Railway communication network early warning method and system based on intrusion detection

Abstract

The application provides a railway communication network early warning method and system based on intrusion detection, which comprises the following steps: collecting protocol session traffic of key nodes of a railway communication network, and obtaining session-level interaction data by analysis; extracting state transition features of the protocol session, calculating dynamic information entropy values, and generating an entropy feature vector; constructing a behavior chain sequence of the device, and calculating a behavior chain probability by using a decay-weighted N-Gram model; dividing network operation scenarios by time-sensitive clustering, establishing a dynamic baseline library for storing entropy threshold baselines and behavior chain probability threshold baselines of each scenario; performing entropy deviation detection and behavior chain anomaly detection in parallel; when the entropy deviation detection and the behavior chain anomaly detection trigger an alarm at the same time, a high-confidence alarm is generated and a protection device is linked. Through the dual detection mechanism of dynamic information entropy analysis and decay-weighted behavior chain, combined with time-sensitive scenario clustering, the application realizes high-precision and low-false-alarm early warning of complex railway communication network attacks.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of railway communication network security, and particularly relates to a railway communication network early warning method and system based on intrusion detection. BACKGROUND

[0002] The railway communication network is the core infrastructure supporting train operation control, dispatching command, passenger service and equipment monitoring, and its security is directly related to the reliability, efficiency and passenger life and property safety of railway transportation. With the rapid development of 5G-R, Internet of Things and intelligent railway technology, the scale and complexity of the railway communication network have been significantly improved, but it also faces more severe network security threats.

[0003] The traditional static defense technology usually has the following defects: manual log analysis response delay > 4 hours, far exceeding the 50ms safety time window of train-ground communication, and unable to block penetration attacks; static security strategy cannot distinguish business scenarios (such as 300 daily dispatching instructions per minute and 2000 during the Spring Festival peak), resulting in normal traffic being misjudged as DDoS attacks during the peak, producing false positives, and slow scanning attacks during the maintenance window greatly increasing the false negative rate; due to the inability to analyze interactive semantics, the detection rate of encrypted traffic deep packet inspection (DPI) on GSM-R / 5G-R protocol vulnerability attacks is < 35%. SUMMARY

[0004] Therefore, the purpose of the present application is to provide a railway communication network early warning method and system based on intrusion detection to solve the above-mentioned problems.

[0005] According to the railway communication network early warning method based on intrusion detection provided by the present application, the method comprises:

[0006] Collecting protocol session traffic of key nodes of the railway communication network, and analyzing to obtain session-level interactive data;

[0007] Based on the session-level interactive data, extracting state transition features of the protocol session, calculating dynamic information entropy values, and generating entropy feature vectors;

[0008] Based on the session-level interactive data, constructing a behavior chain sequence of the device, and calculating a behavior chain probability using a decay-weighted N-Gram model;

[0009] Dividing network operation scenarios through time-sensitive clustering, and establishing a dynamic baseline library for storing entropy threshold baselines and behavior chain probability threshold baselines of each scenario;

[0010] Parallelly performing entropy deviation detection and behavior chain anomaly detection;

[0011] When the entropy deviation detection and the behavior chain anomaly detection trigger the alarm at the same time, a high-confidence alarm is generated and a protection device is linked.

[0012] Further, the dynamic information entropy value is calculated, including:

[0013] The protocol state machine legal jump set is defined as , wherein represents the i-th type of state jump event;

[0014] Based on the session-level interaction data, the probability of occurrence of each type of jump event in the historical session is counted to obtain a state jump probability distribution .

[0015] The entropy value is calculated for the state jump probability distribution, and the formula is: , wherein H is the entropy value of the current session, n is the total number of legal state jump types, is the occurrence probability of the i-th type of jump event;

[0016] Based on the entropy value of each protocol interaction phase, an entropy feature vector is constructed, and the entropy feature vector is , wherein is the session entropy value of the authentication phase, is the session entropy value of the instruction interaction phase, is the entropy value of the response delay distribution.

[0017] Further, the behavior chain probability is calculated by using a decay-weighted N-Gram model, including:

[0018] The behavior chain sequence is composed of atomic operations, including at least two consecutive operations of GPS reporting, state query, and control response;

[0019] The behavior chain probability is calculated, and the formula is: , wherein P(chain) is the behavior chain probability, indicating the occurrence probability of the current behavior chain, λ is a time decay factor, , is the current timestamp, is the occurrence timestamp of the k-th historical behavior chain, is the occurrence timestamp of the m-th historical behavior chain, is the number of occurrences of the historical behavior chain identical to the current behavior chain , K is the total number of matched historical chains, and M is the total number of all historical behavior chains in the time window.

[0020] Further, the dynamic baseline library is established, including:

[0021] Based on the first week of full volume historical session data, generate a global initial entropy threshold baseline vector and a global initial behavior chain probability threshold baseline to perform cold start when the system is initialized;

[0022] Construct a clustering feature vector, and based on the clustering feature vector, divide the network state into three types of scenes, namely daily scheduling, peak operation and maintenance mode, by time-sensitive clustering;

[0023] Redistribute the historical session data according to the scene label, and calculate the entropy threshold baseline vector and the behavior chain probability threshold baseline of each dedicated scene respectively. The entropy threshold baseline vector of the dedicated scene is: , , , The authentication phase entropy threshold baseline, the instruction interaction entropy threshold baseline and the response delay entropy threshold baseline of the corresponding scene are represented by, respectively. The behavior chain probability threshold baseline of the dedicated scene is: , is the average value of the behavior chain probability of the corresponding scene, is the standard deviation of the behavior chain probability of the corresponding scene;

[0024] Update the dedicated threshold baseline of each scene independently.

[0025] Further, the construction of the clustering feature vector comprises:

[0026] Extract the traffic cycle feature, device online rate feature and instruction type distribution feature in the current time window;

[0027] Introduce a time decay factor to generate a current clustering feature vector with time weight: wherein, δ is a time decay factor, , is the traffic cycle feature, is the device online rate feature, is the instruction type distribution feature, , is the control instruction proportion, is the state query proportion, is the data reporting proportion.

[0028] Further, the network state is divided into three types of scenes, namely daily scheduling, peak operation and maintenance mode, by time-sensitive clustering, which comprises:

[0029] Initialize three types of scene clustering centers, wherein the daily scheduling center is: , the peak operation center is: , and the maintenance mode center is: wherein, , , , , , All are historical sample statistical mean;

[0030] Calculate the time-decayed Euclidean distance between the current cluster feature vector and the center of each scene:

[0031] ,

[0032] in, Represents the current cluster feature vector The a-th eigenvalue, Represents the center of the j-th scene. The a-th eigenvalue, j=1,2,3;

[0033] Assign the current cluster feature vector to the scenario corresponding to the minimum distance;

[0034] If the minimum distance is greater than θ, a temporary scene is created and manual review is initiated, where θ = 2 × historical average class spacing.

[0035] Furthermore, the parallel execution entropy deviation detection and behavioral chain anomaly detection include:

[0036] Compare the entropy feature vector with the entropy threshold baseline of the current scene, calculate the entropy value deviation, and trigger a primary alarm if any entropy value deviation is greater than a preset deviation.

[0037] The probability of the behavior chain is compared with the baseline threshold of the behavior chain probability in the current scene. If the probability of the behavior chain is less than the baseline threshold, a primary alarm is triggered.

[0038] Furthermore, the calculation of entropy deviation includes:

[0039] Calculate the entropy deviation for each stage using the following formula: Where x∈{auth, cmd, response}, for The time represents the entropy value during the authentication phase. for This represents the session entropy value during the authentication phase. for This represents the baseline entropy threshold for the authentication phase in the current scenario. for The time represents the entropy value of the command interaction. for This represents the session entropy value during the command interaction phase. for This represents the baseline entropy threshold during the instruction interaction phase of the current scenario. for The entropy value representing the response delay is in degrees. for , representing the entropy value of the response delay distribution. for , representing the baseline entropy threshold for the response latency of the current scenario.

[0040] Furthermore, the generation of high-confidence alarms and the activation of protective devices include:

[0041] When a high-confidence alarm is triggered, the abnormal session is automatically isolated;

[0042] Based on the behavior chain sequence and entropy feature vector, a source tracing report is generated. The anomalies marked in the source tracing report include the atomic operation positions with the lowest probability in the behavior chain and the protocol interaction stages with the largest entropy value mutations.

[0043] This invention also proposes an intrusion detection-based early warning system for railway communication networks, used to implement the aforementioned intrusion detection-based early warning method for railway communication networks. The system includes:

[0044] Data acquisition module: used to collect protocol session traffic of key nodes in the railway communication network and parse it to obtain session-level interaction data;

[0045] Session entropy analysis module: used to extract state transition features of protocol sessions based on the session-level interaction data, calculate dynamic information entropy values, and generate entropy feature vectors;

[0046] Behavior chain modeling module: used to construct the device's behavior chain sequence based on the session-level interaction data, and calculate the behavior chain probability using a decay-weighted N-Gram model;

[0047] Dynamic baseline maintenance module: used to divide network operation scenarios through time-sensitive clustering, establish a dynamic baseline library, and store the entropy threshold baseline and behavior chain probability threshold baseline for each scenario;

[0048] Parallel detection module: used for parallel execution of entropy deviation detection and behavioral chain anomaly detection;

[0049] Joint early warning module: When the entropy deviation detection and behavior chain anomaly detection trigger alarms simultaneously, a high confidence alarm is generated and the protection equipment is activated.

[0050] In summary, the railway communication network early warning method based on intrusion detection of the present invention, by analyzing the state transition logic of protocol interaction and constructing dynamic information entropy, avoids dependence on encrypted content and can accurately identify the behavior patterns of attackers forging protocol sessions (such as skipping authentication steps or injecting illegal instructions), significantly improving the ability to detect protocol-level vulnerability attacks and solving the functional failure problem of traditional deep packet inspection in railway encrypted communication scenarios.

[0051] By abstracting device operations into atomic behavior chains and introducing a time decay mechanism to focus on recent legitimate patterns, the interference of historical data can be effectively removed. The time decay N-Gram model has a good ability to identify low-frequency slow attacks (such as latent penetration under legitimate credentials) and device operation pattern drift (such as behavior changes after firmware upgrades), overcoming the blind spot defect of traditional threshold detection for long-cycle, low-rate threats.

[0052] Based on the real-time clustering and baseline autonomy mechanism of network operation scenarios, it dynamically adapts to discrete business phases such as day and night peak hours, seasonal scheduling and emergency maintenance, solves the problem of misjudgment risk of static policies in scenarios of traffic surge or batch operation of equipment, realizes the synchronization of security policies and business pulse, and ensures zero-interference operation under ultra-high availability requirements.

[0053] Ultimately, the dynamic information entropy of the protocol session and the probability of the device behavior chain are used in parallel as detection dimensions to form a dual verification mechanism. An attack must break through the thresholds of both types of features simultaneously to trigger a high-confidence alarm and link up with the protection device, which greatly reduces the false alarm rate and avoids business interruption caused by a single false alarm.

[0054] This invention significantly improves the accuracy and real-time performance of railway communication network intrusion detection through a dual detection mechanism of dynamic information entropy analysis and attenuation-weighted behavior chain modeling, combined with time-sensitive scene clustering technology. It achieves high-precision, low-false-report early warning of attacks on complex railway communication networks, providing reliable security protection for key scenarios such as high-speed rail scheduling and train control.

[0055] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by means of embodiments of the invention. Attached Figure Description

[0056] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, in which:

[0057] Figure 1 This is a flowchart of an intrusion detection-based early warning method for railway communication networks according to Embodiment 1 of the present invention;

[0058] Figure 2This is a system block diagram of an intrusion detection-based early warning system for railway communication networks according to Embodiment 2 of the present invention. Detailed Implementation

[0059] To facilitate understanding of the present invention, a more complete description will be given below with reference to the accompanying drawings. Several embodiments of the invention are illustrated in the drawings. However, the invention can be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete.

[0060] It should be noted that when a component is said to be "fixed to" another component, it can be directly on the other component or there may be an intervening component. When a component is said to be "connected to" another component, it can be directly connected to the other component or there may be an intervening component. The terms "vertical," "horizontal," "left," "right," and similar expressions used in this document are for illustrative purposes only.

[0061] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0062] Example 1

[0063] Please see Figure 1 This invention proposes an early warning method for railway communication networks based on intrusion detection, the method comprising steps S101 to S106:

[0064] S101 collects protocol session traffic from key nodes of the railway communication network and parses it to obtain session-level interaction data.

[0065] Understandably, hardware optical splitters are deployed at service control plane nodes such as Radio Block Center (RBC), Train Control Center (TCC), and Centralized Dispatch Center (CTC), and hardware optical splitters are deployed at core network elements such as Radio Block Center (RBC) and Train Control Center (TCC) to obtain the original traffic through zero-copy mirroring technology.

[0066] Railway communication uses railway-specific protocols such as GSM-R / LTE-R. Wireshark, Suricata, or a custom parser are used to identify GSM-R / LTE-R protocol fields (such as BSSMAP messages and S1AP signaling). The parsing process extracts session metadata (five-tuples, IMSI / TMSI), signaling content (location update, handover commands), and service parameters (train ID, QoS level), and generates structured data using tools such as Scapy or Zeek.

[0067] The entire session is tracked based on the 5-tuple or service identifier, extracting temporal features (message interval, response delay), state transitions (protocol state machine jumps), and behavioral chains (such as "GPS reporting → status query → control response"). A data structure example includes session ID, protocol type, node information, and message sequence (type, timestamp, source / destination, payload), such as the interaction record between BSSMAP_ASSIGNMENT_REQ and BSSMAP_ASSIGNMENT_COMPLETE in the train handover process.

[0068] S102, Based on the session-level interaction data, extract the state transition features of the protocol session, calculate the dynamic information entropy value, and generate an entropy feature vector;

[0069] Further optionally, the calculation of the dynamic information entropy value includes:

[0070] Define the set of valid transitions for the protocol state machine as follows: ,in, This represents the i-th type of state transition event;

[0071] Based on the session-level interaction data, the probability of various transition events occurring in historical sessions is statistically analyzed to obtain the state transition probability distribution. ;

[0072] For the state transition probability distribution, the entropy value is calculated using the following formula: Where H is the entropy value of the current session, and n is the total number of valid state transition types. Let be the probability of the i-th type of jump event occurring;

[0073] Based on the entropy values ​​of each protocol interaction phase, an entropy feature vector is constructed, wherein the entropy feature vector is... ,in, This is the session entropy value during the authentication phase. This represents the session entropy value during the instruction interaction phase. The entropy value is the response delay distribution.

[0074] Understandably, railway protocols such as GSM-R / LTE-R can be deconstructed into discretized state transition events, forming mathematically describable... The set precisely corresponds to the column control business logic, where each This represents a type of legitimate state transition event, such as idle → dedicated mode or handover request → handover complete in the GSM-R protocol. This embodiment, by directly analyzing the protocol interaction mode, can circumvent the GSM-R voice / data encryption barrier, significantly improving the detection rate compared to deep packet inspection.

[0075] Based on the parsed session-level interaction data, the probability of occurrence of each type of transition event in historical sessions is calculated to form a state transition probability distribution. This is to capture statistical patterns in protocol interactions. For example, if the percentage of handover requests to handover completion in historical sessions is 80%, then the probability distribution of its state transitions... .

[0076] The entropy value H of the current session is calculated using the entropy formula in information theory to quantify the uncertainty of protocol interactions. Legitimate sessions have stable entropy values ​​due to a uniform distribution of redirection probabilities, while attack behaviors cause sudden changes in entropy values ​​due to abnormal redirections (such as skipping authentication). This embodiment significantly reduces the false positive rate by accurately identifying threats such as man-in-the-middle attacks (sudden drop in entropy value) and denial-of-service attacks (surge in entropy value).

[0077] S103, Based on the session-level interaction data, construct the device's behavior chain sequence and calculate the behavior chain probability using a decay-weighted N-Gram model.

[0078] Further optionally, the calculation of the behavioral chain probability using a decay-weighted N-Gram model includes:

[0079] The behavior chain sequence consists of atomic operations, including at least two consecutive operations from GPS reporting, status query, and control response;

[0080] The formula for calculating the probability of a behavioral chain is: Where P(chain) is the probability of the action chain, representing the probability of the current action chain occurring, and λ is the time decay factor. , This is the current timestamp. Let k be the timestamp of the occurrence of the k-th historical behavior chain. Let m be the timestamp of the occurrence of the m-th historical behavior chain. For historical behavior chains that are the same as the current behavior chain The occurrence count, K is the total number of historical chains matched, and M is the total number of all historical behavior chains within the time window.

[0081] Understandably, atomic operations are defined as typical operations in railway communication (such as GPS reporting, status query, and control response), and the behavior chain sequence consists of at least two consecutive atomic operations (such as "GPS reporting → status query" or "status query → control response → GPS reporting"). This transforms equipment behavior into a quantifiable, serialized pattern, accurately matching railway-specific business flows such as train control and dispatching instructions.

[0082] Using formula Calculate the probability of the behavioral chain using weighted frequencies. Characterizing the probability of the current behavior chain occurring, the introduced Exponential decay factor (e.g.) At that time, data from three months ago has a weight of less than 1%, allowing the model to continuously focus on recent behavioral patterns and automatically weaken the interference of historical data. Legitimate behavioral changes caused by device firmware upgrades or seasonal policy adjustments can be naturally absorbed by the λ decay mechanism (new data weight > old data), avoiding misjudgment. If an attacker performs low-frequency penetration disguised as normal operation (such as one unauthorized command per hour), then due to... The value was identified as being significantly lower than the historical baseline.

[0083] S104 uses time-sensitive clustering to divide the network operation scenarios and establishes a dynamic baseline library to store the entropy threshold baseline and behavior chain probability threshold baseline for each scenario.

[0084] Further optionally, the establishment of the dynamic baseline library includes:

[0085] Based on the full historical session data of the first week, a global initial entropy threshold baseline vector and a global initial behavior chain probability threshold baseline are generated to perform a cold start during system initialization.

[0086] Construct clustering feature vectors, and based on these clustering feature vectors, classify network states into three scenarios—daily scheduling, peak operation, and maintenance mode—using time-sensitive clustering.

[0087] Historical session data is redistributed according to scene labels, and the entropy threshold baseline vector and behavior chain probability threshold baseline are calculated for each specific scene. The entropy threshold baseline vector for each specific scene is: ,in, , , These represent the mean entropy of the authentication phase, the mean entropy of the instruction interaction, and the mean entropy of the response delay, respectively, using only the corresponding scenario-specific labeled data. They also represent the baseline entropy thresholds for the authentication phase, instruction interaction, and response delay in the corresponding scenario. The baseline behavioral chain probability threshold for the specific scenario is: , This represents the average probability of the behavioral chain in the corresponding scenario. The standard deviation of the probability of the behavioral chain in the corresponding scenario;

[0088] Each scenario has its own independent threshold baseline updated.

[0089] Understandably, the full historical session data collected in the first week after system deployment (without scene differentiation) is used to calculate two types of global initial baselines to address the cold start issue caused by the lack of scene labels during system initialization. The global initial entropy threshold baseline vector is calculated using the global statistical mean. ,in, These represent the average entropy values ​​of the authentication phase, command interaction phase, and response latency distribution in historical data, respectively. Simultaneously, the baseline probability threshold for the global initial behavior chain is calculated using the normal distribution statistical principle. , This represents the historical average of the probability of the behavioral chain. The historical standard deviation of the behavioral chain probability, under the assumption of normal distribution, means that this behavioral chain probability threshold covers 99.7% of normal behaviors. The interval makes anomaly detection mathematically necessary.

[0090] Real-time collection of flow cycles using a sliding window (Messages / minute), Equipment Online Rate Instruction type distribution (Control commands) Status query / Data reporting The three-dimensional features (proportion) are used to accurately quantify the network's operating status and construct clustering feature vectors.

[0091] When performing clustering, time-decay Euclidean distance is used to divide the network status into three scenarios: daily scheduling (dominated by control commands), peak operation (surge in status queries), and maintenance mode (dominated by equipment reporting), which are consistent with the real-world scenarios of railway operation.

[0092] The historical session data from the cold start phase is relabeled with scene tags based on the clustering results: The clustering feature vector for each historical time period is calculated, and the scene is assigned to the nearest scene based on the minimum Euclidean distance; if it is close to the peak operation center, it is marked as a peak. After clustering, a specific threshold baseline and an entropy threshold baseline vector for each scene are calculated. Baseline for behavioral chain probability thresholds in specific scenarios: .

[0093] When the system enters a specific scenario (such as peak operation), only the specific threshold baseline for that scenario is updated. The update formula for the entropy threshold baseline vector is: , The mean of the entropy feature vector of the current detection window. This is the baseline vector of the entropy threshold before the update for the specific scenario, where α controls the update magnitude. The update formula for the behavior chain probability threshold baseline is: , The baseline for the probability threshold of the behavior chain before the update for the specific scenario. and This is a statistical value of the probability of the behavior chain within the current window. The baseline for other scenarios remains frozen during this process to avoid cross-scenario misadjustment caused by sudden business changes.

[0094] Further optionally, the construction of the clustering feature vector includes:

[0095] Extract traffic cycle characteristics, device online rate characteristics, and command type distribution characteristics within the current time window;

[0096] Introducing a time decay factor generates a time-weighted current cluster feature vector: Where δ is the time decay factor, , As a characteristic of the flow cycle, For equipment online rate characteristics, For instruction type distribution characteristics, , To control the proportion of instructions, This represents the percentage of status queries. This represents the percentage of data reported.

[0097] Understandably, three key features are extracted within the sliding time window: flow cycle. (Messages / minute), Equipment Online Rate Instruction type distribution (Control commands) Status query / Data reporting (Percentage), of which, traffic cycle The number of packets per unit time reflects the network load in real time and captures the surge in business during peak periods, such as peak operation scenarios. Significantly increased; equipment uptime To determine the percentage of active devices, quantify network topology stability, and identify instances of mass device shutdowns or malicious access, such as during maintenance mode when some devices are offline. It may drop below 60%; instruction type distribution , To control the proportion of instructions, This represents the percentage of status queries. The percentage of data reported, such as in daily scheduling scenarios. >70%, peak operation scenario >50%, maintenance mode scenario >60%, three-dimensional features together construct the digital fingerprint of railway business.

[0098] Introduction The time decay factor is used to weight the cluster feature vectors, generating the current cluster feature vector with time weights: To amplify the impact of recent characteristics, such as At that time, the weight of last week's data was only 10% of the historical average, suppressing interference from outdated data.

[0099] Further optionally, the method of classifying network states into three scenarios—daily scheduling, peak operation, and maintenance mode—through time-sensitive clustering includes:

[0100] Define historical sample set Where N is the number of samples, Let i be the feature vector of the i-th historical cluster. This includes characteristics such as traffic cycle, device online rate, and command type distribution.

[0101] Three types of clustering centers were initialized based on historical samples, among which the daily scheduling center is: The peak operation center is: The maintenance mode center is: ,in, , , , , , All are historical sample statistical mean;

[0102] Calculate the time-decayed Euclidean distance between the current cluster feature vector and the center of each scene:

[0103] ,

[0104] in, Represents the current cluster feature vector The a-th eigenvalue, Represents the center of the j-th scene. The a-th eigenvalue, j=1,2,3, This is the time decay factor;

[0105] Assign the current cluster feature vector to the scenario corresponding to the minimum distance;

[0106] If the minimum distance is greater than θ, a temporary scene is created and manual review is initiated, where θ = 2 × historical average class spacing.

[0107] Understandably, historical clustering feature vectors are collected based on historical sliding windows to form a sample set. Each vector It includes traffic cycles, device online rates, and command type distribution characteristics, providing a data foundation for scenario segmentation.

[0108] Based on the historical sample statistical mean μ (to avoid scene drift caused by random initialization), three types of scene centers are initialized:

[0109] Daily Dispatch Center , Indicates a low-flow period. This indicates a high equipment online rate and a high proportion of control commands. =0.7), meaning that the control command dominates.

[0110] Peak Operations Center , Indicates a high-flow period. The device online rate is saturated, and the proportion of status queries is high. =0.5), which means a surge in status queries.

[0111] Maintenance Mode Center , Indicates the medium flow cycle. This indicates a low device online rate and a high proportion of data reporting. =0.6), meaning that data reporting is the primary method.

[0112] Further explanation: The center of each scene is a five-dimensional vector, in the form of: .in, For flow cycle Historical average. Daily scheduling: low load. ,like <800 messages / minute; Peak operation: High load ,like >1500 messages / minute; Maintenance mode: Medium load , such as 800 <1200 messages / minute.

[0113] For equipment online rate Historical average. Daily scheduling: High online rate. ,like >95% (all equipment is participating in dispatching normally); Peak operation: Saturation online rate ,like ≈100% (All devices are connected); Maintenance mode: Low online rate ,like <80% (some equipment is offline for maintenance).

[0114] Instruction type distribution ( Historical average. Daily scheduling: control commands. leading( Status query and data reporting The proportion is relatively low ( , Peak operation: Status query The proportion increased ( ), control commands The proportion decreased ( Maintenance mode: Data reporting The proportion has increased significantly ( ), control commands Lowest percentage ( ).

[0115] Calculate the current cluster feature vector With the scene center Distance: ,in, Weighting (δ∈(0,0.2]) amplifies the influence of recent features (e.g., when δ=0.1, the weight of last week's data decreases by 90%), while suppressing historical noise interference. For example, when lightning strikes cause equipment to go offline, Weighted automatic reduction Feature weights help avoid incorrect maintenance patterns.

[0116] Assign the current cluster feature vector to the scenario with the smallest distance (daily scheduling, peak operation, or maintenance mode). If the minimum distance is greater than θ (θ = 2 × historical average inter-class distance), create a temporary scenario and manually review it to deal with extreme events, such as regional failures.

[0117] S105, Parallel execution entropy deviation detection and behavior chain anomaly detection.

[0118] Further optionally, the parallel execution entropy deviation detection and behavioral chain anomaly detection include:

[0119] Compare the entropy feature vector with the entropy threshold baseline of the current scene, calculate the entropy value deviation, and trigger a primary alarm if any entropy value deviation is greater than a preset deviation.

[0120] The probability of the behavior chain is compared with the baseline threshold of the behavior chain probability in the current scene. If the probability of the behavior chain is less than the baseline threshold, a primary alarm is triggered.

[0121] Understandably, the current entropy feature vector generated in step S102 will be... The entropy threshold baseline vector corresponding to the current scenario (routine scheduling / peak operation / maintenance mode) is compared, and the entropy deviation of each stage is calculated. If any entropy value ( If the deviation exceeds a preset deviation (e.g., 30%), a primary alarm is triggered. A typical scenario is an identity spoofing attack (such as a man-in-the-middle attack that skips authentication) causing an increase in entropy during the authentication process. A sudden drop; response latency disorder (such as a DoS attack) causes the entropy value of the response latency to drop sharply. A surge.

[0122] The current behavior chain probability P(chain) calculated in step S103 is compared with the behavior chain probability threshold baseline corresponding to the current scenario. If the current behavior chain probability is less than the behavior chain probability threshold baseline corresponding to the current scenario, a primary alarm is triggered. Typical scenario: Low-frequency penetration attacks (such as one unauthorized command per hour) cause the behavior chain probability to be significantly lower than the historical normal distribution interval ( ).

[0123] Primary alarms are generated when triggered by a single engine, serving as a risk warning but without triggering any blocking. When triggered by two engines simultaneously, high-confidence alarms are generated, and the session is automatically isolated and traced back to its source.

[0124] Further optionally, the calculation of the entropy deviation includes:

[0125] Calculate the entropy deviation for each stage using the following formula: Where x∈{auth, cmd, response}, for The time represents the entropy value during the authentication phase. for This represents the session entropy value during the authentication phase. for This represents the baseline entropy threshold for the authentication phase in the current scenario. for The time represents the entropy value of the command interaction. for This represents the session entropy value during the command interaction phase. for This represents the baseline entropy threshold during the instruction interaction phase of the current scenario. for The entropy value representing the response delay is in degrees. for , representing the entropy value of the response delay distribution. for , representing the baseline entropy threshold for the response latency of the current scenario.

[0126] S106, when the entropy deviation detection and the behavior chain anomaly detection trigger alarms simultaneously, a high confidence alarm is generated and the protection device is activated.

[0127] Further optionally, the generation of high-confidence alarms and the activation of protective devices include:

[0128] When a high-confidence alarm is triggered, the abnormal session is automatically isolated;

[0129] Based on the behavior chain sequence and entropy feature vector, a source tracing report is generated. The anomalies marked in the source tracing report include the atomic operation positions with the lowest probability in the behavior chain and the protocol interaction stages with the largest entropy value mutations.

[0130] Understandably, a high-confidence alarm is only generated when the entropy deviation detection and behavior chain anomaly detection in step S105 simultaneously trigger a primary alarm (dual-engine joint decision). Ensuring the high confidence of the alarm can significantly reduce the false alarm rate. When a high-confidence alarm is triggered, the attack source session connection is immediately cut off, and the SDN controller or firewall is activated to inject blocking flow table entries.

[0131] Generating source tracing reports based on behavioral chain sequences and entropy feature vectors can accurately pinpoint the root cause of anomalies. Dynamic programming algorithms can be used to backtrack behavioral chain sequences and mark the atomic operation positions with the lowest probability (e.g., in the control response → GPS spoofing scenario, the P(chain) of the "GPS spoofing" operation is 0.45, significantly lower than the scenario baseline of 0.65). Entropy feature vectors are also used for this purpose. Calculate the rate of change of entropy at each stage (e.g.) The value jumped from 3.2 to 5.1, a change rate of 59.4%, marking the protocol interaction phase with the largest mutation.

[0132] The report includes abnormal session IDs, timestamps, atomic operation sequences, entropy change curves, and attack type speculations (such as GPS spoofing attacks or protocol state machine overflow attacks).

[0133] In summary, the railway communication network early warning method based on intrusion detection of the present invention, by analyzing the state transition logic of protocol interaction and constructing dynamic information entropy, avoids dependence on encrypted content and can accurately identify the behavior patterns of attackers forging protocol sessions (such as skipping authentication steps or injecting illegal instructions), significantly improving the ability to detect protocol-level vulnerability attacks and solving the functional failure problem of traditional deep packet inspection in railway encrypted communication scenarios.

[0134] By abstracting device operations into atomic behavior chains and introducing a time decay mechanism to focus on recent legitimate patterns, the interference of historical data can be effectively removed. The time decay N-Gram model has a good ability to identify low-frequency slow attacks (such as latent penetration under legitimate credentials) and device operation pattern drift (such as behavior changes after firmware upgrades), overcoming the blind spot defect of traditional threshold detection for long-cycle, low-rate threats.

[0135] Based on the real-time clustering and baseline autonomy mechanism of network operation scenarios, it dynamically adapts to discrete business phases such as day and night peak hours, seasonal scheduling and emergency maintenance, solves the problem of misjudgment risk of static policies in scenarios of traffic surge or batch operation of equipment, realizes the synchronization of security policies and business pulse, and ensures zero-interference operation under ultra-high availability requirements.

[0136] Ultimately, the dynamic information entropy of the protocol session and the probability of the device behavior chain are used in parallel as detection dimensions to form a dual verification mechanism. An attack must break through the thresholds of both types of features simultaneously to trigger a high-confidence alarm and link up with the protection device, which greatly reduces the false alarm rate and avoids business interruption caused by a single false alarm.

[0137] This invention significantly improves the accuracy and real-time performance of railway communication network intrusion detection through a dual detection mechanism of dynamic information entropy analysis and attenuation-weighted behavior chain modeling, combined with time-sensitive scene clustering technology. It achieves high-precision, low-false-report early warning of attacks on complex railway communication networks, providing reliable security protection for key scenarios such as high-speed rail scheduling and train control.

[0138] Example 2

[0139] Please see Figure 2 This invention proposes an early warning system for railway communication networks based on intrusion detection. The system includes:

[0140] Data acquisition module: used to collect protocol session traffic of key nodes in the railway communication network and parse it to obtain session-level interaction data;

[0141] Session entropy analysis module: used to extract state transition features of protocol sessions based on the session-level interaction data, calculate dynamic information entropy values, and generate entropy feature vectors;

[0142] Behavior chain modeling module: used to construct the device's behavior chain sequence based on the session-level interaction data, and calculate the behavior chain probability using a decay-weighted N-Gram model;

[0143] Dynamic baseline maintenance module: used to divide network operation scenarios through time-sensitive clustering, establish a dynamic baseline library, and store the entropy threshold baseline and behavior chain probability threshold baseline for each scenario;

[0144] Parallel detection module: used for parallel execution of entropy deviation detection and behavioral chain anomaly detection;

[0145] Joint early warning module: When the entropy deviation detection and behavior chain anomaly detection trigger alarms simultaneously, a high confidence alarm is generated and the protection equipment is activated.

[0146] Further optionally, the session entropy analysis module is also used for:

[0147] Define the set of valid transitions for the protocol state machine as follows: ,in, This represents the i-th type of state transition event;

[0148] Based on the session-level interaction data, the probability of various transition events occurring in historical sessions is statistically analyzed to obtain the state transition probability distribution. ;

[0149] For the state transition probability distribution, the entropy value is calculated using the following formula: Where H is the entropy value of the current session, and n is the total number of valid state transition types. Let be the probability of the i-th type of jump event occurring;

[0150] Based on the entropy values ​​of each protocol interaction phase, an entropy feature vector is constructed, wherein the entropy feature vector is... ,in, This is the session entropy value during the authentication phase. This represents the session entropy value during the instruction interaction phase. The entropy value is the response delay distribution.

[0151] Further optionally, the behavior chain modeling module is also used for:

[0152] The behavior chain sequence consists of atomic operations, including at least two consecutive operations from GPS reporting, status query, and control response;

[0153] The formula for calculating the probability of a behavioral chain is: Where P(chain) is the probability of the action chain, representing the probability of the current action chain occurring, and λ is the time decay factor. , This is the current timestamp. Let k be the timestamp of the occurrence of the k-th historical behavior chain. Let m be the timestamp of the occurrence of the m-th historical behavior chain. For historical behavior chains that are the same as the current behavior chain The occurrence count, K is the total number of historical chains matched, and M is the total number of all historical behavior chains within the time window.

[0154] Further optionally, the dynamic baseline maintenance module is also used for:

[0155] Based on the full historical session data of the first week, a global initial entropy threshold baseline vector and a global initial behavior chain probability threshold baseline are generated to perform a cold start during system initialization.

[0156] Construct clustering feature vectors, and based on these clustering feature vectors, classify network states into three scenarios—daily scheduling, peak operation, and maintenance mode—using time-sensitive clustering.

[0157] Historical session data is redistributed according to scene labels, and the entropy threshold baseline vector and behavior chain probability threshold baseline are calculated for each specific scene. The entropy threshold baseline vector for each specific scene is: , , , These represent the baseline entropy thresholds for the authentication phase, command interaction, and response latency, respectively. The baseline behavioral chain probability threshold for the specific scenario is: , This represents the average probability of the behavioral chain in the corresponding scenario. The standard deviation of the probability of the behavioral chain in the corresponding scenario;

[0158] Each scenario has its own independent threshold baseline updated.

[0159] Further optionally, the dynamic baseline maintenance module is also used for:

[0160] Extract traffic cycle characteristics, device online rate characteristics, and command type distribution characteristics within the current time window;

[0161] Introducing a time decay factor generates a time-weighted current cluster feature vector: Where δ is the time decay factor, , As a characteristic of the flow cycle, For equipment online rate characteristics, For instruction type distribution characteristics, , To control the proportion of instructions, This represents the percentage of status queries. This represents the percentage of data reported.

[0162] Further optionally, the dynamic baseline maintenance module is also used for:

[0163] Initialize cluster centers for three types of scenarios, among which the daily scheduling center is: The peak operation center is: The maintenance mode center is: ,in, , , , , , All are historical sample statistical mean;

[0164] Calculate the time-decayed Euclidean distance between the current cluster feature vector and the center of each scene:

[0165] ,

[0166] in, Represents the current cluster feature vector The a-th eigenvalue, Represents the center of the j-th scene. The a-th eigenvalue, j=1,2,3;

[0167] Assign the current cluster feature vector to the scenario corresponding to the minimum distance;

[0168] If the minimum distance is greater than θ, a temporary scene is created and manual review is initiated, where θ = 2 × historical average class spacing.

[0169] Further optionally, the parallel detection module is also used for:

[0170] Compare the entropy feature vector with the entropy threshold baseline of the current scene, calculate the entropy value deviation, and trigger a primary alarm if any entropy value deviation is greater than a preset deviation.

[0171] The probability of the behavior chain is compared with the baseline threshold of the behavior chain probability in the current scene. If the probability of the behavior chain is less than the baseline threshold, a primary alarm is triggered.

[0172] Further optionally, the parallel detection module is also used for:

[0173] Calculate the entropy deviation for each stage using the following formula: Where x∈{auth, cmd, response}, for The time represents the entropy value during the authentication phase. for This represents the session entropy value during the authentication phase. for This represents the baseline entropy threshold for the authentication phase in the current scenario. for The time represents the entropy value of the command interaction. for This represents the session entropy value during the command interaction phase. for This represents the baseline entropy threshold during the instruction interaction phase of the current scenario. for The entropy value representing the response delay is in degrees. for , representing the entropy value of the response delay distribution. for , representing the baseline entropy threshold for the response latency of the current scenario.

[0174] Further optionally, the joint early warning module is also used for:

[0175] When a high-confidence alarm is triggered, the abnormal session is automatically isolated;

[0176] Based on the behavior chain sequence and entropy feature vector, a source tracing report is generated. The anomalies marked in the source tracing report include the atomic operation positions with the lowest probability in the behavior chain and the protocol interaction stages with the largest entropy value mutations.

[0177] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

Claims

1. A method for early warning of intrusion detection in railway communication networks, characterized in that, The method includes: Collect protocol session traffic from key nodes of the railway communication network and parse it to obtain session-level interaction data; Based on the session-level interaction data, extract the state transition features of the protocol session, calculate the dynamic information entropy value, and generate an entropy feature vector. Based on the session-level interaction data, a behavior chain sequence of the device is constructed, and the probability of the behavior chain is calculated using a decay-weighted N-Gram model. The network operation scenarios are divided by time-sensitive clustering, and a dynamic baseline library is established to store the entropy threshold baseline and behavior chain probability threshold baseline for each scenario. Parallel execution entropy deviation detection and behavior chain anomaly detection; When the entropy deviation detection and the behavior chain anomaly detection trigger alarms simultaneously, a high-confidence alarm is generated and the protection device is activated. The calculation of the behavioral chain probability using the decay-weighted N-Gram model includes: The behavior chain sequence consists of atomic operations, including at least two consecutive operations from GPS reporting, status query, and control response; The formula for calculating the probability of a behavioral chain is: Where P(chain) is the probability of the action chain, representing the probability of the current action chain occurring, and λ is the time decay factor. , This is the current timestamp. Let k be the timestamp of the occurrence of the k-th historical behavior chain. Let m be the timestamp of the occurrence of the m-th historical behavior chain. For historical behavior chains that are the same as the current behavior chain The occurrence count, K is the total number of historical chains matched, and M is the total number of all historical behavior chains within the time window.

2. The railway communication network early warning method based on intrusion detection according to claim 1, characterized in that, The calculation of the dynamic information entropy value includes: Define the set of valid transitions for the protocol state machine as follows: ,in, This represents the i-th type of state transition event; Based on the session-level interaction data, the probability of various transition events occurring in historical sessions is statistically analyzed to obtain the state transition probability distribution. ; For the state transition probability distribution, the entropy value is calculated using the following formula: Where H is the entropy value of the current session, and n is the total number of valid state transition types. Let be the probability of the i-th type of jump event occurring; Based on the entropy values ​​of each protocol interaction phase, an entropy feature vector is constructed, wherein the entropy feature vector is... ,in, This is the session entropy value during the authentication phase. This represents the session entropy value during the instruction interaction phase. The entropy value is the response delay distribution.

3. The railway communication network early warning method based on intrusion detection according to claim 1, characterized in that, The establishment of the dynamic baseline library includes: Based on the full historical session data of the first week, a global initial entropy threshold baseline vector and a global initial behavior chain probability threshold baseline are generated to perform a cold start during system initialization. Construct clustering feature vectors, and based on these clustering feature vectors, classify network states into three scenarios—daily scheduling, peak operation, and maintenance mode—using time-sensitive clustering. Historical session data is redistributed according to scene labels, and the entropy threshold baseline vector and behavior chain probability threshold baseline are calculated for each specific scene. The entropy threshold baseline vector for each specific scene is: , , , These represent the baseline entropy thresholds for the authentication phase, command interaction, and response latency, respectively. The baseline behavioral chain probability threshold for the specific scenario is: , This represents the average probability of the behavioral chain in the corresponding scenario. The standard deviation of the probability of the behavioral chain in the corresponding scenario; Each scenario has its own independent threshold baseline updated.

4. The railway communication network early warning method based on intrusion detection according to claim 3, characterized in that, The construction of clustering feature vectors includes: Extract traffic cycle characteristics, device online rate characteristics, and command type distribution characteristics within the current time window; Introducing a time decay factor generates a time-weighted current cluster feature vector: Where δ is the time decay factor, , As a characteristic of the flow cycle, For equipment online rate characteristics, For instruction type distribution characteristics, , To control the proportion of instructions, This represents the percentage of status queries. This represents the percentage of data reported.

5. The railway communication network early warning method based on intrusion detection according to claim 4, characterized in that, The network state is divided into three scenarios—daily scheduling, peak operation, and maintenance mode—using time-sensitive clustering, including: Initialize cluster centers for three types of scenarios, among which the daily scheduling center is: The peak operation center is: The maintenance mode center is: ,in, , , , , , All are historical sample statistical mean; Calculate the time-decayed Euclidean distance between the current cluster feature vector and the center of each scene: ， in, Represents the current cluster feature vector The a-th eigenvalue, Represents the center of the j-th scene. The a-th eigenvalue, j=1,2,3; Assign the current cluster feature vector to the scenario corresponding to the minimum distance; If the minimum distance is greater than θ, a temporary scene is created and manual review is initiated, where θ = 2 × historical average class spacing.

6. The railway communication network early warning method based on intrusion detection according to claim 2 or 3, characterized in that, The parallel execution entropy deviation detection and behavior chain anomaly detection include: Compare the entropy feature vector with the entropy threshold baseline of the current scene, calculate the entropy value deviation, and trigger a primary alarm if any entropy value deviation is greater than a preset deviation. The probability of the behavior chain is compared with the baseline threshold of the behavior chain probability in the current scene. If the probability of the behavior chain is less than the baseline threshold, a primary alarm is triggered.

7. The railway communication network early warning method based on intrusion detection according to claim 6, characterized in that, The calculation of entropy deviation includes: Calculate the entropy deviation for each stage using the following formula: Where x∈{auth, cmd, response}, for The time represents the entropy value during the authentication phase. for This represents the session entropy value during the authentication phase. for This represents the baseline entropy threshold for the authentication phase in the current scenario. for The time represents the entropy value of the command interaction. for This represents the session entropy value during the command interaction phase. for This represents the baseline entropy threshold during the instruction interaction phase of the current scenario. for The entropy value representing the response delay is in degrees. for , representing the entropy value of the response delay distribution. for , representing the baseline entropy threshold for the response latency of the current scenario.

8. The railway communication network early warning method based on intrusion detection according to claim 1, characterized in that, The generation of high-confidence alarms and the activation of protective devices include: When a high-confidence alarm is triggered, the abnormal session is automatically isolated; Based on the behavior chain sequence and entropy feature vector, a source tracing report is generated. The anomalies marked in the source tracing report include the atomic operation positions with the lowest probability in the behavior chain and the protocol interaction stages with the largest entropy value mutations.

9. A railway communication network early warning system based on intrusion detection, used to implement the railway communication network early warning method based on intrusion detection as described in any one of claims 1 to 8, characterized in that, The system includes: Data acquisition module: used to collect protocol session traffic of key nodes in the railway communication network and parse it to obtain session-level interaction data; Session entropy analysis module: used to extract state transition features of protocol sessions based on the session-level interaction data, calculate dynamic information entropy values, and generate entropy feature vectors; Behavior chain modeling module: used to construct the device's behavior chain sequence based on the session-level interaction data, and calculate the behavior chain probability using a decay-weighted N-Gram model; Dynamic baseline maintenance module: used to divide network operation scenarios through time-sensitive clustering, establish a dynamic baseline library, and store the entropy threshold baseline and behavior chain probability threshold baseline for each scenario; Parallel detection module: used for parallel execution of entropy deviation detection and behavioral chain anomaly detection; Joint early warning module: When the entropy deviation detection and behavior chain anomaly detection trigger alarms simultaneously, a high confidence alarm is generated and the protection equipment is activated.

Images