Device, method, medium and equipment for guaranteeing safe operation of rail transit signal system

Abstract

The invention discloses a method and a device for guaranteeing safe operation of a rail transit signal system. The method comprises the following steps of: S1, respectively acquiring original data from network safety equipment and a signal service system through a data acquisition module, and carrying out standardization processing on the original data; s2, in the cross-domain analysis engine, pre-constructing an asset portrait library comprising network security equipment, a signal service system and application service through an asset portrait management sub-module, and pre-configuring a dynamic association rule of each asset object and an asset relationship thereof through an association rule management sub-module; and S3, running the standardized data in a cross-domain analysis engine, sensing the data type through a real-time analysis sub-module, analyzing network security data and service system data, and further driving forward association processing of the network security data and reverse traceability processing of the service system data in parallel. According to the invention, deep collaboration of network security protection and a service operation and maintenance system can be realized, and the method has the advantage of adapting to dynamic services.

Description

Technical Field

[0001] This invention relates to the field of urban rail transit operation safety technology, and in particular to a device, method, medium and equipment for ensuring the safe operation of rail transit signaling systems. Background Technology

[0002] Urban rail transit signaling systems are the core systems controlling the safe and efficient operation of trains, and their reliability is directly related to public safety and operational order. As these systems evolve towards greater networking and intelligence, the cybersecurity risks they face are becoming increasingly prominent. The frequent occurrence of advanced persistent threats and cyberattacks targeting industrial control systems makes rail transit signaling systems, a critical information infrastructure, a potential target. Cyber ​​intrusions or malicious interference can lead to abnormal train operation control commands and operational disruptions, resulting in delays, service stoppages, and even safety accidents, posing a serious threat to socio-economic development and public safety.

[0003] To address the aforementioned risks, existing technical solutions typically deploy two independent protection systems in parallel: on the one hand, a network security protection system consisting of firewalls, intrusion detection systems, and security auditing systems is deployed, focusing on defending against network layer attacks; on the other hand, an independent business operation and maintenance system (such as a monitoring system, a data acquisition and monitoring control system, and an intelligent operation and maintenance platform) is established to monitor the operational status and functional logic of business equipment such as switches, signals, and vehicle controllers. However, in actual operation and maintenance, these two systems generally have coordination barriers, presenting a fragmented state, resulting in low overall security effectiveness. Specific defects include: 1. Lack of information fusion leads to misjudgment of risks: Security alarms generated by network security devices (such as abnormal connections and malicious code activity) and operational anomalies reported by business systems (such as inconsistent turnout display, train-to-ground communication timeouts, and signal drive failures) are displayed and processed on different platforms, lacking deep correlation analysis based on business semantics. Security operations personnel struggle to determine whether a network attack has substantially impacted train control operations, while business operations personnel are unable to perceive the potential network security threats behind functional anomalies. This information silo phenomenon directly leads to inaccurate prioritization of emergency response, resulting in either overreaction and wasted resources or delayed response and amplified risks.

[0004] 2. Fragmented handling processes reduce response efficiency: When system anomalies occur, the business operations team typically follows functional logic for fault location and recovery, lacking the ability to trace the source of cybersecurity threats. Consequently, when handling security incidents, the security team also struggles to quickly and accurately assess their specific impact on train operation safety and efficiency, and to formulate effective business coordination instructions. This disconnect in handling actions significantly prolongs system recovery time when facing complex failures caused by cyberattacks, severely impacting operational continuity.

[0005] 3. Static defense strategies are ill-suited to dynamic business needs: Traditional network security strategies are mostly based on static rules or general models, lacking the ability to perceive and adapt to dynamic changes in the internal business logic of the signal system (such as operational diagram adjustments, online device deployment and decommissioning, and network topology reconstruction). This leads to gaps between security protection rules and real-time business requirements, causing the protection system to lag behind business development and fail to effectively cope with targeted attacks against new business scenarios.

[0006] Existing improvements, such as log aggregation via the Syslog protocol or simple integration of some business logs into the security operations center platform, while achieving initial data centralization to some extent, are essentially one-way information collection and passive post-event analysis. These methods fail to build a collaborative handling mechanism that can understand business context, support two-way information linkage and intelligent decision-making, and therefore cannot fundamentally solve the problem of deep collaboration between network security and business operations.

[0007] Therefore, a long-standing technical challenge for those skilled in the art is how to break down the barriers between network security protection and business operations in existing technologies, and build an integrated protection solution that can achieve deep data fusion, risk linkage analysis, and collaborative closed-loop handling, so as to systematically improve the overall resilience, operational efficiency, and recovery capabilities of urban rail transit signaling systems in the face of complex network threats.

[0008] The statements herein provide only background information in relation to the present invention and do not necessarily constitute prior art. Summary of the Invention

[0009] The purpose of this invention is to provide a device, method, medium, and equipment to ensure the safe operation of a rail transit signaling system, which can solve the problems of difficulty in coordinating network security protection and business operation and maintenance systems, fragmented handling processes, and difficulty in adapting to dynamic business in existing urban rail transit signaling systems.

[0010] To achieve the above objectives, the present invention provides a method for ensuring the safe operation of a rail transit signaling system, comprising the following steps: Step S1: Collect raw data from network security equipment and signal service system respectively through data acquisition module and perform standardization processing; Step S2: Within the cross-domain analysis engine, an asset profile library containing network security devices, signal service systems, and application services is pre-built through the asset profile management sub-module, and dynamic association rules for each asset object and its asset relationships are pre-configured through the association rule management sub-module. Step S3: Run the standardized data within the cross-domain analysis engine. The data type is perceived through the real-time analysis submodule, and network security data and business system data are parsed out. Then, the forward correlation processing of the network security data and the reverse tracing processing of the business system data are driven in parallel.

[0011] Optionally, the secure operation method further includes: step S4, continuously optimizing the cross-domain analysis engine through the disposal execution monitoring module; and monitoring and validating the execution process of the collaborative execution module.

[0012] Optionally, the secure operation method further includes: step S5, displaying global information after associating network security devices and signal service systems through a unified management portal, so as to display security alarms and service alarm information in real time, and track the process of forward association handling and reverse tracing handling.

[0013] Optionally, in step S1, the raw data collected from the network security device includes: firewall session logs, intrusion detection / prevention system alarms, antivirus events, and network traffic probe data; The raw data collected from the signaling system includes: status events of the automatic train monitoring system, communication messages of the automatic train protection system, control commands and status feedback of the computer interlocking system, and performance indicators of the data communication system.

[0014] Optionally, in step S2, the asset relationship includes: the network attributes, business attributes, and topological relationships between each asset object.

[0015] Optionally, the positive correlation processing of network security data in step S3 includes: S301, through the first real-time analysis submodule, perceives and parses network security data, and extracts network feature vectors representing network alarm events from it; S302, the network feature vector is matched with the dynamic association rule, and the threatened business objects and business functions are mapped through the configured dynamic association rule. A first handling decision instruction is generated through the first decision generation submodule. The first handling decision instruction is converted into a recognizable third handling decision instruction through the instruction converter. The third handling decision instruction contains comprehensive security risk warning information that integrates network alarm events and corresponding business risks. S303 After receiving the comprehensive security risk warning information, the collaborative execution module performs security isolation to the network security device through the security-side actuator, and at the same time sends instructions to the business operation and maintenance platform of the signal business system to reduce business risks through the business-side actuator.

[0016] Optionally, the network feature vector includes at least the attack source IP address, target IP address, target port, and protocol type.

[0017] Optionally, the reverse tracing process for business system data in step S3 includes: S311 uses the second real-time analysis submodule to perceive and parse business system data, and filters out suspicious business events from it; S312, backtrack historical security data for suspicious business events, identify the network security object that caused the suspicious business event through the configured dynamic association, and generate a second handling decision instruction through the second decision generation submodule. The second handling decision instruction is converted into a recognizable fourth handling decision instruction through the instruction converter. The fourth handling decision instruction contains comprehensive business risk warning information that integrates the suspicious business event and the corresponding network security risk. S313 After receiving the comprehensive business risk warning information, the collaborative execution module performs fault repair on the signal business system through the business-side executor, and at the same time performs security hardening on the network security equipment through the security-side executor.

[0018] Optionally, the suspicious service events include: service events that are not obvious hardware failures, or those caused by underlying network or security issues.

[0019] Optionally, step S4 includes the following steps: S4.1, continuously optimizes the dynamic association rules in the association rule management submodule by using the machine learning algorithm built into the execution monitoring module; S4.2 The execution process of steps S303 and S313 is monitored and verified by the disposal execution monitoring module, and the disposal log generated in the monitoring is fed back to the security side executor and the business side executor to verify whether the security side executor and the business side executor have executed effective instructions to reduce security risks and business risks.

[0020] The present invention also provides an apparatus for ensuring the safe operation of a rail transit signaling system, used to implement the aforementioned safe operation method. The apparatus includes: a data acquisition module, a cross-domain analysis engine, and a collaborative execution module. The data acquisition module is communicatively connected to network security equipment and signal service system. The data acquisition module is configured to collect raw data from network security equipment and signal service system, and perform standardized processing to obtain network security data and service system data. The cross-domain analysis engine is communicatively connected to the data acquisition module and is configured to perform forward correlation analysis on standardized network security data and reverse source tracing analysis on business system data based on preset dynamic correlation rules, and generate disposal decision instructions. The collaborative execution module is communicatively connected to the cross-domain analysis engine and is configured to receive the handling decision instructions and send security operation instructions to the business operation and maintenance platform of network security equipment and signal service system.

[0021] Optionally, the device for secure operation further includes: a disposal execution monitoring module and a unified management portal; The disposal execution monitoring module is communicatively connected to the cross-domain analysis engine to optimize dynamic association rules based on machine learning algorithms within the disposal execution monitoring module; the disposal execution monitoring module is also communicatively connected to the collaborative execution module to feed back the generated disposal logs to the collaborative execution module to verify whether it has executed effective risk reduction instructions; The unified management portal communicates with the cross-domain analysis engine and collaborative execution module to provide global situation visualization, manual intervention interface and system configuration management functions.

[0022] Optionally, the cross-domain analytics engine includes: The asset profile management submodule is used to pre-store asset objects, including network security equipment, signal service systems and application services, and their asset relationships, and form an asset profile library; The association rule management submodule is communicatively connected to the asset profile management submodule and is used to pre-configure dynamic association rules for each asset object and its asset relationships. The real-time analysis submodule is connected to the data acquisition module and the association rule management submodule, respectively. It can call standardized network security data and business system data, as well as call the dynamic association rules in the association rule management submodule to perform positive association processing and reverse tracing processing. The decision generation submodule communicates with the real-time analysis submodule to generate a decision instruction from the execution results of the forward correlation processing and the reverse tracing processing.

[0023] Optionally, the real-time analysis submodule includes: a first real-time analysis submodule and a second real-time analysis submodule; The first real-time analysis submodule is communicatively connected to both the data acquisition module and the association rule management submodule to sense network security data and extract network feature vectors, and then perform positive association processing on the standardized network security data. The second real-time analysis submodule is communicatively connected to both the data acquisition module and the association rule management submodule to sense business system data and then perform reverse tracing processing on the standardized business system data.

[0024] Optionally, the decision generation submodule includes: a first decision generation submodule and a second decision generation submodule; The first decision generation submodule is communicatively connected to the first real-time analysis submodule to generate a first disposal decision instruction in the positive correlation disposal; the second decision generation submodule is communicatively connected to the second real-time analysis submodule to generate a second disposal decision instruction in the reverse tracing disposal.

[0025] Optionally, the collaborative execution module includes: The instruction converter is communicatively connected to both the first and second decision generation submodules. It is used to convert various disposal decision instructions into command formats that can be recognized by network security devices and business operation and maintenance platforms, that is, to convert the first disposal decision instruction into a recognizable third disposal decision instruction and to convert the second disposal decision instruction into a recognizable fourth disposal decision instruction. The security-side actuator, which is communicatively connected to the instruction converter, is used to receive identifiable third-party action decision instructions and send policy configuration, isolation, or blocking instructions to the network security device. The service-side executor is communicatively connected to the instruction converter and is used to receive identifiable fourth-handling decision instructions and send instructions to the service operation and maintenance platform of the signal service system to reduce service risks or to perform fault repair on the signal service system.

[0026] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the aforementioned secure operation method.

[0027] The present invention also provides an electronic device including a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the secure operation method described above is implemented.

[0028] In summary, compared with the prior art, the present invention has the following beneficial effects: 1. The present invention provides a device, method, medium and equipment for ensuring the safe operation of a rail transit signaling system, which breaks down the barriers between security and business, transforms from "passive defense" to "active protection", enhances the active defense and network security resilience of the signaling system, and builds an integrated operation protection system.

[0029] 2. The present invention provides a device, method, medium and equipment for ensuring the safe operation of a rail transit signaling system. Through bidirectional dynamic correlation mapping, it automatically completes the mutual correlation between safety events and business impacts, greatly shortens the fault location time and reduces repeated troubleshooting.

[0030] 3. The present invention provides a device, method, medium, and equipment for ensuring the safe operation of a rail transit signaling system. On the network security side, it utilizes cross-domain data fusion technology and then uses an intelligent rule engine to dynamically map the data to specific business systems that may be affected in real time, and proactively pushes accurate risk warnings to the business side. On the business side, when a business performance alarm or failure occurs, the system can automatically trace back to the source, analyze and correlate it to the underlying network security vulnerabilities, and send reinforcement instructions to the security side. This achieves automated linkage of handling actions, enabling security protection to respond to business anomalies in a timely manner, and business operations to avoid security risks in advance, forming a collaborative closed loop, and significantly improving the overall risk resistance and recovery capabilities of the system. Attached Figure Description

[0031] Figure 1 This is an operational diagram of the method for ensuring the safe operation of a rail transit signaling system according to the present invention; Figure 2 The block diagram of the device for ensuring the safe operation of a rail transit signaling system according to the present invention is shown. Detailed Implementation

[0032] The following will be combined with the appendix Figures 1-2 The present invention will be further described in detail through preferred embodiments. The advantages and features of the present invention will become clearer from the following description. It should be noted that the accompanying drawings are in a very simplified form and use non-precise proportions, only for the purpose of conveniently and clearly illustrating the embodiments of the present invention. Please refer to the accompanying drawings to make the objectives, features, and advantages of the present invention more apparent and understandable. It should be understood that the structures, proportions, sizes, etc., depicted in the accompanying drawings are only for the purpose of assisting those skilled in the art in understanding and reading the content disclosed in the specification, and are not intended to limit the implementation conditions of the present invention. Therefore, they have no substantial technical significance. Any modifications to the structure, changes in the proportional relationships, or adjustments to the size, without affecting the effects and objectives achieved by the present invention, should still fall within the scope of the technical content disclosed in the present invention.

[0033] like Figure 2 As shown, the present invention provides a device for ensuring the safe operation of a rail transit signaling system, comprising: a data acquisition module, a cross-domain analysis engine, a collaborative execution module, a disposal execution monitoring module, and a unified management portal.

[0034] The data acquisition module is communicatively connected to network security equipment and signal service system. The data acquisition module is configured to collect raw data from network security equipment and signal service system through data interface, and perform standardized processing to obtain network security data and service system data.

[0035] The network security equipment mentioned can be firewalls, IDS (Intrusion Detection Systems), SWITCH (Switches), etc.

[0036] The signaling service system may be an automatic train monitoring system, an automatic train protection system, etc.

[0037] The data interface supports access to various heterogeneous data sources, including network management protocols (such as SNMP Trap), log protocols (such as Syslog), application programming interfaces (such as RESTful API), and industrial communication standards (such as OPC UA). After completing data acquisition, the data acquisition module also needs to perform data standardization processing, specifically including: cleaning, formatting, and field mapping.

[0038] The cross-domain analysis engine is communicatively connected to the data acquisition module and is configured to perform forward correlation analysis on standardized network security data and reverse source tracing analysis on business system data based on preset dynamic correlation rules, and generate disposal decision instructions.

[0039] This cross-domain analysis engine includes: an asset profiling management submodule, used to pre-store asset objects and their asset relationships, including network security equipment, signal service systems, and application services, forming an asset profiling library; an association rule management submodule, communicatively connected to the asset profiling management submodule, used to pre-configure dynamic association rules for each asset object and its asset relationships; a real-time analysis submodule, communicatively connected to both the data acquisition module and the association rule management submodule, capable of calling standardized network security data and business system data, as well as calling dynamic association rules in the association rule management submodule, for positive association handling and reverse tracing handling; and a decision generation submodule, communicatively connected to the real-time analysis submodule, to generate handling decision instructions (such as generating risk warnings, generating blocking instructions, etc.) from the execution results of positive association handling and reverse tracing handling.

[0040] Furthermore, the real-time analysis submodule includes: a first real-time analysis submodule and a second real-time analysis submodule; the first real-time analysis submodule is communicatively connected to both the data acquisition module and the association rule management submodule to sense network security data and extract network feature vectors, and then perform positive association processing on the standardized network security data; the second real-time analysis submodule is communicatively connected to both the data acquisition module and the association rule management submodule to sense business system data, and then perform reverse tracing processing on the standardized business system data.

[0041] Furthermore, the decision generation submodule includes: a first decision generation submodule and a second decision generation submodule; the first decision generation submodule is communicatively connected to the first real-time analysis submodule to generate a first disposal decision instruction in positive correlation disposal; the second decision generation submodule is communicatively connected to the second real-time analysis submodule to generate a second disposal decision instruction in reverse tracing disposal.

[0042] The collaborative execution module is communicatively connected to the decision generation submodule of the cross-domain analysis engine and is configured to receive the disposal decision instructions generated by the decision generation submodule and send security operation instructions to the business operation and maintenance platform of network security equipment and signal service system.

[0043] The collaborative execution module includes: an instruction converter, which is communicatively connected to both the first and second decision generation submodules, for converting various handling decision instructions into command formats recognizable by network security devices and business operation and maintenance platforms, i.e., converting the first handling decision instruction into a recognizable third handling decision instruction, and converting the second handling decision instruction into a recognizable fourth handling decision instruction; a security-side executor, which is communicatively connected to the instruction converter, for receiving the recognizable third handling decision instruction and sending policy configuration, isolation, or blocking instructions to network security devices; and a business-side executor, which is communicatively connected to the instruction converter, for receiving the recognizable fourth handling decision instruction and sending instructions to reduce business risks or perform fault repair on the signal service system to the business operation and maintenance platform of the signal service system.

[0044] The disposal execution monitoring module is communicatively connected to the association rule management submodule of the cross-domain analysis engine to optimize dynamic association rules based on machine learning algorithms within the disposal execution monitoring module. The disposal execution monitoring module is also communicatively connected to the security-side executor and business-side executor within the collaborative execution module to feed back the generated disposal logs to the security-side executor and business-side executor to verify whether the security-side executor and business-side executor have executed effective instructions to reduce security and business risks.

[0045] The unified management portal communicates with the cross-domain analysis engine and collaborative execution module to provide global situation visualization, manual intervention interface and system configuration management functions.

[0046] Specifically, the global situation visualization includes visualization of real-time alarm information, handling process tracking, asset profile database information, etc.; the manual intervention interface supports confirmation, approval, and one-click issuance of automatically generated handling decision instructions, taking into account both automation and manual supervision; the system configuration management includes configuration management of dynamic association rules and asset profile database.

[0047] like Figure 1 As shown, the present invention also provides a method for achieving safe operation of a rail transit signaling system through the aforementioned safe operation device. Its core lies in constructing a two-way closed-loop processing flow of "safety-driven operation" and "operation-driven safety." This safe operation method includes the following steps: Step S1: Collect raw data from network security equipment and signal service system respectively through data acquisition module and perform standardization processing.

[0048] The raw data collected from the network security devices includes: firewall session logs, intrusion detection / prevention system (IDS / IPS) alarms, antivirus events, and network traffic probe data.

[0049] The raw data collected from the signaling system includes: Automatic Train Monitoring (ATS) system status events, Automatic Train Protection (ATP) system communication messages, Computer Interlocking (CI) system control commands and status feedback, and Data Communication System (DCS) performance indicators.

[0050] The standardization process includes cleaning, formatting, and mapping the raw data according to a predefined standardization paradigm, and unifying the formats of key fields such as timestamps, protocol types, and IP addresses to provide data support for cross-domain (network security domain and business system domain) correlation analysis.

[0051] Step S2: Within the cross-domain analysis engine, an asset profile library containing network security devices, signal service systems, and application services is pre-built through the asset profile management submodule, and dynamic association rules for each asset object and its asset relationships are pre-configured through the association rule management submodule.

[0052] The asset relationships include: the network attributes, business attributes, and topological relationships between each asset object.

[0053] Step S3: Run the standardized data within the cross-domain analysis engine. The data type is perceived through the real-time analysis submodule, and network security data and business system data are parsed out. Then, the forward correlation processing of the network security data and the reverse tracing processing of the business system data are driven in parallel.

[0054] Specifically, the positive correlation processing of the network security data includes: S301, the first real-time analysis submodule senses and parses network security data, and extracts network feature vectors representing network alarm events from it; the network feature vectors include at least the attack source IP address, target IP address, target port and protocol type.

[0055] S302, the network feature vector is matched with the dynamic association rule, and the threatened business objects and business functions are mapped through the configured dynamic association rule. A first handling decision instruction is generated through the first decision generation submodule. The first handling decision instruction is converted into a recognizable third handling decision instruction through the instruction converter. The third handling decision instruction contains comprehensive security risk warning information that integrates network alarm events and corresponding business risks.

[0056] S303, after receiving the comprehensive security risk warning information, the collaborative execution module performs security isolation on the network security device through the security side executor (such as isolating the infected host and blocking the IP address of the attack source), and at the same time sends an instruction to the business operation and maintenance platform of the signal business system to reduce business risks through the business side executor. The business operation and maintenance platform provides a contingency plan to reduce business risks.

[0057] Specifically, the reverse tracing process for events in the business system includes: S311 uses the second real-time analysis submodule to perceive and parse business system data, and filters out suspicious business events from it; The suspicious business events include: business events that are not obvious hardware failures or are suspected to be caused by underlying network or security issues.

[0058] S312, backtrack historical security data for suspicious business events, identify the network security object that caused the suspicious business event through the configured dynamic association, and generate a second handling decision instruction through the second decision generation submodule. The second handling decision instruction is converted into a recognizable fourth handling decision instruction through the instruction converter. The fourth handling decision instruction contains comprehensive business risk warning information that integrates the suspicious business event and the corresponding network security risk.

[0059] Specifically, the backtracking process involves checking whether the suspicious business event was subjected to network scanning, whether there were abnormal login logs, and whether the traffic was abnormal before the business failure occurred.

[0060] S313 After receiving the comprehensive business risk warning information, the collaborative execution module performs fault repair on the signal business system through the business side executor (such as restarting the service or switching the link in the business operation and maintenance platform), and at the same time performs security hardening on the network security device through the security side executor (such as issuing a policy to the firewall to immediately discard ICMP data packets sent to the ATS server; or commanding the terminal security management software to perform virus scanning and removal on the server).

[0061] Step S4 involves continuously optimizing the cross-domain analysis engine through the execution monitoring module and monitoring and validating the execution process of the collaborative execution module.

[0062] Specifically, step S4 includes: S4.1, continuously optimizes the dynamic association rules in the association rule management submodule by using the machine learning algorithm built into the execution monitoring module; S4.2 The execution process of steps S303 and S313 is monitored and verified by the execution monitoring module. During the monitoring, a disposal log is generated to characterize the execution process and disposal effect. The disposal log is fed back to the security side executor and the business side executor to verify whether the security side executor and the business side executor have executed effective instructions to reduce security risks and business risks.

[0063] Step S5: Display global information on associated network security devices and signal service systems through the unified management portal to display security alarms and service alarms in real time, and track the processes of forward correlation handling and reverse tracing handling.

[0064] The following will provide the implementation process of the safe operation method of the present invention in a specific scenario.

[0065] For business alerts triggered by network alarm events and network security hardening triggered by business anomalies, this method for ensuring the safe operation of the rail transit signaling system includes the following specific steps: Step S1: Collect raw data from network security equipment and signal service system respectively through data acquisition module and perform standardization processing; The raw data collected by the network security device includes: a network security alarm from the IDS, which reads "An abnormal access to the host with IP address 192.168.10.20 was detected"; The raw data collected in the signal service system includes: a service alarm from the ATS system, which states that "the communication delay between the ATS scheduling workstation and the central server has increased significantly, affecting the refresh rate."

[0066] Step S2: Within the cross-domain analysis engine, an asset profile library containing network security devices, signal service systems, and application services is pre-built through the asset profile management submodule, and dynamic association rules for each asset object and its asset relationships are pre-configured through the association rule management submodule.

[0067] Step S3: Run the standardized data within the cross-domain analysis engine. The data type is perceived through the real-time analysis submodule, and network security data and business system data are parsed out. Then, the forward correlation processing of the network security data and the reverse tracing processing of the business system data are driven in parallel.

[0068] Specifically, the positive correlation processing of this piece of network security data includes: S301, through the first real-time analysis submodule, perceives and parses network security data - "detected abnormal access to the host with IP address 192.168.10.20", and extracts the network feature vector representing the network alarm event; the network feature vector is the attack source IP, target IP (192.168.10.20), protocol (TCP), and port (3389).

[0069] S302, the network feature vector is matched with the dynamic association rule, and the threatened business object and business function are mapped through the configured dynamic association rule (confirming that the business object corresponding to the target IP 192.168.10.20 is "Line 1 Station B Interlocking Control Host A", and the business function is "controlling the turnouts and signals of Line 1 Station B"). The first decision generation submodule generates a comprehensive security risk warning that integrates network alarm events and corresponding business risks.

[0070] This comprehensive security risk warning not only includes network security alerts (such as attack sources and attack types), but also clearly points out their impact on business systems: "Successful intrusion incidents may endanger the interlocking control safety of Station B on Line 1, and there is a risk of switch malfunction."

[0071] S303, after receiving the comprehensive security risk warning information, the collaborative execution module automatically sends an instruction to the firewall through the security-side executor to immediately block all inbound communication from the attack source IP; and at the same time, it sends an instruction to the business operation and maintenance platform of the signal service system through the service-side executor to reduce business risks. The business operation and maintenance platform provides a business contingency plan of "Please pay attention to the interlocking status of Station B of Line 1, and it is recommended to start the backup control unit and conduct a security check" to reduce business risks.

[0072] Specifically, the reverse tracing process for events in the business system includes: S311 uses the second real-time analysis submodule to perceive and analyze business system data—"The communication delay between the ATS scheduling workstation and the central server has increased significantly, affecting the refresh rate," and filters out suspicious business events from it. The suspicious business events are those suspected of being caused by underlying network or security issues.

[0073] S312 performs historical security data backtracking for suspicious business events (querying the IP of the affected ATS server through the asset profile database and retrieving all security-related logs and traffic records of the server in the past 5 minutes), identifies the network security object that caused the suspicious business event (ATS server is under ICMP Flood attack) through the configured dynamic association rules, and generates a comprehensive business risk warning that integrates the suspicious business event and the corresponding network security risk through the second decision generation submodule.

[0074] S313 After receiving the comprehensive business risk warning, the collaborative execution module restarts the ATS server through the business-side executor and simultaneously sends a policy to the firewall through the security-side executor to immediately discard ICMP (Internet Control Message Protocol) data packets sent to the ATS server in order to eliminate network-level attack traffic.

[0075] Step S4: Continuously monitor the performance indicators of the ATS server. After a few minutes, the communication delay returns to normal, and the verification results are fed back to the cross-domain analysis engine to form a closed loop of positive correlation handling and reverse source tracing handling, and to provide data samples for the optimization of the rule base.

[0076] Step S5: Display global information on associated network security devices and signal service systems through the unified management portal to display security alarms and service alarms in real time, and track the process of forward correlation handling and reverse tracing handling, such as "Policy has been issued", "Warning has been delivered", "Service indicators have been restored", etc.

[0077] The present invention also provides an electronic device comprising at least one processor and a memory. The memory stores a computer program, which, when executed by the processor, enables the implementation of all the method steps described in the above embodiments.

[0078] The present invention also provides a computer-readable storage medium, such as ROM, RAM, disk, optical disk, or flash memory. This medium stores a computer program, which, when loaded and executed by a processor, enables the secure operation method described in the above embodiments.

[0079] In summary, the present invention provides a device, method, medium, and equipment for ensuring the safe operation of a rail transit signaling system. On the network security side, it dynamically maps security alarms (such as network attacks and equipment anomalies) to corresponding related business system events in real time, and pushes risk warnings to the business side while handling them. On the business side, it automatically traces the network security vulnerabilities associated with business alarms and triggers security hardening instructions simultaneously during handling. Through cross-domain data fusion, intelligent rule matching, and coordinated handling actions, it achieves a closed loop of collaborative handling of network and business alarms, significantly reducing the repetitiveness of operation and maintenance, improving fault location efficiency, and forming an integrated operation guarantee system of "security protection - business stability".

[0080] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0081] In the description of this invention, it should be understood that the terms "center," "height," "thickness," "upper," "lower," "vertical," "horizontal," "top," "bottom," "inner," "outer," "axial," "radial," and "circumferential," etc., indicating orientation or positional relationships, are based on the orientation or positional relationships shown in the accompanying drawings and are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. In the description of this invention, unless otherwise stated, "a plurality of" means two or more.

[0082] In the description of this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," "linking," and "fixing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0083] In this invention, unless otherwise explicitly specified and limited, "above" or "below" the second feature can include direct contact between the first and second features, or contact between the first and second features through another feature between them. Furthermore, "above," "over," and "on top" of the second feature includes the first feature directly above or diagonally above the second feature, or simply indicates that the first feature is at a higher horizontal level than the second feature. "Below," "below," and "under" the second feature includes the first feature directly below or diagonally below the second feature, or simply indicates that the first feature is at a lower horizontal level than the second feature.

[0084] Although the present invention has been described in detail through the preferred embodiments above, it should be understood that the above description should not be considered as a limitation of the present invention. Various modifications and substitutions to the present invention will be apparent to those skilled in the art after reading the above description. Therefore, the scope of protection of the present invention should be defined by the appended claims.

Claims

1. A method for ensuring safe operation of a rail transit signal system, characterized in that, Comprising the following steps: Step S1, collecting raw data from network security devices and signal service systems through a data acquisition module and performing standardization processing; Step S2, in the cross-domain analysis engine, pre-constructing an asset portrait library containing network security devices, signal service systems and application services through an asset portrait management submodule, and pre-configuring dynamic correlation rules of each asset object and its asset relationship through a correlation rule management submodule; Step S3, running the data processed through standardization in the cross-domain analysis engine, perceiving data types through a real-time analysis submodule, and analyzing network security data and business system data, and then driving forward correlation disposal of the network security data and reverse trace disposal of the business system data in parallel.

2. The safe operation method according to claim 1, characterized by, Further comprising: Step S4, continuously optimizing the cross-domain analysis engine through a disposal execution monitoring module; And monitoring and verifying the effectiveness of the execution process of the collaborative execution module.

3. The safe operation method according to claim 2, wherein Further comprising: Step S5, displaying global information after correlating network security devices and signal service systems through a unified management portal, to display security alerts and business alert information in real time, and track the process of forward correlation disposal and reverse trace disposal.

4. The safe operation method according to claim 1, wherein In step S1, the raw data collected from the network security devices includes firewall session logs, intrusion detection / prevention system alerts, antivirus events, and network traffic probe data; The raw data collected from the signal service systems includes train automatic monitoring system state events, train automatic protection system communication messages, computer interlocking system control instructions and state feedback, and data communication system performance indicators.

5. The safe operation method of claim 1, wherein, In step S2, the asset relationship includes network attributes, business attributes of each asset object, and topological relationships between asset objects.

6. The safe operation method of claim 1, wherein, The forward correlation disposal process of the network security data in step S3 includes: S301, perceiving and analyzing network security data through a first real-time analysis submodule, and extracting network feature vectors representing network alert events therefrom; S302, matching the network feature vectors with the dynamic correlation rules, and mapping threatened business objects and business functions through the configured dynamic correlation rules, and generating first disposal decision instructions through a first decision generation submodule, which are converted into identifiable third disposal decision instructions through an instruction converter, the third disposal decision instructions including comprehensive security risk warning information fusing network alert events and corresponding business risks; S303, after receiving the comprehensive security risk warning information, the collaborative execution module performs security isolation on the network security devices through a security side executor, and simultaneously sends instructions to reduce business risks to the business operation and maintenance platform of the signal business system through a business side executor.

7. The safe operation method according to claim 6, wherein The network feature vectors at least include attack source IP addresses, target IP addresses, target ports and protocol types.

8. The safe operation method of claim 1, wherein, The reverse trace disposal process of the business system data in step S3 includes: S311, perceiving and analyzing business system data through a second real-time analysis submodule, and screening suspicious business events therefrom; S312, backtracking the suspicious business event with historical security data, and determining the network security object causing the suspicious business event through the configured dynamic correlation rules, and generating a second disposal decision instruction through the second decision generation submodule, the second disposal decision instruction being converted into a recognizable fourth disposal decision instruction through the instruction converter, the fourth disposal decision instruction containing comprehensive business risk early warning information fusing the suspicious business event and the corresponding network security risk; S313, after receiving the comprehensive business risk early warning information, the cooperative execution module executes fault repair on the signal business system through the business side executor, and simultaneously executes security reinforcement on the network security device through the security side executor.

9. The safe operation method according to claim 8, wherein The suspicious business event includes: non-obvious hardware failure, business event caused by underlying network or security problem.

10. The safe operation method according to claim 9, wherein The step S4 includes the following steps: S4.1, continuously optimizing the dynamic correlation rules in the correlation rule management submodule through the machine learning algorithm built in the disposal execution monitoring module; S4.2, monitoring and verifying the execution process of steps S303 and S313 through the disposal execution monitoring module, and feeding back the disposal log generated in the monitoring to the security side executor and the business side executor, so as to verify whether the security side executor and the business side executor have executed effective security risk and business risk reduction instructions.

11. A device for ensuring safe operation of a rail transit signal system, for implementing the safe operation method according to any one of claims 1-10, characterized in that, It includes: a data acquisition module, a cross-domain analysis engine, and a cooperative execution module; The data acquisition module is in communication connection with the network security device and the signal business system, and is configured to acquire raw data from the network security device and the signal business system and perform standardization processing to obtain network security data and business system data; The cross-domain analysis engine is in communication connection with the data acquisition module and is configured to perform forward correlation analysis on the standardized network security data and reverse source analysis on the business system data based on the preset dynamic correlation rules, and generate disposal decision instructions; The cooperative execution module is in communication connection with the cross-domain analysis engine and is configured to receive the disposal decision instructions and send security operation instructions to the business operation and maintenance platform of the network security device and the signal business system.

12. The apparatus of claim 11, wherein, It also includes a disposal execution monitoring module and a unified management portal; The disposal execution monitoring module is in communication connection with the cross-domain analysis engine to optimize the dynamic correlation rules based on the machine learning algorithm in the disposal execution monitoring module; the disposal execution monitoring module is also in communication connection with the cooperative execution module to feed back the generated disposal log to the cooperative execution module to verify whether it has executed effective risk reduction instructions; The unified management portal is in communication connection with the cross-domain analysis engine and the cooperative execution module to provide global situation visualization, manual intervention interface and system configuration management functions.

13. The apparatus of claim 11, wherein, The cross-domain analysis engine includes: An asset portrait management submodule for pre-storing asset objects including network security devices, signal business systems and application services and asset relationships thereof, and forming an asset portrait library; The correlation rule management submodule is in communication connection with the asset portrait management submodule, and is configured to preconfigure a dynamic correlation rule of each asset object and an asset relationship thereof; The real-time analysis submodule is in communication connection with the data collection module and the correlation rule management submodule, and is configured to call the standardized network security data and the business system data, and call the dynamic correlation rule in the correlation rule management submodule, so as to perform forward correlation disposal and reverse trace disposal; The decision generation submodule is in communication connection with the real-time analysis submodule, and is configured to generate a disposal decision instruction according to an execution result of the forward correlation disposal and the reverse trace disposal.

14. The apparatus of claim 13, wherein, The real-time analysis submodule comprises a first real-time analysis submodule and a second real-time analysis submodule. The first real-time analysis submodule is in communication connection with the data collection module and the correlation rule management submodule, and is configured to perceive network security data and extract a network feature vector, and then perform forward correlation disposal on the standardized network security data. The second real-time analysis submodule is in communication connection with the data collection module and the correlation rule management submodule, and is configured to perceive business system data, and then perform reverse trace disposal on the standardized business system data.

15. The apparatus of claim 14 wherein, The decision generation submodule comprises a first decision generation submodule and a second decision generation submodule. The first decision generation submodule is in communication connection with the first real-time analysis submodule, and is configured to generate a first disposal decision instruction in the forward correlation disposal. The second decision generation submodule is in communication connection with the second real-time analysis submodule, and is configured to generate a second disposal decision instruction in the reverse trace disposal.

16. The apparatus of claim 15 wherein, The cooperative execution module comprises: The instruction converter is in communication connection with the first decision generation submodule and the second decision generation submodule, and is configured to convert each disposal decision instruction into a command format recognizable by a network security device and a business operation and maintenance platform, i.e., convert the first disposal decision instruction into a recognizable third disposal decision instruction, and convert the second disposal decision instruction into a recognizable fourth disposal decision instruction; The security side executor is in communication connection with the instruction converter, and is configured to receive the recognizable third disposal decision instruction, and send a policy configuration, isolation or blocking instruction to the network security device; The business side executor is in communication connection with the instruction converter, and is configured to receive the recognizable fourth disposal decision instruction, and send an instruction for reducing business risk to a business operation and maintenance platform of a signal business system, or perform fault repair on the signal business system.

17. A computer readable storage medium having stored thereon a computer program, characterized in that The computer program is executed by the processor to implement the safe operation method in any one of claims 1-10.

18. An electronic device, comprising: The computer program is executed by the processor to implement the safe operation method in any one of claims 1-10. The computer program is executed by the processor to implement the safe operation method in any one of claims 1-10.

Images