In another embodiment of the present invention, the train Ethernet network security anomaly detection method of the present invention further includes:

[0062] If the number of occurrences of the TCP data stream for a specific IP within a preset time interval is greater than a preset number, then the anomaly detection result is determined to be the presence of a network security anomaly.

[0063] In one embodiment of the present invention, the time interval may specifically be one day, and the preset number of times may be 1 time.

[0064] In one embodiment of the present invention, if there are no multiple TCP data flows for a specific IP on the same day, it is considered as normal maintenance behavior; otherwise, it is determined that there is a network security anomaly and an alarm is triggered.

[0065] In one embodiment of the present invention, the above step S103 performs train network security anomaly detection according to the Comid sending information to obtain anomaly detection results, specifically including:

[0066] The Comid sending information is compared with a preset Comid normal sending standard to obtain the abnormal detection result, wherein the Comid normal sending standard includes: the normal sending type and normal sending frequency of the Comid of each port in the train network.

[0067] In the present invention, the present invention compares the Comid sending information with the preset Comid normal sending standard in real time. When it is detected that the Comid sending type or frequency has an abnormal change, that is, it is inconsistent with the Comid normal sending standard, the abnormal detection result is determined to be that there is a network security abnormality. Otherwise, the abnormal detection result is determined to be that there is no network security abnormality.

[0068] In the present invention, since the train network environment is single, for a specific port, the type and frequency of Comid transmission should be consistent. Therefore, the present invention pre-establishes the normal Comid transmission standard. By real-time monitoring of Comid transmission, when abnormal Comid and traffic inconsistent with the normal Comid transmission standard appear, it can be determined that network security abnormality occurs.

[0069] For example, the braking system sends a TRDP data packet with Comid 206 to the CCU (Control and Monitoring Unit) at a specific port of the switch at an interval of 200ms. If the interval becomes 100ms or a different Comid appears, it can be considered abnormal.

[0070] In another embodiment of the present invention, the above step S103 performs train network security anomaly detection according to the Comid sending information to obtain an anomaly detection result, specifically including:

[0071] Model input data is generated according to the Comid sending information, and then the model input data is input into a preset network security anomaly detection model to obtain the anomaly detection result output by the network security anomaly detection model, wherein the network security anomaly detection model is trained based on training samples and a preset machine learning model, and the training samples are Comid sending information for model training that is marked with anomaly detection results.

[0072] In one embodiment of the present invention, the machine learning model may adopt classification models such as decision trees, random forests, support vector machines, etc., or may adopt a neural network model.

[0073] In one embodiment of the present invention, the present invention can perform standardization processing on the information sent by the Comid, and then convert it into a vector form to obtain model input data.

[0074] The present invention adopts artificial intelligence technology to perform anomaly diagnosis through a trained network security anomaly detection model, thereby achieving the beneficial effect of accurate and efficient network security anomaly diagnosis, and helping to improve the accuracy and efficiency of train network security anomaly diagnosis.

[0075] In another embodiment of the present invention, the train Ethernet network security anomaly detection method of the present invention further includes:

[0076] If the UDP data stream has a traffic anomaly, the anomaly detection result is determined to be a network security anomaly.

[0077] In the present invention, when an abnormal UDP data flow is detected, the abnormal detection result is also determined to be a network security abnormality, triggering an alarm mechanism.

[0078] In another embodiment of the present invention, the train Ethernet network security anomaly detection method of the present invention further includes:

[0079] If the abnormality detection result is that there is a network security abnormality, an alarm message is generated and sent to the train display screen to remind train staff to handle the network security abnormality.

[0080] In the present invention, once an abnormality is detected, an alarm message is immediately sent to the train display screen. The alarm message is sent to the train display screen through a specific communication protocol to remind train staff to deal with network security abnormalities in a timely manner and report to the ground through the train-to-ground data transmission system.

[0081] It can be seen from the above embodiments that the train Ethernet network security anomaly detection method of the present invention achieves at least the following beneficial effects:

[0082] 1. The present invention can perform accurate safety monitoring based on the characteristics of the train network, effectively improving the accuracy and timeliness of train network security anomaly detection.

[0083] 2. The present invention can timely discover potential network security threats by monitoring Comid in UDP data and reasonably analyzing TCP data streams, and send alarm information to train staff in a timely manner to ensure the safe operation of the train.

[0084] 3. The solution of the present invention can adapt to the specific network environment and operation requirements of the train, avoid the occurrence of false alarms and missed alarms, and improve the reliability of train network security monitoring.

[0085] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0086] Based on the same inventive concept, an embodiment of the present invention also provides a train Ethernet network security anomaly detection device, which can be used to implement the train Ethernet network security anomaly detection method described in the above embodiment, as described in the following embodiment. Since the principle of solving the problem by the train Ethernet network security anomaly detection device is similar to that of the train Ethernet network security anomaly detection method, the embodiment of the train Ethernet network security anomaly detection device can refer to the embodiment of the train Ethernet network security anomaly detection method, and the repeated parts will not be repeated. As used below, the term "unit" or "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0087] Figure 4 is a first structural block diagram of a train Ethernet network security anomaly detection device according to an embodiment of the present invention. Figure 4 As shown, in one embodiment of the present invention, the train Ethernet network security anomaly detection device of the present invention includes:

[0088] UDP data stream acquisition unit 1, used to acquire UDP data streams of each switch interface of the train network;

[0089] Comid sending information determining unit 2, used for parsing Comid sending information from the UDP data stream, wherein the Comid sending information includes: the sending type and sending frequency of the Comid of each port in the train network;

[0090] The first abnormality detection result determination unit 3 is used to perform train network security abnormality detection according to the information sent by the Comid to obtain an abnormality detection result.

[0091] Figure 5 is a second structural block diagram of the train Ethernet network security anomaly detection device according to an embodiment of the present invention, such as Figure 5 As shown, in one embodiment of the present invention, the train Ethernet network security anomaly detection device of the present invention further includes:

[0092] A TCP data flow monitoring unit 4 is used to continuously monitor the data flow of each switch interface, and when a TCP data flow is found, obtain the current speed information of the train;

[0093] The second abnormality detection result determining unit 5 is configured to determine that the abnormality detection result is that a network security abnormality exists if the speed information is not 0.

[0094] In one embodiment of the present invention, the train Ethernet network security anomaly detection device of the present invention further includes:

[0095] A data monitoring and acquisition unit, used to continuously monitor the data streams of each of the switch interfaces, and when a TCP data stream is found, obtain the current speed information and position information of the train;

[0096] The third abnormal detection result determining unit is configured to determine that the abnormal detection result is a network security abnormality if the speed information is not 0 and / or the position information is not a preset position.

[0097] In one embodiment of the present invention, the first abnormality detection result determination unit 3 specifically includes:

[0098] The comparison and confirmation module is used to compare the Comid sending information with the preset Comid normal sending standard to obtain the abnormal detection result, wherein the Comid normal sending standard includes: the normal sending type and normal sending frequency of the Comid of each port in the train network.

[0099] In another embodiment of the present invention, the first abnormality detection result determination unit 3 specifically includes:

[0100] A model prediction module is used to generate model input data according to the Comid sending information, and then input the model input data into a preset network security anomaly detection model to obtain the anomaly detection result output by the network security anomaly detection model, wherein the network security anomaly detection model is trained based on training samples and a preset machine learning model, and the training samples are Comid sending information for model training with annotated anomaly detection results.

[0101] In one embodiment of the present invention, the train Ethernet network security anomaly detection device of the present invention further includes:

[0102] The fourth abnormality detection result determining unit is used to determine that the abnormality detection result is that a network security abnormality exists if a flow abnormality occurs in the UDP data stream.

[0103] In one embodiment of the present invention, the train Ethernet network security anomaly detection device of the present invention further includes:

[0104] The alarm information generating and sending unit is used to generate an alarm message and send the alarm message to the train display screen if the abnormality detection result is that there is a network security abnormality, so as to remind the train staff to deal with the network security abnormality.

[0105] In order to achieve the above object, according to another aspect of the present application, a computer device is also provided. Figure 6 As shown, the computer device includes a memory, a processor, a communication interface and a communication bus. A computer program that can be executed on the processor is stored in the memory. When the processor executes the computer program, the steps in the above-mentioned embodiment method are implemented.

[0106] The processor may be a central processing unit (CPU). The processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0107] The memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer executable programs and units, such as the corresponding program units in the above method embodiments of the present invention. The processor executes various functional applications of the processor and works data processing by running the non-transitory software programs, instructions and modules stored in the memory, that is, implementing the method in the above method embodiments.

[0108] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created by the processor, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0109] The one or more units are stored in the memory, and when executed by the processor, the method in the above embodiment is performed.

[0110] The specific details of the above-mentioned computer device can be understood by referring to the corresponding related descriptions and effects in the above-mentioned embodiments, and will not be repeated here.

[0111] In order to achieve the above purpose, according to another aspect of the present application, a computer-readable storage medium is also provided, wherein the computer-readable storage medium stores a computer program, and the computer program implements the steps in the above train Ethernet network security anomaly detection method when executed in a computer processor. Those skilled in the art can understand that the implementation of all or part of the process in the above embodiment method can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and the program can include the process of the embodiment of each method as described above when executed. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (Flash Memory), a hard disk (Hard Disk Drive, abbreviated: HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above types of memories.

[0112] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a computer program product is also provided, including a computer program / instruction, which implements the steps of the above-mentioned train Ethernet network security anomaly detection method when executed by a processor.

[0113] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0114] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A train Ethernet network security anomaly detection method, characterized in that: include: Obtain the UDP data stream of each switch interface of the train network; Parsing the Comid sending information from the UDP data stream, wherein the Comid sending information includes: the sending type and sending frequency of the Comid of each port in the train network; According to the information sent by Comid, train network security anomaly detection is performed to obtain an anomaly detection result.

2. The train Ethernet network security anomaly detection method according to claim 1 is characterized in that: Also includes: Continuously monitor the data streams of the switch interfaces, and when a TCP data stream is found, obtain the current speed information of the train; If the speed information is not 0, it is determined that the abnormality detection result is that a network security abnormality exists.

3. The train Ethernet network security anomaly detection method according to claim 1 is characterized in that: Also includes: Continuously monitor the data streams of each of the switch interfaces, and when a TCP data stream is found, obtain the current speed information and position information of the train; If the speed information is not 0, and / or the position information is not a preset position, it is determined that the abnormality detection result is that a network security abnormality exists.

4. The train Ethernet network security anomaly detection method according to claim 1 is characterized in that: The train network security anomaly detection is performed according to the information sent by the Comid to obtain the anomaly detection result, specifically including: The Comid sending information is compared with a preset Comid normal sending standard to obtain the abnormal detection result, wherein the Comid normal sending standard includes: the normal sending type and normal sending frequency of the Comid of each port in the train network.

5. The train Ethernet network security anomaly detection method according to claim 1 is characterized in that: The train network security anomaly detection is performed according to the information sent by the Comid to obtain the anomaly detection result, specifically including: Model input data is generated according to the Comid sending information, and then the model input data is input into a preset network security anomaly detection model to obtain the anomaly detection result output by the network security anomaly detection model, wherein the network security anomaly detection model is trained based on training samples and a preset machine learning model, and the training samples are Comid sending information for model training that is marked with anomaly detection results.

6. The train Ethernet network security anomaly detection method according to claim 1 is characterized in that: Also includes: If the UDP data stream has a traffic anomaly, the anomaly detection result is determined to be a network security anomaly.

7. The train Ethernet network security anomaly detection method according to any one of claims 1 to 6, characterized in that: Also includes: If the abnormality detection result is that there is a network security abnormality, an alarm message is generated and sent to the train display screen to remind train staff to handle the network security abnormality.

8. A train Ethernet network security anomaly detection device, characterized in that: include: A UDP data stream acquisition unit, used to acquire UDP data streams of each switch interface of the train network; A Comid sending information determining unit, used for parsing Comid sending information from the UDP data stream, wherein the Comid sending information includes: the sending type and sending frequency of the Comid of each port in the train network; The first abnormality detection result determining unit is used to perform train network security abnormality detection according to the information sent by the Comid to obtain an abnormality detection result.

9. The train Ethernet network security anomaly detection device according to claim 8, characterized in that: Also includes: A TCP data flow monitoring unit, used to continuously monitor the data flow of each of the switch interfaces, and when a TCP data flow is found, obtain the current speed information of the train; The second abnormality detection result determining unit is configured to determine, if the speed information is not 0, that the abnormality detection result is that a network security abnormality exists.

10. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

12. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images