Abnormal event monitoring method for rail transit train control equipment

Abstract

The invention discloses an abnormal event monitoring method for rail transit train control equipment, and the method comprises the following steps: 1, collecting the related environment information of the rail transit train control equipment, and analyzing the environment information to obtain environment evaluation information; 2, the rail transit train control equipment is graded according to the environment evaluation information, equipment grading information is obtained, and the equipment grading information comprises first-level equipment, second-level equipment and third-level equipment; 3, different monitoring devices are selected according to the specific content of the device grading information to carry out abnormal event monitoring on the rail transit train control device, and abnormal monitoring information is obtained; and 4, analyzing and processing the abnormal monitoring information to obtain abnormal monitoring analysis information. According to the invention, more comprehensive abnormal event monitoring of the rail transit train control equipment can be carried out, so that the information safety of the rail transit train control equipment is better ensured.

Description

Technical Field

[0001] This invention relates to the field of information security protection, and specifically to a method for monitoring abnormal events in rail transit train control equipment. Background Technology

[0002] Rail transit train control equipment is a complex set of interconnected systems and devices designed to ensure the safe and efficient operation of trains on tracks. These devices include Automatic Train Control (ATC), onboard controllers, ground equipment, signaling equipment, and other auxiliary systems. Signal lights on rail transit trains are also a type of control equipment for rail transit trains. In actual use, attention needs to be paid to information security and abnormal event monitoring. Abnormal event monitoring methods are used in the process of abnormal monitoring of rail transit train control equipment.

[0003] Existing abnormal event monitoring methods only monitor a single type of abnormal event and cannot achieve comprehensive protection of information security for rail transit train control equipment, which has a certain impact on the use of abnormal event monitoring methods. Therefore, an abnormal event monitoring method for rail transit train control equipment is proposed. Summary of the Invention

[0004] The technical problem to be solved by this invention is: how to address the issue that existing abnormal event monitoring methods only monitor a single abnormal event and cannot achieve comprehensive protection of information security for rail transit train control equipment, which has a certain impact on the use of abnormal event monitoring methods. This invention provides an abnormal event monitoring method for rail transit train control equipment.

[0005] The present invention solves the above-mentioned technical problems through the following technical solution, and the present invention includes the following steps: Step 1: Collect relevant environmental information on rail transit train control equipment and analyze the environmental information to obtain environmental assessment information; Step 2: Classify the rail transit train control equipment according to the environmental assessment information to obtain equipment classification information, which includes Level 1 equipment, Level 2 equipment and Level 3 equipment; Step 3: Then, based on the specific content of the equipment classification information, select different monitoring devices to monitor abnormal events of the rail transit train control equipment and obtain abnormal monitoring information; Step 4: Analyze and process the anomaly monitoring information to obtain anomaly monitoring analysis information; Step 5: Simultaneously collect equipment access information from the rail transit train control equipment itself, analyze and process the equipment access information, and obtain relevant information on equipment anomaly monitoring. Step 6: Send the anomaly monitoring information and anomaly monitoring analysis information to the preset receiving terminal.

[0006] Furthermore, the specific processing procedure for the environmental assessment information is as follows: extract the relevant environmental information of the rail transit train control equipment. The relevant environmental information of the rail transit train control equipment includes the ambient temperature information, ambient humidity information, ambient dust concentration, ambient electromagnetic interference intensity and ambient green area information of the signal light equipment. The process of obtaining the ambient green area information is as follows: extract the center point position of the rail transit train control equipment, draw a circle with the center of the circle and a preset length as the radius to obtain the collection area, and then extract the green area within the collection area to obtain the ambient green area information. The system scores environmental temperature information, humidity information, dust concentration, electromagnetic interference intensity, and other factors. Environmental assessment information can be obtained by scoring environmental temperature, environmental humidity, environmental dust concentration, electromagnetic interference, and other factors.

[0007] Furthermore, the process for obtaining the environmental temperature score, environmental humidity score, environmental dust concentration score, electromagnetic interference score, and other factor scores is as follows: Ambient temperature information is extracted. The ambient temperature information is the temperature information of the environment of the rail transit train control equipment over the past six months. The average value is calculated to obtain the average temperature information. An ambient temperature score W is determined based on the magnitude of the average temperature information. When the average temperature information is within the preset range, W is the preset value a1. When the average temperature information is outside the preset range, W is the preset value a2. The temperature information within the six months is January, March, May, July, September and November or February, April, June, August, October and December, where a1 > a2. The ambient humidity information is extracted from the humidity information of the rail transit train control equipment over the past six months. The average value is calculated to obtain the average humidity information. An ambient humidity score S is determined based on the magnitude of the average humidity information. When the average humidity information is less than the preset value m1, S is the preset value b1. When the average humidity information is between the preset values ​​m1 and m2, S is the preset value b2. When the average humidity information is greater than the preset value m2, S is the preset value b3, where m1 < m2, b1 > b2 > b3. Environmental dust concentration information is extracted. This information is derived from the dust concentration data of the rail transit train control equipment over the past six months. The average value is calculated to obtain the average dust concentration information. An environmental dust concentration score F is determined based on the magnitude of the average dust concentration information. When the average dust concentration information is less than the preset value u1, F is the preset value c1. When the average dust concentration information is between the preset values ​​u1 and u2, F is the preset value c2. When the average dust concentration information is greater than the preset value u2, F is the preset value c3, where u1 < u2, c1 > c2 > c3. The environmental electromagnetic interference intensity is extracted. The environmental electromagnetic interference intensity is collected once every preset time interval, and the collection is repeated x times to obtain x environmental electromagnetic interference intensities. After removing the maximum and minimum values ​​of the x environmental electromagnetic interference intensities, the average value of the remaining x-2 environmental electromagnetic interference intensities is calculated, which is the average interference intensity. An electromagnetic interference score H is determined based on the magnitude of the average interference intensity. When the average interference intensity is less than the preset value v1, H is the preset value d1. When the average interference intensity is between the preset values ​​v1 and v2, H is the preset value d2. When the average interference intensity is greater than the preset value v2, H is the preset value d3, where v1 < v2, d1 > d2 > d3. Extract the area information of green plants in the environment, and formulate scores for other factors based on the size of the area information of green plants in the environment. When the average interference intensity is less than the preset value g1, P is the preset value e1. When the average interference intensity is between the preset values ​​g1 and g2, P is the preset value e2. When the average interference intensity is greater than the preset value g2, P is the preset value e3, where g1 < g2 and e1 > e2 > e3.

[0008] Furthermore, the specific processing procedure for the environmental assessment information is as follows: extract the collected environmental temperature score, environmental humidity score, environmental dust concentration score, electromagnetic interference score, and other factor scores, and label the environmental temperature score as T1, the environmental humidity score as T2, the environmental dust concentration score as T3, the electromagnetic interference score as T4, and the other factor scores as T5. Assign a correction value Q1 to T1, a correction value Q2 to T2, a correction value Q3 to T3, a correction value Q4 to T4, and a correction value Q5 to T5; Q4>Q5>Q2>Q3>Q1, Q4+Q5+Q2+Q3+Q1=1; The environmental assessment information can be obtained by using the formula T1*Q1+T2*Q2+T3*Q3+T4*Q4+T5*Q5=Tt.

[0009] Furthermore, the specific process of the equipment classification information is as follows: when the environmental assessment information is greater than the preset value w1, a level 1 device is generated; when the environmental assessment information is between the preset values ​​w1 and w2, a level 2 device is generated; and when the environmental assessment information is less than the preset value w2, a level 3 device is generated.

[0010] Furthermore, when the equipment is rated as a Level 1 equipment, the specific process of abnormal monitoring information is as follows: at least two communication monitoring devices and one image acquisition device are installed on the rail transit train control equipment to monitor communication abnormal events and abnormal events of the equipment itself. The communication anomaly events monitored by the communication monitoring equipment include the number of times the signal transmission strength of the rail transit train control equipment is less than the preset value within a preset time period, the number of times the fluctuation amplitude of the communication signal is greater than the preset amplitude, the number of times the information upload speed is less than the preset value, the number of times the information download speed is less than the preset value, the number of times the control equipment is accessed by unauthorized users, and the number of times the control equipment is attacked by the network. The abnormal communication events monitored by the two communication monitoring devices were extracted, the mean of each item was calculated, and the abnormal signal strength assessment parameters, abnormal communication fluctuation assessment parameters, abnormal upload assessment parameters, abnormal download assessment parameters, abnormal access assessment parameters, and abnormal attack assessment parameters were obtained. The abnormal events monitored by the image acquisition equipment include the number of times the brightness of the rail transit signal lights is less than the preset value within a preset time period, and the number of times the lighting content does not match the received control content. The abnormal monitoring information consists of parameters for signal strength anomaly assessment, communication fluctuation anomaly assessment, upload anomaly assessment, download anomaly assessment, abnormal access assessment, abnormal attack assessment, the number of times the signal light brightness is less than the preset value, and the number of times the light content does not match the received control content.

[0011] Furthermore, when the equipment is rated as a Level 2 equipment, the specific process of abnormal monitoring information is as follows: at least three communication monitoring devices and one image acquisition device are installed on the rail transit train control equipment to monitor communication abnormal events and abnormal events of the equipment itself. The communication anomaly events monitored by the communication monitoring equipment are the same as those monitored by the Level 1 equipment; The abnormal communication events monitored by three communication monitoring devices were extracted, the average value of each item was calculated, and the abnormal signal strength assessment parameters, abnormal communication fluctuation assessment parameters, abnormal upload assessment parameters, abnormal download assessment parameters, abnormal access assessment parameters, and abnormal attack assessment parameters were obtained. The content of abnormal event monitoring for the image acquisition equipment itself is the same as that for Level 1 equipment; The content of the anomaly monitoring information is the same as that of the Level 1 equipment.

[0012] Furthermore, when the equipment is rated as a Level 3 equipment, the specific process of abnormal monitoring information is as follows: at least four communication monitoring devices and one image acquisition device are installed on the rail transit train control equipment to monitor communication abnormal events and abnormal events of the equipment itself. The communication anomaly events monitored by the communication monitoring equipment are the same as those monitored by the Level 1 equipment; The communication anomaly events monitored by four communication monitoring devices were extracted, the mean of each item was calculated, and the signal strength anomaly assessment parameters, communication fluctuation anomaly assessment parameters, upload anomaly assessment parameters, download anomaly assessment parameters, abnormal access assessment parameters, and abnormal attack assessment parameters were obtained. The content of abnormal event monitoring for the image acquisition equipment itself is the same as that for Level 1 equipment; The content of the anomaly monitoring information is the same as that of the Level 1 equipment.

[0013] Furthermore, the anomaly monitoring and analysis information includes Level 1 anomalies, Level 2 anomalies, and Level 3 anomalies. The specific acquisition process of the anomaly monitoring and analysis information is as follows: extract the acquired anomaly monitoring information, and then extract the signal strength anomaly assessment parameters, communication fluctuation anomaly assessment parameters, upload anomaly assessment parameters, download anomaly assessment parameters, anomaly access assessment parameters, anomaly attack assessment parameters, the number of times the signal light brightness is less than the preset value, and the number of times the light content does not match the received control content. When the number of signal strength anomaly assessment parameters, communication fluctuation anomaly assessment parameters, upload anomaly assessment parameters, download anomaly assessment parameters, abnormal access assessment parameters, abnormal attack assessment parameters, the number of times the signal light brightness is less than the preset value, and the number of times the light content does not match the received control content is greater than 0 but less than the preset value r1, a level 1 anomaly is generated. When the number of signal strength anomaly assessment parameters, communication fluctuation anomaly assessment parameters, upload anomaly assessment parameters, download anomaly assessment parameters, abnormal access assessment parameters, abnormal attack assessment parameters, the number of times the signal light brightness is less than the preset value, and the number of times the light content does not match the received control content is greater than the preset value, a level 2 anomaly is generated. A Level 3 anomaly is generated when the number of parameters exceeding the preset values ​​in the following categories—signal strength anomaly assessment parameter, communication fluctuation anomaly assessment parameter, upload anomaly assessment parameter, download anomaly assessment parameter, abnormal access assessment parameter, abnormal attack assessment parameter, number of times the signal light brightness is less than the preset value, and number of times the light content does not match the received control content—is greater than r2.

[0014] Furthermore, the abnormal monitoring information includes relevant monitoring anomalies and relevant monitoring normalities. The specific processing procedure for the abnormal monitoring information is as follows: extract the collected device access information, which includes the real-time quantity information of access cables and the real-time quantity information of other devices wirelessly accessing the rail transit train control equipment. The difference between the real-time number of access cables and the preset standard number of access cables is calculated to obtain the cable access quantity difference. When the cable access quantity difference is a non-zero value, a notification message is generated to notify maintenance personnel to verify the access abnormal cables. When the verification is successful, no information is generated. When the verification fails, relevant monitoring abnormal information is generated. When the cable access quantity difference is 0, relevant monitoring normal information is generated. The difference between the real-time number of other devices connected to the rail transit train control equipment and the preset standard number of other devices is calculated to obtain the wireless access difference. When the wireless access difference is a non-zero value, a notification message is generated to notify maintenance personnel to verify the wireless access device. When the verification is successful, no information is generated. When the verification fails, relevant monitoring abnormal information is generated. When the wireless access difference is 0, relevant monitoring normal information is generated.

[0015] Compared with existing technologies, this invention has the following advantages: The abnormal event monitoring method for rail transit train control equipment analyzes the environment of the rail transit train control equipment (i.e., the signal lighting equipment) and assigns it different ratings. Based on these ratings, different numbers of related communication monitoring devices are set up to monitor the rail transit train control equipment with varying degrees of precision. This allows for more accurate detection of abnormal events, thus better ensuring the information security of the rail transit train control equipment. Simultaneously, the generated abnormal monitoring analysis information allows management personnel to understand the probability of abnormal events occurring, thereby enhancing information security protection measures and improving their effectiveness. Furthermore, by combining the analysis of the rail transit train control equipment's own information with device access information, it promptly detects whether there are any abnormal connections to the rail transit train control equipment, i.e., whether other devices abnormally connect to the signal lighting equipment, further understanding whether there are any information security anomalies in the rail transit train control equipment. This achieves more comprehensive abnormal event monitoring of rail transit train control equipment, making the system more worthy of widespread use. Attached Figure Description

[0016] Figure 1 This is the overall flowchart of the present invention. Detailed Implementation

[0017] The embodiments of the present invention are described in detail below. These embodiments are implemented based on the technical solution of the present invention, and provide detailed implementation methods and specific operation processes. However, the scope of protection of the present invention is not limited to the following embodiments.

[0018] like Figure 1 As shown, this embodiment provides a technical solution: a method for monitoring abnormal events in rail transit train control equipment, comprising the following steps: Step 1: Collect relevant environmental information on rail transit train control equipment and analyze the environmental information to obtain environmental assessment information; Step 2: Classify the rail transit train control equipment according to the environmental assessment information to obtain equipment classification information, which includes Level 1 equipment, Level 2 equipment and Level 3 equipment; Step 3: Then, based on the specific content of the equipment classification information, select different monitoring devices to monitor abnormal events of the rail transit train control equipment and obtain abnormal monitoring information; Step 4: Analyze and process the anomaly monitoring information to obtain anomaly monitoring analysis information; Step 5: Simultaneously collect equipment access information from the rail transit train control equipment itself, analyze and process the equipment access information, and obtain relevant information on equipment anomaly monitoring. Step Six: Send the anomaly monitoring information and anomaly monitoring analysis information to the preset receiving terminal; This invention analyzes the environment of rail transit train control equipment, specifically the signal lighting equipment, and assigns different ratings to it. Based on these ratings, different numbers of related communication monitoring devices are deployed to monitor the train control equipment with varying degrees of precision. This allows for more accurate detection of abnormal events, thus better ensuring the information security of the train control equipment. The generated anomaly monitoring and analysis information enables management personnel to understand the probability of abnormal events occurring, thereby improving and enhancing information security protection measures. Furthermore, by analyzing the equipment access information of the train control equipment itself, the invention promptly detects any abnormal access to the train control equipment, specifically to other devices connected to the signal lighting equipment, further revealing any information security anomalies and achieving more comprehensive monitoring of abnormal events in the train control equipment.

[0019] The specific processing procedure for the environmental assessment information is as follows: Extract the relevant environmental information of the rail transit train control equipment. The relevant environmental information of the rail transit train control equipment includes the ambient temperature information, ambient humidity information, ambient dust concentration, ambient electromagnetic interference intensity and ambient green area information of the signal light equipment. The process of obtaining the ambient green area information is as follows: Extract the center point position of the rail transit train control equipment, draw a circle with the center of the circle and a preset length as the radius to obtain the collection area, and then extract the green area within the collection area, that is, obtain the ambient green area information. The system scores environmental temperature information, humidity information, dust concentration, electromagnetic interference intensity, and other factors. Environmental assessment information can be obtained by scoring environmental temperature, environmental humidity, environmental dust concentration, electromagnetic interference, and other factors. Environmental assessment information can provide insights into the environment in which rail transit train control equipment, namely rail transit signaling equipment, is located. Analyzing this environment can reveal the probability of abnormal events occurring with the rail transit signaling equipment.

[0020] The process for obtaining the environmental temperature score, environmental humidity score, environmental dust concentration score, electromagnetic interference score, and other factor scores is as follows: The ambient temperature information is extracted. The ambient temperature information is the temperature information of the environment of the rail transit train control equipment in the past six months. The average value is calculated to obtain the average temperature information. An ambient temperature score W is determined based on the magnitude of the average temperature information. When the average temperature information is within the preset range, W is the preset value a1. When the average temperature information is outside the preset range, W is the preset value a2, where a1 > a2. The ambient humidity information is extracted from the humidity information of the rail transit train control equipment over the past six months. The average value is calculated to obtain the average humidity information. An ambient humidity score S is determined based on the magnitude of the average humidity information. When the average humidity information is less than the preset value m1, S is the preset value b1. When the average humidity information is between the preset values ​​m1 and m2, S is the preset value b2. When the average humidity information is greater than the preset value m2, S is the preset value b3, where m1 < m2, b1 > b2 > b3. Environmental dust concentration information is extracted. This information is derived from the dust concentration data of the rail transit train control equipment over the past six months. The average value is calculated to obtain the average dust concentration information. An environmental dust concentration score F is determined based on the magnitude of the average dust concentration information. When the average dust concentration information is less than the preset value u1, F is the preset value c1. When the average dust concentration information is between the preset values ​​u1 and u2, F is the preset value c2. When the average dust concentration information is greater than the preset value u2, F is the preset value c3, where u1 < u2, c1 > c2 > c3. The environmental temperature, humidity, and dust concentration information for the six months are for January, March, May, July, September, and November, or February, April, June, August, October, and December. This process can avoid the low reliability of the collected data caused by continuous collection. The environmental electromagnetic interference intensity is extracted. The environmental electromagnetic interference intensity is collected once at a preset time interval, and collected continuously for x times, x≥10, to obtain x environmental electromagnetic interference intensities. After removing the maximum and minimum values ​​of the x environmental electromagnetic interference intensities, the average value of the remaining x-2 environmental electromagnetic interference intensities is calculated, which is the average interference intensity. An electromagnetic interference score H is determined based on the magnitude of the average interference intensity. When the average interference intensity is less than the preset value v1, H is the preset value d1. When the average interference intensity is between the preset values ​​v1 and v2, H is the preset value d2. When the average interference intensity is greater than the preset value v2, H is the preset value d3, where v1<v2, d1>d2>d3. Extract the area information of green plants in the environment, and formulate scores for other factors based on the size of the area information of green plants in the environment. When the average interference intensity is less than the preset value g1, P is the preset value e1. When the average interference intensity is between the preset values ​​g1 and g2, P is the preset value e2. When the average interference intensity is greater than the preset value g2, P is the preset value e3, where g1 < g2 and e1 > e2 > e3.

[0021] The specific processing procedure for the environmental assessment information is as follows: extract the collected environmental temperature score, environmental humidity score, environmental dust concentration score, electromagnetic interference score and other factor scores, and mark the environmental temperature score as T1, the environmental humidity score as T2, the environmental dust concentration score as T3, the electromagnetic interference score as T4, and the other factor score as T5. Assign a correction value Q1 to T1, a correction value Q2 to T2, a correction value Q3 to T3, a correction value Q4 to T4, and a correction value Q5 to T5; Q4>Q5>Q2>Q3>Q1, Q4+Q5+Q2+Q3+Q1=1; The environmental assessment information can be obtained by using the formula T1*Q1+T2*Q2+T3*Q3+T4*Q4+T5*Q5=Tt. The specific process of the equipment classification information is as follows: when the environmental assessment information is greater than the preset value w1, a level 1 device is generated; when the environmental assessment information is between the preset values ​​w1 and w2, a level 2 device is generated; and when the environmental assessment information is less than the preset value w2, a level 3 device is generated. The reason why other factors score T5 has a large weight is that if there is a large amount of vegetation, there may be a large number of insects. Some insects are phototactic and will gather on the rail transit train control equipment, i.e., rail transit train signal lights. Too many insects gathering on the rail transit train control equipment, and the accumulation of some insect corpses will affect the heat dissipation of the equipment, which will lead to the equipment temperature rise and affect the stability of the equipment communication. Insects gnawing on cables will also lead to poor communication stability, which will affect the security of information transmission. Therefore, it is given the largest weight to affect the entire parameter, thereby ensuring the accuracy of the final equipment classification information. Through the above process, more accurate environmental assessment information is obtained, which enables us to understand the relevant monitoring of different levels of equipment with different levels of detail. This leads to better monitoring of abnormal events in rail transit train control equipment, thereby ensuring the information security protection of rail transit train control equipment and the stability of the equipment's safety status.

[0022] When the equipment is rated as a Level 1 equipment, the specific process of abnormal monitoring information is as follows: at least two communication monitoring devices and one image acquisition device are set up on the rail transit train control equipment to monitor communication abnormal events and abnormal events of the equipment itself. The communication anomaly events monitored by the communication monitoring equipment include the number of times the signal transmission strength of the rail transit train control equipment is less than the preset value within a preset time period, the number of times the fluctuation amplitude of the communication signal is greater than the preset amplitude, the number of times the information upload speed is less than the preset value, the number of times the information download speed is less than the preset value, the number of times the control equipment is accessed by unauthorized users, and the number of times the control equipment is attacked by the network. The abnormal communication events monitored by the two communication monitoring devices were extracted, the mean of each item was calculated, and the abnormal signal strength assessment parameters, abnormal communication fluctuation assessment parameters, abnormal upload assessment parameters, abnormal download assessment parameters, abnormal access assessment parameters, and abnormal attack assessment parameters were obtained. The abnormal events monitored by the image acquisition equipment include the number of times the brightness of the rail transit signal lights is less than the preset value within a preset time period, and the number of times the lighting content does not match the received control content. The abnormal monitoring information consists of parameters for signal strength anomaly assessment, communication fluctuation anomaly assessment, upload anomaly assessment, download anomaly assessment, abnormal access assessment, abnormal attack assessment, the number of times the signal light brightness is less than the preset value, and the number of times the light content does not match the received control content. When the equipment is rated as a Level 2 equipment, the specific process of abnormal monitoring information is as follows: at least three communication monitoring devices and one image acquisition device are set up on the rail transit train control equipment to monitor communication abnormal events and abnormal events of the equipment itself. The communication anomaly events monitored by the communication monitoring equipment are the same as those monitored by the Level 1 equipment; The abnormal communication events monitored by three communication monitoring devices were extracted, the average value of each item was calculated, and the abnormal signal strength assessment parameters, abnormal communication fluctuation assessment parameters, abnormal upload assessment parameters, abnormal download assessment parameters, abnormal access assessment parameters, and abnormal attack assessment parameters were obtained. The content of abnormal event monitoring for the image acquisition equipment itself is the same as that for Level 1 equipment; The content of the anomaly monitoring information is also the same as that of the Level 1 equipment; When the equipment is rated as a Level 3 equipment, the specific process of abnormal monitoring information is as follows: at least four communication monitoring devices and one image acquisition device are set up on the rail transit train control equipment to monitor communication abnormal events and abnormal events of the equipment itself. The communication anomaly events monitored by the communication monitoring equipment are the same as those monitored by the Level 1 equipment; The communication anomaly events monitored by four communication monitoring devices were extracted, the mean of each item was calculated, and the signal strength anomaly assessment parameters, communication fluctuation anomaly assessment parameters, upload anomaly assessment parameters, download anomaly assessment parameters, abnormal access assessment parameters, and abnormal attack assessment parameters were obtained. The content of abnormal event monitoring for the image acquisition equipment itself is the same as that for Level 1 equipment; The content of the anomaly monitoring information is the same as that of the Level 1 equipment.

[0023] Furthermore, the anomaly monitoring and analysis information includes Level 1 anomalies, Level 2 anomalies, and Level 3 anomalies. The specific acquisition process of the anomaly monitoring and analysis information is as follows: extract the acquired anomaly monitoring information, and then extract the signal strength anomaly assessment parameters, communication fluctuation anomaly assessment parameters, upload anomaly assessment parameters, download anomaly assessment parameters, anomaly access assessment parameters, anomaly attack assessment parameters, the number of times the signal light brightness is less than the preset value, and the number of times the light content does not match the received control content. When the number of signal strength anomaly assessment parameters, communication fluctuation anomaly assessment parameters, upload anomaly assessment parameters, download anomaly assessment parameters, abnormal access assessment parameters, abnormal attack assessment parameters, the number of times the signal light brightness is less than the preset value, and the number of times the light content does not match the received control content is greater than 0 but less than the preset value r1, a level 1 anomaly is generated. This indicates that the device has a relatively minor security risk, but relevant monitoring and maintenance are still required to ensure the information security and stable operation of the device. When the number of signal strength anomaly assessment parameters, communication fluctuation anomaly assessment parameters, upload anomaly assessment parameters, download anomaly assessment parameters, abnormal access assessment parameters, abnormal attack assessment parameters, the number of times the signal light brightness is less than the preset value, and the number of times the light content does not match the received control content are greater than the preset value, a level 2 anomaly is generated. A level 2 anomaly indicates that the device has certain information security risks and needs to be monitored. When the number of signal strength anomaly assessment parameters, communication fluctuation anomaly assessment parameters, upload anomaly assessment parameters, download anomaly assessment parameters, abnormal access assessment parameters, abnormal attack assessment parameters, the number of times the signal light brightness is less than the preset value, and the number of times the lit content does not match the received control content exceeds the preset value, a level three anomaly is generated. A level three anomaly indicates that the device has a significant information security risk and the device itself is abnormal, requiring close monitoring to prevent accidents from happening.

[0024] The abnormal monitoring information includes relevant monitoring anomalies and relevant monitoring normalities. The specific processing procedure for the abnormal monitoring information is as follows: extract the collected device access information, which includes the real-time quantity information of access cables and the real-time quantity information of other devices wirelessly accessing the rail transit train control equipment. The difference between the real-time number of access cables and the preset standard number of access cables is calculated to obtain the cable access quantity difference. When the cable access quantity difference is a non-zero value, a notification message is generated to notify maintenance personnel to verify the access abnormal cables. When the verification is successful, no information is generated. When the verification fails, relevant monitoring abnormal information is generated. When the cable access quantity difference is 0, relevant monitoring normal information is generated. The difference between the real-time number of other devices connected to the rail transit train control equipment and the preset standard number of other devices is calculated to obtain the wireless access difference. When the wireless access difference is a non-zero value, a notification message is generated to notify the maintenance personnel to verify the wireless access device. When the verification is successful, no information is generated. When the verification fails, relevant monitoring abnormal information is generated. When the wireless access difference is 0, relevant monitoring normal information is generated. Through the above process, it is possible to understand whether there are any abnormal wired or wireless accesses to the rail transit train control equipment, thereby achieving more comprehensive information security protection and abnormal event monitoring for the rail transit train control equipment.

[0025] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0026] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0027] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A method for monitoring abnormal events in rail transit train control equipment, characterized in that, Includes the following steps: Step 1: Collect relevant environmental information on rail transit train control equipment and analyze the environmental information to obtain environmental assessment information; Step 2: Classify the rail transit train control equipment according to the environmental assessment information to obtain equipment classification information, which includes Level 1 equipment, Level 2 equipment and Level 3 equipment; Step 3: Then, based on the specific content of the equipment classification information, select different monitoring devices to monitor abnormal events of the rail transit train control equipment and obtain abnormal monitoring information; Step 4: Analyze and process the anomaly monitoring information to obtain anomaly monitoring analysis information; Step 5: Simultaneously collect equipment access information from the rail transit train control equipment itself, analyze and process the equipment access information, and obtain relevant information on equipment anomaly monitoring. Step 6: Send the anomaly monitoring information and anomaly monitoring analysis information to the preset receiving terminal.

2. The method for monitoring abnormal events in rail transit train control equipment according to claim 1, characterized in that: The specific processing procedure for the environmental assessment information is as follows: Extract the relevant environmental information of the rail transit train control equipment. The relevant environmental information of the rail transit train control equipment includes the ambient temperature information, ambient humidity information, ambient dust concentration, ambient electromagnetic interference intensity and ambient green area information of the signal light equipment. The system scores environmental temperature information, humidity information, dust concentration, electromagnetic interference intensity, and other factors. Environmental assessment information can be obtained by scoring environmental temperature, environmental humidity, environmental dust concentration, electromagnetic interference, and other factors.

3. The method for monitoring abnormal events in rail transit train control equipment according to claim 2, characterized in that: The process for obtaining the environmental temperature score, environmental humidity score, environmental dust concentration score, electromagnetic interference score, and other factor scores is as follows: The ambient temperature information is extracted. The ambient temperature information is the temperature information of the environment of the rail transit train control equipment over the past six months. The average value is calculated to obtain the average temperature information. An ambient temperature score W is determined based on the magnitude of the average temperature information. The environmental humidity information is extracted. The environmental humidity information is the humidity information of the previous six months of the environment of the rail transit train control equipment. The average value is calculated to obtain the average humidity information. An environmental humidity score S is formulated based on the magnitude of the average humidity information. The environmental dust concentration information is extracted. The environmental dust concentration information is the dust concentration information of the past six months in the environment of the rail transit train control equipment. The mean value is calculated to obtain the average dust concentration information. An environmental dust concentration score F is formulated based on the magnitude of the average dust concentration information. The intensity of environmental electromagnetic interference is extracted. The intensity of environmental electromagnetic interference is collected once every preset time interval. After collecting x times, x environmental electromagnetic interference intensities are obtained. Then, the maximum and minimum values ​​of the x environmental electromagnetic interference intensities are removed, and the average value of the remaining x-2 environmental electromagnetic interference intensities is calculated, which is the average interference intensity. The electromagnetic interference score H is determined based on the magnitude of the average interference intensity. Extract the area information of green plants in the environment, and formulate scores for other factors based on the size of the area information of green plants in the environment.

4. The method for monitoring abnormal events in rail transit train control equipment according to claim 2, characterized in that: The specific processing procedure for the environmental assessment information is as follows: extract the collected environmental temperature score, environmental humidity score, environmental dust concentration score, electromagnetic interference score and other factor scores, and mark the environmental temperature score as T1, the environmental humidity score as T2, the environmental dust concentration score as T3, the electromagnetic interference score as T4, and the other factor score as T5. Assign a correction value Q1 to T1, a correction value Q2 to T2, a correction value Q3 to T3, a correction value Q4 to T4, and a correction value Q5 to T5; Q4>Q5>Q2>Q3>Q1, Q4+Q5+Q2+Q3+Q1=1; The environmental assessment information can be obtained by using the formula T1*Q1+T2*Q2+T3*Q3+T4*Q4+T5*Q5=Tt.

5. The method for monitoring abnormal events in rail transit train control equipment according to claim 1, characterized in that: The specific process of the equipment classification information is as follows: when the environmental assessment information is greater than the preset value w1, a level 1 device is generated; when the environmental assessment information is between the preset values ​​w1 and w2, a level 2 device is generated; and when the environmental assessment information is less than the preset value w2, a level 3 device is generated.

6. The method for monitoring abnormal events in rail transit train control equipment according to claim 1, characterized in that: When the equipment is rated as a Level 1 equipment, the specific process of abnormal monitoring information is as follows: at least two communication monitoring devices and one image acquisition device are set up on the rail transit train control equipment to monitor communication abnormal events and abnormal events of the equipment itself. The communication anomaly events monitored by the communication monitoring equipment include the number of times the signal transmission strength of the rail transit train control equipment is less than the preset value within a preset time period, the number of times the fluctuation amplitude of the communication signal is greater than the preset amplitude, the number of times the information upload speed is less than the preset value, the number of times the information download speed is less than the preset value, the number of times the control equipment is accessed by unauthorized users, and the number of times the control equipment is attacked by the network. The abnormal communication events monitored by the two communication monitoring devices were extracted, the mean of each item was calculated, and the abnormal signal strength assessment parameters, abnormal communication fluctuation assessment parameters, abnormal upload assessment parameters, abnormal download assessment parameters, abnormal access assessment parameters, and abnormal attack assessment parameters were obtained. The abnormal events monitored by the image acquisition equipment include the number of times the brightness of the rail transit signal lights is less than the preset value within a preset time period, and the number of times the lighting content does not match the received control content. The abnormal monitoring information consists of parameters for signal strength anomaly assessment, communication fluctuation anomaly assessment, upload anomaly assessment, download anomaly assessment, abnormal access assessment, abnormal attack assessment, the number of times the signal light brightness is less than the preset value, and the number of times the light content does not match the received control content.

7. The method for monitoring abnormal events in rail transit train control equipment according to claim 1, characterized in that: When the equipment is rated as a Level 2 equipment, the specific process of abnormal monitoring information is as follows: at least three communication monitoring devices and one image acquisition device are set up on the rail transit train control equipment to monitor communication abnormal events and abnormal events of the equipment itself. The communication anomaly events monitored by the communication monitoring equipment are the same as those monitored by the Level 1 equipment; The abnormal communication events monitored by three communication monitoring devices were extracted, the average value of each item was calculated, and the abnormal signal strength assessment parameters, abnormal communication fluctuation assessment parameters, abnormal upload assessment parameters, abnormal download assessment parameters, abnormal access assessment parameters, and abnormal attack assessment parameters were obtained. The content of abnormal event monitoring for the image acquisition equipment itself is the same as that for Level 1 equipment; The content of the anomaly monitoring information is the same as that of the Level 1 equipment.

8. The method for monitoring abnormal events in rail transit train control equipment according to claim 1, characterized in that: When the equipment is rated as a Level 3 equipment, the specific process of abnormal monitoring information is as follows: at least four communication monitoring devices and one image acquisition device are set up on the rail transit train control equipment to monitor communication abnormal events and abnormal events of the equipment itself. The communication anomaly events monitored by the communication monitoring equipment are the same as those monitored by the Level 1 equipment; The communication anomaly events monitored by four communication monitoring devices were extracted, the mean of each item was calculated, and the signal strength anomaly assessment parameters, communication fluctuation anomaly assessment parameters, upload anomaly assessment parameters, download anomaly assessment parameters, abnormal access assessment parameters, and abnormal attack assessment parameters were obtained. The content of abnormal event monitoring for the image acquisition equipment itself is the same as that for Level 1 equipment; The content of the anomaly monitoring information is the same as that of the Level 1 equipment.

9. The method for monitoring abnormal events in rail transit train control equipment according to claim 1, characterized in that: The anomaly monitoring and analysis information includes Level 1 anomalies, Level 2 anomalies, and Level 3 anomalies. The specific acquisition process of the anomaly monitoring and analysis information is as follows: extract the acquired anomaly monitoring information, and then extract the signal strength anomaly assessment parameters, communication fluctuation anomaly assessment parameters, upload anomaly assessment parameters, download anomaly assessment parameters, anomaly access assessment parameters, anomaly attack assessment parameters, the number of times the signal light brightness is less than the preset value, and the number of times the light content does not match the received control content. When the number of signal strength anomaly assessment parameters, communication fluctuation anomaly assessment parameters, upload anomaly assessment parameters, download anomaly assessment parameters, abnormal access assessment parameters, abnormal attack assessment parameters, the number of times the signal light brightness is less than the preset value, and the number of times the light content does not match the received control content is greater than 0 but less than the preset value r1, a level 1 anomaly is generated. When the number of signal strength anomaly assessment parameters, communication fluctuation anomaly assessment parameters, upload anomaly assessment parameters, download anomaly assessment parameters, abnormal access assessment parameters, abnormal attack assessment parameters, the number of times the signal light brightness is less than the preset value, and the number of times the light content does not match the received control content is greater than the preset value, a level 2 anomaly is generated. A Level 3 anomaly is generated when the number of parameters exceeding the preset values ​​in the following categories—signal strength anomaly assessment parameter, communication fluctuation anomaly assessment parameter, upload anomaly assessment parameter, download anomaly assessment parameter, abnormal access assessment parameter, abnormal attack assessment parameter, number of times the signal light brightness is less than the preset value, and number of times the light content does not match the received control content—is greater than r2.

10. The method for monitoring abnormal events in rail transit train control equipment according to claim 1, characterized in that: The abnormal monitoring information includes relevant monitoring anomalies and relevant monitoring normalities. The specific processing procedure for the abnormal monitoring information is as follows: extract the collected device access information, which includes the real-time quantity information of access cables and the real-time quantity information of other devices wirelessly accessing the rail transit train control equipment. The difference between the real-time number of access cables and the preset standard number of access cables is calculated to obtain the cable access quantity difference. When the cable access quantity difference is a non-zero value, a notification message is generated to notify maintenance personnel to verify the access abnormal cables. When the verification is successful, no information is generated. When the verification fails, relevant monitoring abnormal information is generated. When the cable access quantity difference is 0, relevant monitoring normal information is generated. The difference between the real-time number of other devices connected to the rail transit train control equipment and the preset standard number of other devices is calculated to obtain the wireless access difference. When the wireless access difference is a non-zero value, a notification message is generated to notify maintenance personnel to verify the wireless access device. When the verification is successful, no information is generated. When the verification fails, relevant monitoring abnormal information is generated. When the wireless access difference is 0, relevant monitoring normal information is generated.

Images