A cloud-edge collaboration-based high-speed rail system network risk dynamic intelligent positioning method

Abstract

The application discloses a kind of based on cloud edge coordination's high-speed rail system network risk dynamic intelligent positioning method, belongs to intelligent transportation technical field, including S1, graph embedding method reconstructs node feature, generates node embedding vector for subsequent analysis;S2, calculate residual network cumulative connectivity, identify key risk nodes;S3, calculate risk node weight, determine node importance to improve positioning efficiency;S4, construct reinforcement learning model, make it adapt to network changes and develop optimal scheme;S5, based on edge centrality positioning key edge, provide basis for monitoring and prevention and control;S6, confirm key chain, realize adaptive safety prevention and control through real-time decision.The application adopts the above-mentioned based on cloud edge coordination's high-speed rail system network risk dynamic intelligent positioning method, dynamically intelligently positions high-speed rail network risk, accurately identifies risk key nodes, edges and propagation chain, realizes effective prevention and control, improves system security and operation intelligent level.

Description

Technical Field

[0001] This invention relates to the field of intelligent transportation technology, and in particular to a method for dynamic intelligent location of network risks in high-speed rail systems based on cloud-edge collaboration. Background Technology

[0002] Current technologies for dynamic location of various network risks in high-speed rail information infrastructure have many shortcomings. At the physical layer, manual inspections and handheld devices are relied upon, with periodic checks for issues such as track deformation. Risk assessment is based on experience, data recording is outdated, dynamic analysis is lacking, and the response cycle is long. Video surveillance relies on manual patrols, resulting in high false alarm rates and slow response times. At the network layer, static rules are prevalent, and intrusion prevention systems can only match known attacks, failing to address variant attacks and zero-day vulnerabilities, with rule updates lagging. DDoS protection is easily bypassed and lacks in-depth analysis capabilities. Log auditing requires manual screening and cannot automatically discover cross-device risk correlations.

[0003] These traditional technical means are no longer sufficient to meet the needs of the digital transformation of the high-speed rail system. This invention provides a dynamic intelligent positioning method for network risks in the high-speed rail system based on cloud-edge collaboration. It opens up the entire data link, uses digital twin technology to achieve a qualitative change in risk prediction capabilities, promotes the transformation of the high-speed rail network security system from passive defense to active immunity, provides a security foundation for the construction of intelligent high-speed rail, and at the same time builds a dynamic risk positioning system covering the entire "cloud-edge-device" domain, realizing a fundamental shift in risk prevention and control of high-speed rail information infrastructure from passive response to active prediction. Summary of the Invention

[0004] The purpose of this invention is to provide a dynamic intelligent location method for network risks in high-speed rail systems based on cloud-edge collaboration. It proposes a method based on graph embedding and reinforcement learning to determine key points, key edges, and key chains of risk, thereby enabling efficient risk prevention and control.

[0005] To achieve the above objectives, this invention provides a method for dynamic intelligent location of network risks in high-speed rail systems based on cloud-edge collaboration, comprising the following steps:

[0006] S1. Reconstruct node features using graph embedding to generate node embedding vectors for subsequent node classification;

[0007] S2. Calculate the cumulative connectivity of the residual network and identify key risk nodes;

[0008] S3. Calculate the weight of risk nodes and determine the importance of nodes to improve positioning efficiency;

[0009] S4. Construct a reinforcement learning model to adapt to network changes and formulate the optimal solution;

[0010] S5. Based on edge centrality, key edges are located to provide a basis for monitoring and prevention.

[0011] S6. Identify the critical chain and achieve adaptive security control through real-time decision-making by reinforcement learning models.

[0012] Preferably, step S1 specifically includes:

[0013] S11, Construct a high-speed rail information infrastructure network map;

[0014] S12. Use Node2Vec as the graph embedding method and set the hyperparameters;

[0015] S13. Generate a node sequence through biased random walk, train the Node2Vec model, and obtain the embedding vector of each node;

[0016] S14. Evaluate the importance of node embedding vectors, classify nodes using logistic regression, and identify key risk nodes.

[0017] Preferably, in step S13, the mapping function is defined based on the lookup table method, and the formula is:

[0018]

[0019] Where e i For a graph node, u i For the embedding domain vector, W is a learnable parameter; the center node and the context node have different mapping functions:

[0020]

[0021] Among them, v i W represents a node in the graph domain. cen The mapping parameters for the central node; W con For the mapping parameters of the context node;

[0022] From this, we can obtain the reconstructed information:

[0023]

[0024] Where V represents the set of all nodes in the graph domain; v con For context nodes; v cen f is the central node; con (v con ) T The feature representation of the context nodes obtained through the mapping function; f cen (v cen ) is the feature representation obtained by the mapping function for the central node.

[0025] Preferably, in step S2, the cumulative connectivity feature is used to analyze the key risk nodes of the high-speed rail information infrastructure network. The cumulative connectivity of the key risk nodes is represented as follows:

[0026]

[0027] Where AC(N,E) represents the cumulative connectivity of network nodes and edges; k represents the total number of network nodes; n i ∈N represents the i-th risk node to be attacked; This indicates that when n is removed i The cumulative connectivity of the network after each node; Indicates initial connectivity.

[0028] Preferably, in step S3, different risk nodes are associated with different weights, as shown below:

[0029]

[0030] Where, c(n) i ) represents node n i The costs of its own prevention and control.

[0031] Preferably, in step S4, the environment is the high-speed rail information infrastructure network, and the state of the remaining network nodes after removing the key nodes is taken as state s. t The action is to remove or replace critical subsystem nodes. t The algorithm uses the residual key edges after an action as a reward, and learns the optimal mapping between node states and actions by continuously updating parameters. Then, based on the action value function, state value function, optimal action value function, and optimal state value function, it can select the optimal key points under different network states.

[0032] Preferably, in step S4, the reward function is calculated as follows:

[0033] R t =AC t =pAC 1 (s t ,a t ,s t+1 ), AC 2 (s t ,a t ,s t+1 ),...,AC M (s t ,a t ,s t+1 (6)

[0034] Among them, AC M (s t ,a t ,st+1 () indicates that the target of the Mth identification critical chain takes action a at time t and state s, and then transitions to state s. t+1 The instant reward obtained at that time;

[0035] The action value function Q can be expressed as:

[0036]

[0037] This indicates that under policy π, from state s t Begin, take action t The expected cumulative discounted reward, where γ is a discount factor used to calculate the future reward value of the system;

[0038] State value function V π It can be represented as:

[0039]

[0040] This indicates that under policy π, from state s t Initially, the expected long-term cumulative discounted reward is considered; therefore, the optimal action value function is expressed as:

[0041] Q * (s,a)=max π Q π (s,a) (9)

[0042] The optimal state value function is expressed as:

[0043] V * (s)=max π V π (s) (10)

[0044] The optimal selection of key points for high-speed rail information infrastructure satisfies:

[0045]

[0046] Where, π * (a|s) represents the optimal strategy for choosing action a in state s, where argmax is the maximum value. a' Q * (s,a') represents the optimal action value function Q in state s. * (s,a') represents the largest action, a'.

[0047] Preferably, in step S5, after identifying key risk points in the network, key edges are further identified, and edge centrality is used to calculate the shortest path between all pairs of nodes in the graph. The calculation formula is as follows:

[0048]

[0049] Where N represents the set of key nodes, θ(s,t) represents the number of shortest paths, and θ(s,t|e) represents the number of paths passing through edge e.

[0050] Preferably, in step S6, the specific process of finding the key chain based on reinforcement learning is as follows: receiving the state s of the high-speed rail information infrastructure network. t Based on this state s t Take action a t The environment has entered a new state. t+1 At this point, the environment will provide some rewards. The goal is to maximize the expected sum of all rewards. Based on the calculated Q value, an ε-greedy action strategy is adopted, which selects the node with the highest Q with a probability of (1-ε). Otherwise, random action is taken. The parameters are updated through multiple simulation training to identify the nodes and dependencies that cause the system to fail in a chain reaction, forming a risk critical chain. The risk prevention and control strategy is specified on the critical chain. When an attack node is discovered, the critical edge is blocked in time according to the critical chain to achieve security prevention and control.

[0051] Therefore, this invention employs the aforementioned cloud-edge collaborative dynamic intelligent location method for network risks in high-speed rail systems. This overcomes the problems of data silos, response delays, and high false alarm rates inherent in traditional manual inspections and static rule engines. Through multimodal data fusion and adaptive learning mechanisms, it improves the accuracy and timeliness of risk location. It achieves multi-source data integration and correlation analysis by using graph embedding to map heterogeneous data such as video surveillance, sensor signals, and network logs to a unified vector space, establishing cross-system spatiotemporal correlation feature representations. This avoids the transmission delays and data barriers of centralized storage, completing localized feature extraction and global correlation analysis of multi-source data. Simultaneously, through… Graph embedding is used to reconstruct node features, and combined with residual network cumulative connectivity calculation and risk node weight calculation, to accurately identify critical risk nodes. A reinforcement learning model is used to select the optimal key points under different network conditions. Based on edge centrality, key edges are located, ultimately confirming the critical risk chain and providing a clear objective for risk prevention and control. Through a dynamic network node embedding and reinforcement learning interaction mechanism, combined with a multi-dimensional analysis model of edge centrality features, real-time location of key nodes under dynamic topology changes and accurate identification of critical risk transmission links are achieved. This promotes the transformation of the high-speed rail network security system from passive defense to proactive immunity, providing a solid security foundation for the construction of intelligent high-speed rail.

[0052] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0053] Figure 1 This is a flowchart of the dynamic intelligent location method for network risks in high-speed rail systems based on cloud-edge collaboration proposed in this invention;

[0054] Figure 2 This is a roadmap for the risk critical chain location technology proposed in this invention;

[0055] Figure 3 This is a framework diagram of the graph embedding method proposed in this invention;

[0056] Figure 4 This is a flowchart of the reinforcement learning process proposed in this invention;

[0057] Figure 5 This is a flowchart of the key chain of the high-speed rail information infrastructure network proposed in this invention;

[0058] Figure 6 This is a security control logic chain diagram proposed in this invention. Detailed Implementation

[0059] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0060] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. The power modules of the embodiments of the present invention can be arranged and designed in various different configurations. The specific model specifications need to be selected and determined according to actual needs, etc., and therefore will not be described in detail.

[0061] Example

[0062] like Figure 1-3 As shown, a dynamic intelligent location method for network risks in a high-speed rail system based on cloud-edge collaboration has the following main steps:

[0063] Step S1: Reconstruct node features using graph embedding.

[0064] Existing methods typically use feature summaries to represent nodes and graphs. However, these features are often transient and may lead to inaccurate performance. This invention employs a graph embedding method to map network nodes into low-dimensional vector representations, preserving graph information in the embedding domain, and using the node representations in the embedding domain to reconstruct the information of the graph domain to be preserved.

[0065] First, a high-speed rail information infrastructure network graph is constructed, where network nodes include signal and control systems, communication facilities, and power supply systems. The attribute data of each node, such as the type, location, and operating status of high-speed rail system equipment, provides rich input information for subsequent embedding learning. Then, Node2Vec is adopted as the graph embedding method, with hyperparameters set such as an embedding dimension of 128, a random walk length of 60, and a window size of 15. Next, a biased random walk is used to generate node sequences, and the Node2Vec model is trained to obtain the embedding vector for each node. Through training, each node is mapped into a 128-dimensional vector space, which contains the node's structural and attribute information.

[0066] The mapping function, defined based on the lookup table method, has the following formula:

[0067] f(v i )=u i =e i T W (1)

[0068] Where e i For a graph node, u i The embedding domain vector is denoted by W, which represents a learnable parameter. Co-occurrence information is then stored using the skip-gram algorithm. For the reconstructed information, the center node and the context nodes have different mapping functions:

[0069]

[0070] Among them, v i W represents a node in the graph domain. cen The mapping parameters for the central node; W con For the mapping parameters of the context node;

[0071] From this, we can obtain the reconstructed information:

[0072]

[0073] Where V represents the set of all nodes in the graph domain; v con For context nodes; v cen f is the central node; con (v con ) T The feature representation of the context nodes obtained through the mapping function; f cen (v cenThe feature representation of the central node is obtained through a mapping function. To maximize the reconstruction probability, duplicate tuples need to be removed, thereby minimizing the loss function and obtaining the maximum likelihood estimation objective. Finally, the importance of the node embedding features is evaluated, and logistic regression is used to classify the nodes and identify key risk nodes.

[0074] Step S2: Calculate the cumulative connectivity of the residual network.

[0075] Considering the dynamic characteristics of complex networks, such as risk propagation, measuring node importance requires more in-depth and accurate analysis. This invention uses the Cumulative Connectivity (AC) feature to analyze risk-critical nodes in the high-speed rail information infrastructure network. By blocking a set of risk-critical nodes, the cumulative connectivity is minimized. The cumulative connectivity of a critical risk node is expressed as:

[0076]

[0077] Where AC(N,E) represents the cumulative connectivity of network nodes and edges; k represents the total number of network nodes; n i ∈N represents the i-th risk node to be attacked; This indicates that when n is removed i The cumulative connectivity of the network after each node; This represents the initial connectivity. The value of AC can be seen as an estimate of the area under the curve.

[0078] Step S3: Calculate the risk node weight (prevention and control cost).

[0079] In selecting key points in complex networks, in addition to considering their cumulative connectivity, the cost of controlling these key points should also be taken into account. Different risk nodes are associated with different weights, as shown below:

[0080]

[0081] Where, c(n) i ) represents node n i The costs of its own prevention and control.

[0082] Step S4: Reinforcement learning model construction.

[0083] like Figure 4 As shown, a reinforcement learning model is used to discuss it, that is, the parameters are continuously updated, and then an optimal mapping between node state and action is learned. This mapping can make the optimal key point selection under different network states.

[0084] Among them, the environment is the high-speed rail information infrastructure network being analyzed, and the state is s. tThis refers to the status of the remaining network nodes after removing critical nodes, including the operating status of subsystem devices, historical fault records, current load, etc. Action a t This involves removing or replacing critical subsystem nodes, with the reward being the residual critical edge after the action, i.e., the reduction in the AC (Accuracy Availability) value of the edge connecting two nodes in the high-speed rail network. Its reward function can be expressed as:

[0085] R t =AC t =[AC 1 (s t ,a t ,s t+1 ), AC 2 (s t ,a t ,s t+1 ),...,AC M (s t ,a t ,s t+1 (6)

[0086] Among them, AC M (s t ,a t ,s t+1 () indicates that the target of the Mth identification critical chain takes action a at time t and state s, and then transitions to state s. t+1 The instant reward obtained at that time;

[0087] The action value function Q can be expressed as:

[0088]

[0089] This indicates that under policy π, from state s t Begin, take action t The expected cumulative discounted reward, where γ is a discount factor used to calculate the future reward value of the system;

[0090] State value function V π It can be represented as:

[0091]

[0092] This indicates that under policy π, from state s t Initially, the expected long-term cumulative discounted reward is considered; therefore, the optimal action value function is expressed as:

[0093] Q * (s,a)=max π Q π (s,a) (9)

[0094] The optimal state value function is expressed as:

[0095] V * (s)=max π V π (s) (10)

[0096] The optimal selection of key points for high-speed rail information infrastructure satisfies:

[0097]

[0098] Where, π * (a|s) represents the optimal strategy for choosing action a in state s, where argmax is the maximum value. a' Q * (s,a') represents the optimal action value function Q in state s. * (s,a') represents the largest action, a'.

[0099] In step S4, the steps for finding the critical chain of the high-speed rail information infrastructure network based on reinforcement learning are as follows: Figure 5 As shown: First, the status s received from the high-speed rail information infrastructure network is... t Secondly, based on this state s t Take action a t This means removing a network node, and the environment enters a new state s. t+1 The environment then provides rewards, known as AC values, and the goal is to maximize the expected sum of all rewards. Based on the calculated Q value, an ε-greedy action strategy is adopted, where the node with the highest Q is selected with probability (1-ε), otherwise a random action is taken. Finally, through multiple simulations and training updates, the parameters—state, action, or score parameters α, β, etc.—are updated to achieve the ultimate goal: observing which node failures trigger chain reactions leading to overall system failure, identifying these nodes and their dependencies, and forming a critical risk chain.

[0100] Step S5: Locate the key edge based on edge centrality.

[0101] In a high-speed rail network system, if one subsystem is attacked, the closer the connections between other hosts or equipment components and the subsystem, the higher the risk of attack. For example, an attack on the Train Dispatching and Control System (TDCS) could affect the Automatic Train Protection System (ATP) and the Automatic Train Operation System (ATO), as they are closely interconnected. Therefore, after identifying the key network risk points, it is necessary to further determine the optimal attack paths between these key points, i.e., the critical edges. To measure the optimal attack paths between key points, this invention uses edge centrality to calculate the shortest path between all pairs of nodes in the graph. The calculation formula is as follows:

[0102]

[0103] Where N represents the set of critical nodes, θ(s,t) represents the number of shortest paths, and θ(s,t|e) represents the number of paths passing through edge e. After obtaining the critical nodes and critical edges, the critical chain is confirmed, and the risk control strategy is specified on the critical chain.

[0104] Step S6: Identify the critical risk chain.

[0105] like Figure 6 The diagram illustrates the security control logic within the critical chain. In the critical chain, A1, A2, A3, B5, and C3 represent potential high-speed rail risk events, such as train signal malfunctions, train failures, and braking signal malfunctions. Train 1 (R) and Host 1 (R) are critical nodes. Once an attack node is detected, security control must be implemented by promptly blocking the critical edges according to the critical chain, i.e., disconnecting the critical edges. d and e represent the edges where security risk events occur, while a, b, and c are the critical edges for security control. These three edges must be cut to prevent risk events from occurring.

[0106] Therefore, this invention employs the aforementioned cloud-edge collaborative dynamic intelligent location method for high-speed rail system network risks. Utilizing a dynamic network node embedding and reinforcement learning interaction mechanism, it maps complex network nodes to a low-dimensional vector space (embedding method). Simultaneously, it combines the real-time interaction between the reinforcement learning agent and the network environment to achieve real-time location of key nodes under dynamic topology changes. Furthermore, for a multi-dimensional analysis model of edge centrality characteristics, it proposes a composite centrality index based on edge load, propagation efficiency, and structural vulnerability, overcoming the limitations of traditional single-index methods and accurately identifying key links in risk transmission.

[0107] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A method for dynamic intelligent location of network risks in a high-speed rail system based on cloud-edge collaboration, characterized in that, Includes the following steps: S1. Reconstruct node features using graph embedding to generate node embedding vectors for subsequent node classification; S2. Calculate the cumulative connectivity of the residual network; S3. Calculate the weight of risk nodes and determine the importance of nodes to improve positioning efficiency; S4. Construct a reinforcement learning model to adapt to network changes and formulate the optimal solution; S5. Based on edge centrality, key edges are located to provide a basis for monitoring and prevention. S6. Identify the critical chain and achieve adaptive security control through real-time decision-making by reinforcement learning models; Step S1 specifically includes: S11, Construct a high-speed rail information infrastructure network map; S12. Use Node2Vec as the graph embedding method and set the hyperparameters; S13. Generate a node sequence through biased random walk, train the Node2Vec model, and obtain the embedding vector of each node; S14. Evaluate the importance of node embedding vectors, classify nodes using logistic regression, and identify key risk nodes; In step S4, the environment is the high-speed rail information infrastructure network, and the state of the remaining network nodes after removing the key nodes is taken as the state. The action is to remove or replace critical subsystem nodes. The algorithm uses the residual key edges after an action as a reward, learns the optimal mapping between node states and actions by continuously updating parameters, and then selects the optimal key points under different network states based on the action value function, state value function, optimal action value function and optimal state value function. In step S6, the specific process of finding the key chain based on reinforcement learning is as follows: The state of the high-speed rail information infrastructure network is received; based on this state, an action is taken to remove a network node, and the environment enters a new state; at this time, the environment will receive some rewards, namely the cumulative connectivity AC value. The goal is to maximize the expected sum of all rewards. Based on the calculated Q value, the following is adopted: Action strategy, based on probability Select the node with the highest Q; otherwise, take random action. Update parameters through multiple simulations and training sessions to identify nodes and dependencies that cause cascading failures in the system, forming a risk critical chain. Risk control strategies are specified on the critical chain. When an attack node is discovered, the critical edge is blocked in a timely manner according to the critical chain to achieve security control.

2. The method for dynamic intelligent location of network risks in a high-speed rail system based on cloud-edge collaboration according to claim 1, characterized in that, In step S13, a mapping function is defined based on the lookup table method, and the formula is: （1） in, For graph domain nodes, For embedded field vectors, These are parameters that can be learned; the center node and context nodes have different mapping functions: （2） in, For nodes in the graph domain; The mapping parameters for the central node; For the mapping parameters of the context node; Thus, the reconstructed information is obtained: （3） Where V represents the set of all nodes in the graph domain; For context nodes; As the central node; The feature representation of the context node obtained by the mapping function; The feature representation of the central node is obtained through a mapping function.

3. The method for dynamic intelligent location of network risks in a high-speed rail system based on cloud-edge collaboration according to claim 1, characterized in that, In step S2, the cumulative connectivity feature is used to analyze the key risk nodes of the high-speed rail information infrastructure network. The cumulative connectivity of the key risk nodes is represented as follows: （4） in, Indicates the total number of network nodes; Indicates the number to be attacked One risk node; Indicates the removal of a node The cumulative connectivity of the subsequent network; Indicates initial connectivity.

4. The method for dynamic intelligent location of network risks in a high-speed rail system based on cloud-edge collaboration according to claim 3, characterized in that, In step S3, different risk nodes are associated with different weights, as shown below: （5） in, Represents a node The costs of its own prevention and control.

5. The method for dynamic intelligent location of network risks in a high-speed rail system based on cloud-edge collaboration according to claim 1, characterized in that, In step S4, the reward function is expressed as: （6） in, Indicates the first A target identifying the critical chain takes action a at time t, in state s, and transitions to state a. The instant reward obtained at that time; The action value function Q is expressed as: （7） Indicating in strategy Below, from the state Begin, take action The expected cumulative discounted reward, of which, This is a discount factor used to calculate the system's future reward value; State value function Represented as: （8） Indicating in strategy Below, from the state Initially, the expected long-term cumulative discounted reward is considered; therefore, the optimal action value function is expressed as: （9） The optimal state value function is expressed as: （10） The optimal selection of key points for high-speed rail information infrastructure satisfies: （11） in, Indicates the state Select action The optimal strategy Indicates the state The optimal action value function is then made. Biggest movement .

6. The method for dynamic intelligent location of network risks in a high-speed rail system based on cloud-edge collaboration according to claim 1, characterized in that, In step S5, after identifying the key risk nodes in the network, the key edges are further identified, and the shortest path between all pairs of nodes in the graph is calculated using edge centrality.

Images