Device, method, medium and equipment for ensuring safe operation of rail transit signal system

Abstract

This invention discloses a method and apparatus for ensuring the safe operation of a rail transit signaling system, comprising: Step S1, collecting raw data from network security devices and signaling business systems respectively through a data acquisition module and performing standardized processing; Step S2, within a cross-domain analysis engine, pre-constructing an asset profile library containing network security devices, signaling business systems, and application services through an asset profile management submodule, and pre-configuring dynamic association rules for each asset object and its asset relationships through an association rule management submodule; Step S3, running the standardized data within the cross-domain analysis engine, perceiving data types through a real-time analysis submodule, parsing network security data and business system data, and then driving the forward association processing of the network security data and the reverse tracing processing of the business system data in parallel. This invention can achieve deep collaboration between network security protection and business operation and maintenance systems, and has the advantage of adapting to dynamic business.

Description

Technical Field

[0001] This invention relates to the field of urban rail transit operation safety technology, and in particular to a device, method, medium and equipment for ensuring the safe operation of rail transit signaling systems. Background Technology

[0002] Urban rail transit signaling systems are the core systems controlling the safe and efficient operation of trains, and their reliability is directly related to public safety and operational order. As these systems evolve towards greater networking and intelligence, the cybersecurity risks they face are becoming increasingly prominent. The frequent occurrence of advanced persistent threats and cyberattacks targeting industrial control systems makes rail transit signaling systems, a critical information infrastructure, a potential target. Cyber ​​intrusions or malicious interference can lead to abnormal train operation control commands and operational disruptions, resulting in delays, service stoppages, and even safety accidents, posing a serious threat to socio-economic development and public safety.

[0003] To address the aforementioned risks, existing technical solutions typically deploy two independent protection systems in parallel: on the one hand, a network security protection system consisting of firewalls, intrusion detection systems, and security auditing systems is deployed, focusing on defending against network layer attacks; on the other hand, an independent business operation and maintenance system (such as a monitoring system, a data acquisition and monitoring control system, and an intelligent operation and maintenance platform) is established to monitor the operational status and functional logic of business equipment such as switches, signals, and vehicle controllers. However, in actual operation and maintenance, these two systems generally have coordination barriers, presenting a fragmented state, resulting in low overall security effectiveness. Specific defects include: 1. Lack of information fusion leads to misjudgment of risks: Security alarms generated by network security devices (such as abnormal connections and malicious code activity) and operational anomalies reported by business systems (such as inconsistent turnout display, train-to-ground communication timeouts, and signal drive failures) are displayed and processed on different platforms, lacking deep correlation analysis based on business semantics. Security operations personnel struggle to determine whether a network attack has substantially impacted train control operations, while business operations personnel are unable to perceive the potential network security threats behind functional anomalies. This information silo phenomenon directly leads to inaccurate prioritization of emergency response, resulting in either overreaction and wasted resources or delayed response and amplified risks.

[0004] 2. Fragmented handling processes reduce response efficiency: When system anomalies occur, the business operations team typically follows functional logic for fault location and recovery, lacking the ability to trace the source of cybersecurity threats. Consequently, when handling security incidents, the security team also struggles to quickly and accurately assess their specific impact on train operation safety and efficiency, and to formulate effective business coordination instructions. This disconnect in handling actions significantly prolongs system recovery time when facing complex failures caused by cyberattacks, severely impacting operational continuity.

[0005] 3. Static defense strategies are ill-suited to dynamic business needs: Traditional network security strategies are mostly based on static rules or general models, lacking the ability to perceive and adapt to dynamic changes in the internal business logic of the signal system (such as operational diagram adjustments, online device deployment and decommissioning, and network topology reconstruction). This leads to gaps between security protection rules and real-time business requirements, causing the protection system to lag behind business development and fail to effectively cope with targeted attacks against new business scenarios.

[0006] Existing improvements, such as log aggregation via the Syslog protocol or simple integration of some business logs into the security operations center platform, while achieving initial data centralization to some extent, are essentially one-way information collection and passive post-event analysis. These methods fail to build a collaborative handling mechanism that can understand business context, support two-way information linkage and intelligent decision-making, and therefore cannot fundamentally solve the problem of deep collaboration between network security and business operations.

[0007] Therefore, a long-standing technical challenge for those skilled in the art is how to break down the barriers between network security protection and business operations in existing technologies, and build an integrated protection solution that can achieve deep data fusion, risk linkage analysis, and collaborative closed-loop handling, so as to systematically improve the overall resilience, operational efficiency, and recovery capabilities of urban rail transit signaling systems in the face of complex network threats.

[0008] The statements herein provide only background information in relation to this invention and do not necessarily constitute prior art. Summary of the Invention

[0009] The purpose of this invention is to provide a device, method, medium, and equipment to ensure the safe operation of a rail transit signaling system, which can solve the problems of difficulty in coordinating network security protection and business operation and maintenance systems, fragmented handling processes, and difficulty in adapting to dynamic business in existing urban rail transit signaling systems.

[0010] To achieve the above objectives, the present invention provides a method for ensuring the safe operation of a rail transit signaling system, comprising the following steps: Step S1: Collect raw data from network security equipment and signal service system respectively through data acquisition module and perform standardization processing; Step S2: Within the cross-domain analysis engine, an asset profile library containing network security devices, signal service systems, and application services is pre-built through the asset profile management sub-module, and dynamic association rules for each asset object and its asset relationships are pre-configured through the association rule management sub-module. Step S3: Run the standardized data within the cross-domain analysis engine. The data type is perceived through the real-time analysis submodule, and network security data and business system data are parsed out. Then, the forward correlation processing of the network security data and the reverse tracing processing of the business system data are driven in parallel.

[0011] Optionally, the secure operation method further includes: step S4, continuously optimizing the cross-domain analysis engine through the disposal execution monitoring module; and monitoring and validating the execution process of the collaborative execution module.

[0012] Optionally, the secure operation method further includes: step S5, displaying global information of associated network security devices and signal service systems through a unified management portal to display security alarms and service alarms in real time, and tracking the process of forward correlation handling and reverse tracing handling.

[0013] Optionally, in step S1, the raw data collected from the network security device includes: firewall session logs, intrusion detection / prevention system alarms, antivirus events, and network traffic probe data; The raw data collected from the signaling system includes: status events of the automatic train monitoring system, communication messages of the automatic train protection system, control commands and status feedback of the computer interlocking system, and performance indicators of the data communication system.

[0014] Optionally, in step S2, the asset relationship includes: the network attributes, business attributes, and topological relationships between each asset object.

[0015] Optionally, the positive correlation processing of network security data in step S3 includes: S301, through the first real-time analysis submodule, perceives and parses network security data, and extracts network feature vectors representing network alarm events from it; S302, the network feature vector is matched with the dynamic association rule, and the threatened business objects and business functions are mapped through the configured dynamic association rule. A first handling decision instruction is generated through the first decision generation submodule. The first handling decision instruction is converted into a recognizable third handling decision instruction through the instruction converter. The third handling decision instruction contains comprehensive security risk warning information that integrates network alarm events and corresponding business risks. S303 After receiving the comprehensive security risk warning information, the collaborative execution module performs security isolation to the network security device through the security-side actuator, and at the same time sends instructions to the business operation and maintenance platform of the signal business system to reduce business risks through the business-side actuator.

[0016] Optionally, the network feature vector includes at least the attack source IP address, target IP address, target port, and protocol type.

[0017] Optionally, the reverse tracing process for business system data in step S3 includes: S311 uses the second real-time analysis submodule to perceive and parse business system data, and filters out suspicious business events from it. S312, backtrack historical security data for suspicious business events, identify the network security object that caused the suspicious business event through the configured dynamic association, and generate a second handling decision instruction through the second decision generation submodule. The second handling decision instruction is converted into a recognizable fourth handling decision instruction through the instruction converter. The fourth handling decision instruction contains comprehensive business risk warning information that integrates the suspicious business event and the corresponding network security risk. S313 After receiving the comprehensive business risk warning information, the collaborative execution module performs fault repair on the signal business system through the business-side executor, and at the same time performs security hardening on the network security equipment through the security-side executor.

[0018] Optionally, the suspicious service events include: service events that are not obvious hardware failures or are caused by underlying network or security issues.

[0019] Optionally, step S4 includes the following steps: S4.1, continuously optimizes the dynamic association rules in the association rule management submodule by using the machine learning algorithm built into the execution monitoring module; S4.2 The execution process of steps S303 and S313 is monitored and verified by the disposal execution monitoring module, and the disposal log generated in the monitoring is fed back to the security side executor and the business side executor to verify whether the security side executor and the business side executor have executed effective instructions to reduce security risks and business risks.

[0020] The present invention also provides an apparatus for ensuring the safe operation of a rail transit signaling system, used to implement the aforementioned safe operation method. The apparatus includes: a data acquisition module, a cross-domain analysis engine, and a collaborative execution module. The data acquisition module is communicatively connected to network security equipment and signal service system. The data acquisition module is configured to collect raw data from network security equipment and signal service system, and perform standardized processing to obtain network security data and service system data. The cross-domain analysis engine is communicatively connected to the data acquisition module and is configured to perform forward correlation analysis on standardized network security data and reverse source tracing analysis on business system data based on preset dynamic correlation rules, and generate disposal decision instructions. The collaborative execution module is communicatively connected to the cross-domain analysis engine and is configured to receive the handling decision instructions and send security operation instructions to the business operation and maintenance platform of network security equipment and signal service system.

[0021] Optionally, the secure operation device further includes: a disposal execution monitoring module and a unified management portal; The disposal execution monitoring module is communicatively connected to the cross-domain analysis engine to optimize dynamic association rules based on machine learning algorithms within the disposal execution monitoring module; the disposal execution monitoring module is also communicatively connected to the collaborative execution module to feed back the generated disposal logs to the collaborative execution module to verify whether it has executed effective risk reduction instructions; The unified management portal communicates with the cross-domain analysis engine and collaborative execution module to provide global situation visualization, manual intervention interface and system configuration management functions.

[0022] Optionally, the cross-domain analytics engine includes: The asset profile management submodule is used to pre-store asset objects, including network security equipment, signal service systems and application services, and their asset relationships, and form an asset profile library. The association rule management submodule is communicatively connected to the asset profile management submodule and is used to pre-configure dynamic association rules for each asset object and its asset relationships. The real-time analysis submodule is connected to the data acquisition module and the association rule management submodule, respectively. It can call standardized network security data and business system data, as well as call the dynamic association rules in the association rule management submodule to perform positive association processing and reverse tracing processing. The decision generation submodule communicates with the real-time analysis submodule to generate a decision instruction from the execution results of the positive correlation processing and the reverse tracing processing.

[0023] Optionally, the real-time analysis submodule includes: a first real-time analysis submodule and a second real-time analysis submodule; The first real-time analysis submodule is communicatively connected to both the data acquisition module and the association rule management submodule to sense network security data and extract network feature vectors, and then perform positive association processing on the standardized network security data. The second real-time analysis submodule is communicatively connected to both the data acquisition module and the association rule management submodule to sense business system data and then perform reverse tracing processing on the standardized business system data.

[0024] Optionally, the decision generation submodule includes: a first decision generation submodule and a second decision generation submodule; The first decision generation submodule is communicatively connected to the first real-time analysis submodule to generate a first disposal decision instruction in the positive correlation disposal; the second decision generation submodule is communicatively connected to the second real-time analysis submodule to generate a second disposal decision instruction in the reverse tracing disposal.

[0025] Optionally, the collaborative execution module includes: The instruction converter is communicatively connected to both the first and second decision generation submodules. It is used to convert various disposal decision instructions into command formats that can be recognized by network security devices and business operation and maintenance platforms, that is, to convert the first disposal decision instruction into a recognizable third disposal decision instruction and to convert the second disposal decision instruction into a recognizable fourth disposal decision instruction. The security-side actuator, which is communicatively connected to the instruction converter, is used to receive identifiable third-party action decision instructions and send policy configuration, isolation, or blocking instructions to the network security device. The service-side executor is communicatively connected to the instruction converter and is used to receive identifiable fourth-handling decision instructions and send instructions to the service operation and maintenance platform of the signal service system to reduce service risks or to perform fault repair on the signal service system.

[0026] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the aforementioned secure operation method.

[0027] The present invention also provides an electronic device including a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the secure operation method described above is implemented.

[0028] In summary, compared with the prior art, the present invention has the following beneficial effects: 1. The present invention provides a device, method, medium and equipment for ensuring the safe operation of a rail transit signaling system, which breaks down the barriers between security and business, transforms from "passive defense" to "active protection", enhances the active defense and network security resilience of the signaling system, and builds an integrated operation protection system.

[0029] 2. The present invention provides a device, method, medium and equipment for ensuring the safe operation of a rail transit signaling system. Through bidirectional dynamic correlation mapping, it automatically completes the mutual correlation between safety events and business impacts, greatly shortens the fault location time and reduces repeated troubleshooting.

[0030] 3. The present invention provides a device, method, medium, and equipment for ensuring the safe operation of a rail transit signaling system. On the network security side, it utilizes cross-domain data fusion technology and then uses an intelligent rule engine to dynamically map the data to specific business systems that may be affected in real time, and proactively pushes accurate risk warnings to the business side. On the business side, when a business performance alarm or failure occurs, the system can automatically trace back to the source, analyze and correlate it to the underlying network security vulnerabilities, and send reinforcement instructions to the security side. This achieves automated linkage of handling actions, enabling security protection to respond to business anomalies in a timely manner, and business operations to avoid security risks in advance, forming a collaborative closed loop, and significantly improving the overall risk resistance and recovery capabilities of the system. Attached Figure Description

[0031] Figure 1 This is an operational diagram of the method for ensuring the safe operation of a rail transit signaling system according to the present invention; Figure 2 The block diagram of the device for ensuring the safe operation of a rail transit signaling system according to the present invention is shown. Detailed Implementation

[0032] The following will be combined with the appendix Figures 1-2 The present invention will be further described in detail through preferred embodiments. The advantages and features of the present invention will become clearer from the following description. It should be noted that the accompanying drawings are in a very simplified form and use non-precise proportions, only for the purpose of conveniently and clearly illustrating the embodiments of the present invention. Please refer to the accompanying drawings to make the objectives, features, and advantages of the present invention more apparent and understandable. It should be understood that the structures, proportions, sizes, etc., depicted in the accompanying drawings are only for the purpose of assisting those skilled in the art in understanding and reading the content disclosed in the specification, and are not intended to limit the implementation conditions of the present invention. Therefore, they have no substantial technical significance. Any modifications to the structure, changes in the proportional relationships, or adjustments to the size, without affecting the effects and objectives achieved by the present invention, should still fall within the scope of the technical content disclosed in the present invention.

[0033] like Figure 2 As shown, the present invention provides a device for ensuring the safe operation of a rail transit signaling system, comprising: a data acquisition module, a cross-domain analysis engine, a collaborative execution module, a disposal execution monitoring module, and a unified management portal.

[0034] The data acquisition module is communicatively connected to network security equipment and signal service system. The data acquisition module is configured to collect raw data from network security equipment and signal service system through data interface, and perform standardized processing to obtain network security data and service system data.

[0035] The network security equipment mentioned can be firewalls, IDS (Intrusion Detection Systems), SWITCH (Switches), etc.

[0036] The signaling service system may be an automatic train monitoring system, an automatic train protection system, etc.

[0037] The data interface supports access to various heterogeneous data sources, including network management protocols (such as SNMP Trap), log protocols (such as Syslog), application programming interfaces (such as RESTful API), and industrial communication standards (such as OPC UA). After completing data acquisition, the data acquisition module also needs to perform data standardization processing, specifically including: cleaning, formatting, and field mapping.

[0038] The cross-domain analysis engine is communicatively connected to the data acquisition module and is configured to perform forward correlation analysis on standardized network security data and reverse source tracing analysis on business system data based on preset dynamic correlation rules, and generate disposal decision instructions.

[0039] This cross-domain analysis engine includes: an asset profiling management submodule, used to pre-store asset objects and their asset relationships, including network security equipment, signal service systems, and application services, forming an asset profiling library; an association rule management submodule, communicatively connected to the asset profiling management submodule, used to pre-configure dynamic association rules for each asset object and its asset relationships; a real-time analysis submodule, communicatively connected to both the data acquisition module and the association rule management submodule, capable of calling standardized network security data and business system data, as well as calling dynamic association rules in the association rule management submodule, for forward association handling and reverse tracing handling; and a decision generation submodule, communicatively connected to the real-time analysis submodule, to generate handling decision instructions (such as generating risk warnings, generating blocking instructions, etc.) from the execution results of forward association handling and reverse tracing handling.

[0040] Furthermore, the real-time analysis submodule includes: a first real-time analysis submodule and a second real-time analysis submodule; the first real-time analysis submodule is communicatively connected to both the data acquisition module and the association rule management submodule to sense network security data and extract network feature vectors, and then perform positive association processing on the standardized network security data; the second real-time analysis submodule is communicatively connected to both the data acquisition module and the association rule management submodule to sense business system data, and then perform reverse tracing processing on the standardized business system data.

[0041] Furthermore, the decision generation submodule includes: a first decision generation submodule and a second decision generation submodule; the first decision generation submodule is communicatively connected to the first real-time analysis submodule to generate a first disposal decision instruction in positive correlation disposal; the second decision generation submodule is communicatively connected to the second real-time analysis submodule to generate a second disposal decision instruction in reverse tracing disposal.

[0042] The collaborative execution module is communicatively connected to the decision generation submodule of the cross-domain analysis engine and is configured to receive the disposal decision instructions generated by the decision generation submodule and send security operation instructions to the business operation and maintenance platform of network security equipment and signal service system.

[0043] The collaborative execution module includes: an instruction converter, which is communicatively connected to both the first and second decision generation submodules, for converting various handling decision instructions into command formats recognizable by network security devices and business operation and maintenance platforms, i.e., converting the first handling decision instruction into a recognizable third handling decision instruction, and converting the second handling decision instruction into a recognizable fourth handling decision instruction; a security-side executor, which is communicatively connected to the instruction converter, for receiving the recognizable third handling decision instruction and sending policy configuration, isolation, or blocking instructions to network security devices; and a business-side executor, which is communicatively connected to the instruction converter, for receiving the recognizable fourth handling decision instruction and sending instructions to reduce business risks or perform fault repair on the signal service system to the business operation and maintenance platform of the signal service system.

[0044] The disposal execution monitoring module is communicatively connected to the association rule management submodule of the cross-domain analysis engine to optimize dynamic association rules based on machine learning algorithms within the disposal execution monitoring module. The disposal execution monitoring module is also communicatively connected to the security-side executor and business-side executor within the collaborative execution module to feed back the generated disposal logs to the security-side executor and business-side executor to verify whether the security-side executor and business-side executor have executed effective instructions to reduce security and business risks.

[0045] The unified management portal communicates with the cross-domain analysis engine and collaborative execution module to provide global situation visualization, manual intervention interface and system configuration management functions.

[0046] Specifically, the global situation visualization includes visualization of real-time alarm information, handling process tracking, asset profile database information, etc.; the manual intervention interface supports confirmation, approval, and one-click issuance of automatically generated handling decision instructions, taking into account both automation and manual supervision; the system configuration management includes configuration management of dynamic association rules and asset profile database.

[0047] like Figure 1 As shown, the present invention also provides a method for achieving safe operation of a rail transit signaling system through the aforementioned safe operation device. Its core lies in constructing a two-way closed-loop processing flow of "safety-driven operation" and "operation-driven safety." This safe operation method includes the following steps: Step S1: Collect raw data from network security equipment and signal service system respectively through data acquisition module and perform standardization processing.

[0048] The raw data collected from the network security devices includes: firewall session logs, intrusion detection / prevention system (IDS / IPS) alarms, antivirus events, and network traffic probe data.

[0049] The raw data collected from the signaling system includes: Automatic Train Monitoring (ATS) system status events, Automatic Train Protection (ATP) system communication messages, Computer Interlocking (CI) system control commands and status feedback, and Data Communication System (DCS) performance indicators.

[0050] The standardization process includes cleaning, formatting, and mapping the raw data according to a predefined standardization paradigm, and unifying the formats of key fields such as timestamps, protocol types, and IP addresses to provide data support for cross-domain (network security domain and business system domain) correlation analysis.

[0051] Step S2: Within the cross-domain analysis engine, an asset profile library containing network security devices, signal service systems, and application services is pre-built through the asset profile management submodule, and dynamic association rules for each asset object and its asset relationships are pre-configured through the association rule management submodule.

[0052] The asset relationships include: the network attributes, business attributes, and topological relationships between each asset object.

[0053] Step S3: Run the standardized data within the cross-domain analysis engine. The data type is perceived through the real-time analysis submodule, and network security data and business system data are parsed out. Then, the forward correlation processing of the network security data and the reverse tracing processing of the business system data are driven in parallel.

[0054] Specifically, the positive correlation processing of the network security data includes: S301, the first real-time analysis submodule senses and parses network security data, and extracts network feature vectors representing network alarm events from it; the network feature vectors include at least the attack source IP address, target IP address, target port and protocol type.

[0055] S302, the network feature vector is matched with the dynamic association rule, and the threatened business objects and business functions are mapped through the configured dynamic association rule. A first handling decision instruction is generated through the first decision generation submodule. The first handling decision instruction is converted into a recognizable third handling decision instruction through the instruction converter. The third handling decision instruction contains comprehensive security risk warning information that integrates network alarm events and corresponding business risks.

[0056] S303, after receiving the comprehensive security risk warning information, the collaborative execution module performs security isolation on the network security device through the security side executor (such as isolating the infected host and blocking the IP address of the attack source), and at the same time sends an instruction to the business operation and maintenance platform of the signal business system to reduce business risks through the business side executor. The business operation and maintenance platform provides a contingency plan to reduce business risks.

[0057] Specifically, the reverse tracing process for events in the business system includes: S311 uses the second real-time analysis submodule to perceive and parse business system data, and filters out suspicious business events from it. The suspicious business events include: business events that are not obvious hardware failures or are suspected to be caused by underlying network or security issues.

[0058] S312, backtrack historical security data for suspicious business events, identify the network security object that caused the suspicious business event through the configured dynamic association, and generate a second handling decision instruction through the second decision generation submodule. The second handling decision instruction is converted into a recognizable fourth handling decision instruction through the instruction converter. The fourth handling decision instruction contains comprehensive business risk warning information that integrates the suspicious business event and the corresponding network security risk.

[0059] Specifically, the backtracking process involves checking whether the suspicious business event was subjected to network scanning, whether there were abnormal login logs, and whether the traffic was abnormal before the business failure occurred.

[0060] S313 After receiving the comprehensive business risk warning information, the collaborative execution module performs fault repair on the signal business system through the business side executor (such as restarting the service or switching the link in the business operation and maintenance platform), and at the same time performs security hardening on the network security device through the security side executor (such as issuing a policy to the firewall to immediately discard ICMP data packets sent to the ATS server; or commanding the terminal security management software to perform virus scanning and removal on the server).

[0061] Step S4 involves continuously optimizing the cross-domain analysis engine through the execution monitoring module and monitoring and validating the execution process of the collaborative execution module.

[0062] Specifically, step S4 includes: S4.1, continuously optimizes the dynamic association rules in the association rule management submodule by using the machine learning algorithm built into the execution monitoring module; S4.2 The execution process of steps S303 and S313 is monitored and verified by the execution monitoring module. During the monitoring, a disposal log is generated to characterize the execution process and disposal effect. The disposal log is fed back to the security side executor and the business side executor to verify whether the security side executor and the business side executor have executed effective instructions to reduce security risks and business risks.

[0063] Step S5: Display global information on associated network security devices and signal service systems through the unified management portal to display security alarms and service alarms in real time, and track the processes of forward correlation handling and reverse tracing handling.

[0064] The following will provide the implementation process of the safe operation method of the present invention in a specific scenario.

[0065] For business alerts triggered by network alarm events and network security hardening triggered by business anomalies, this method for ensuring the safe operation of the rail transit signaling system includes the following specific steps: Step S1: Collect raw data from network security equipment and signal service system respectively through data acquisition module and perform standardization processing; The raw data collected by the network security device includes: a network security alarm from the IDS, which reads "An abnormal access to the host with IP address 192.168.10.20 was detected"; The raw data collected in the signal service system includes: a service alarm from the ATS system, which states that "the communication delay between the ATS scheduling workstation and the central server has increased significantly, affecting the refresh rate."

[0066] Step S2: Within the cross-domain analysis engine, an asset profile library containing network security devices, signal service systems, and application services is pre-built through the asset profile management submodule, and dynamic association rules for each asset object and its asset relationships are pre-configured through the association rule management submodule.

[0067] Step S3: Run the standardized data within the cross-domain analysis engine. The data type is perceived through the real-time analysis submodule, and network security data and business system data are parsed out. Then, the forward correlation processing of the network security data and the reverse tracing processing of the business system data are driven in parallel.

[0068] Specifically, the positive correlation processing of this piece of network security data includes: S301, through the first real-time analysis submodule, perceives and parses network security data - "detected abnormal access to the host with IP address 192.168.10.20", and extracts the network feature vector representing the network alarm event; the network feature vector is the attack source IP, target IP (192.168.10.20), protocol (TCP), and port (3389).

[0069] S302, the network feature vector is matched with the dynamic association rule, and the threatened business object and business function are mapped through the configured dynamic association rule (confirming that the business object corresponding to the target IP 192.168.10.20 is "Line 1 Station B Interlocking Control Host A", and the business function is "controlling the turnouts and signals of Line 1 Station B"). The first decision generation submodule generates a comprehensive security risk warning that integrates network alarm events and corresponding business risks.

[0070] This comprehensive security risk warning not only includes network security alerts (such as attack sources and attack types), but also clearly points out their impact on business systems: "Successful intrusion incidents may endanger the interlocking control safety of Station B on Line 1, and there is a risk of switch malfunction."

[0071] S303, after receiving the comprehensive security risk warning information, the collaborative execution module automatically sends an instruction to the firewall through the security-side executor to immediately block all inbound communication from the attack source IP; and at the same time, it sends an instruction to the business operation and maintenance platform of the signal service system through the service-side executor to reduce business risks. The business operation and maintenance platform provides a business contingency plan of "Please pay attention to the interlocking status of Station B of Line 1, and it is recommended to start the backup control unit and conduct a security check" to reduce business risks.

[0072] Specifically, the reverse tracing process for events in the business system includes: S311 uses the second real-time analysis submodule to perceive and analyze business system data—"The communication delay between the ATS scheduling workstation and the central server has increased significantly, affecting the refresh rate," and filters out suspicious business events from it. The suspicious business events are those suspected of being caused by underlying network or security issues.

[0073] S312 performs historical security data backtracking for suspicious business events (querying the IP of the affected ATS server through the asset profile database and retrieving all security-related logs and traffic records of the server in the past 5 minutes), identifies the network security object that caused the suspicious business event (ATS server is under ICMP Flood attack) through the configured dynamic association rules, and generates a comprehensive business risk warning that integrates the suspicious business event and the corresponding network security risk through the second decision generation submodule.

[0074] S313 After receiving the comprehensive business risk warning, the collaborative execution module restarts the ATS server through the business-side executor and simultaneously sends a policy to the firewall through the security-side executor to immediately discard ICMP (Internet Control Message Protocol) data packets sent to the ATS server in order to eliminate network-level attack traffic.

[0075] Step S4: Continuously monitor the performance indicators of the ATS server. After a few minutes, the communication delay returns to normal, and the verification results are fed back to the cross-domain analysis engine to form a closed loop of positive correlation handling and reverse source tracing handling, and to provide data samples for the optimization of the rule base.

[0076] Step S5: Display global information on associated network security devices and signal service systems through the unified management portal to display security alarms and service alarms in real time, and track the process of forward correlation handling and reverse tracing handling, such as "Policy has been issued", "Warning has been delivered", "Service indicators have been restored", etc.

[0077] The present invention also provides an electronic device comprising at least one processor and a memory. The memory stores a computer program, which, when executed by the processor, enables the implementation of all the method steps described in the above embodiments.

[0078] The present invention also provides a computer-readable storage medium, such as ROM, RAM, disk, optical disk, or flash memory. This medium stores a computer program, which, when loaded and executed by a processor, enables the secure operation method described in the above embodiments.

[0079] In summary, the present invention provides a device, method, medium, and equipment for ensuring the safe operation of a rail transit signaling system. On the network security side, it dynamically maps security alarms (such as network attacks and equipment anomalies) to corresponding related business system events in real time, and pushes risk warnings to the business side while handling them. On the business side, it automatically traces the network security vulnerabilities associated with business alarms and triggers security hardening instructions simultaneously during handling. Through cross-domain data fusion, intelligent rule matching, and coordinated handling actions, it achieves a closed loop of collaborative handling of network and business alarms, significantly reducing the repetitiveness of operation and maintenance, improving fault location efficiency, and forming an integrated operation guarantee system of "security protection - business stability".

[0080] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0081] In the description of this invention, it should be understood that the terms "center," "height," "thickness," "upper," "lower," "vertical," "horizontal," "top," "bottom," "inner," "outer," "axial," "radial," and "circumferential," etc., indicating orientation or positional relationships, are based on the orientation or positional relationships shown in the accompanying drawings and are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. In the description of this invention, unless otherwise stated, "a plurality of" means two or more.

[0082] In the description of this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," "linking," and "fixing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0083] In this invention, unless otherwise explicitly specified and limited, "above" or "below" the second feature can include direct contact between the first and second features, or contact between the first and second features through another feature between them. Furthermore, "above," "over," and "on top" of the second feature includes the first feature directly above or diagonally above the second feature, or simply indicates that the first feature is at a higher horizontal level than the second feature. "Below," "below," and "under" the second feature includes the first feature directly below or diagonally below the second feature, or simply indicates that the first feature is at a lower horizontal level than the second feature.

[0084] Although the present invention has been described in detail through the preferred embodiments above, it should be understood that the above description should not be considered as a limitation of the present invention. Various modifications and substitutions to the present invention will be apparent to those skilled in the art after reading the above description. Therefore, the scope of protection of the present invention should be defined by the appended claims.

Claims

1. A method for ensuring the safe operation of a rail transit signaling system, characterized in that, Includes the following steps: Step S1: Collect raw data from network security equipment and signal service system respectively through data acquisition module and perform standardization processing; Step S2: Within the cross-domain analysis engine, an asset profile library containing network security devices, signal service systems, and application services is pre-built through the asset profile management sub-module, and dynamic association rules for each asset object and its asset relationships are pre-configured through the association rule management sub-module. Step S3: Run the standardized data in the cross-domain analysis engine, perceive the data type through the real-time analysis submodule, and parse out network security data and business system data, and then drive the positive correlation processing of the network security data and the reverse tracing processing of the business system data in parallel. Step S4: Continuously optimize the cross-domain analysis engine through the execution monitoring module; The execution process of the collaborative execution module is monitored and its effectiveness is verified. Step S5: Display global information on associated network security devices and signal service systems through the unified management portal to display security alarms and service alarms in real time, and track the process of forward correlation handling and reverse tracing handling. The positive correlation processing of network security data in step S3 includes: S301, through the first real-time analysis submodule, perceives and parses network security data, and extracts network feature vectors representing network alarm events from it; S302, the network feature vector is matched with the dynamic association rule, and the threatened business objects and business functions are mapped through the configured dynamic association rule. A first handling decision instruction is generated through the first decision generation submodule. The first handling decision instruction is converted into a recognizable third handling decision instruction through the instruction converter. The third handling decision instruction contains comprehensive security risk warning information that integrates network alarm events and corresponding business risks. S303: After receiving comprehensive security risk warning information, the collaborative execution module performs security isolation to the network security device through the security-side actuator, and at the same time sends instructions to the business operation and maintenance platform of the signal business system to reduce business risks through the business-side actuator. The reverse tracing process for business system data in step S3 includes: S311 uses the second real-time analysis submodule to perceive and parse business system data, and filters out suspicious business events from it. S312, backtrack historical security data for suspicious business events, identify the network security object that caused the suspicious business event through the configured dynamic association, and generate a second handling decision instruction through the second decision generation submodule. The second handling decision instruction is converted into a recognizable fourth handling decision instruction through the instruction converter. The fourth handling decision instruction contains comprehensive business risk warning information that integrates the suspicious business event and the corresponding network security risk. S313 After receiving the comprehensive business risk warning information, the collaborative execution module performs fault repair on the signal business system through the business-side executor, and at the same time performs security hardening on the network security equipment through the security-side executor. Step S4 includes the following steps: S4.1, continuously optimizes the dynamic association rules in the association rule management submodule by using the machine learning algorithm built into the execution monitoring module; S4.2 The execution process of steps S303 and S313 is monitored and verified by the disposal execution monitoring module, and the disposal log generated in the monitoring is fed back to the security side executor and the business side executor to verify whether the security side executor and the business side executor have executed effective instructions to reduce security risks and business risks.

2. The method for ensuring the safe operation of a rail transit signaling system as described in claim 1, characterized in that, In step S1, the raw data collected from the network security device includes: firewall session logs, intrusion detection / prevention system alarms, antivirus events, and network traffic probe data; The raw data collected from the signaling system includes: status events of the automatic train monitoring system, communication messages of the automatic train protection system, control commands and status feedback of the computer interlocking system, and performance indicators of the data communication system.

3. The method for ensuring the safe operation of a rail transit signaling system as described in claim 1, characterized in that, In step S2, the asset relationship includes: the network attributes, business attributes, and topological relationships between each asset object.

4. The method for ensuring the safe operation of a rail transit signaling system as described in claim 1, characterized in that, The network feature vector includes at least the attack source IP address, target IP address, target port, and protocol type.

5. The method for ensuring the safe operation of a rail transit signaling system as described in claim 1, characterized in that, The suspicious business events include: business events that are not obvious hardware failures, or those caused by underlying network or security issues.

6. An apparatus for ensuring the safe operation of a rail transit signaling system, used to implement the method for ensuring the safe operation of a rail transit signaling system as described in any one of claims 1-5, characterized in that, Includes: a data acquisition module, a cross-domain analysis engine, and a collaborative execution module; The data acquisition module is communicatively connected to network security equipment and signal service system. The data acquisition module is configured to collect raw data from network security equipment and signal service system, and perform standardized processing to obtain network security data and service system data. The cross-domain analysis engine is communicatively connected to the data acquisition module and is configured to perform forward correlation analysis on standardized network security data and reverse source tracing analysis on business system data based on preset dynamic correlation rules, and generate disposal decision instructions. The collaborative execution module is communicatively connected to the cross-domain analysis engine and is configured to receive the handling decision instructions and send security operation instructions to the business operation and maintenance platform of network security equipment and signal service system.

7. The device for safe operation as described in claim 6, characterized in that, It also includes: a processing and execution monitoring module and a unified management portal; The disposal execution monitoring module is communicatively connected to the cross-domain analysis engine to optimize dynamic association rules based on machine learning algorithms within the disposal execution monitoring module; the disposal execution monitoring module is also communicatively connected to the collaborative execution module to feed back the generated disposal logs to the collaborative execution module to verify whether it has executed effective risk reduction instructions; The unified management portal communicates with the cross-domain analysis engine and collaborative execution module to provide global situation visualization, manual intervention interface and system configuration management functions.

8. The apparatus for safe operation as described in claim 6, characterized in that, The cross-domain analysis engine includes: The asset profile management submodule is used to pre-store asset objects, including network security equipment, signal service systems and application services, and their asset relationships, and form an asset profile library. The association rule management submodule is communicatively connected to the asset profile management submodule and is used to pre-configure dynamic association rules for each asset object and its asset relationships. The real-time analysis submodule is connected to the data acquisition module and the association rule management submodule, respectively. It can call standardized network security data and business system data, as well as call the dynamic association rules in the association rule management submodule to perform positive association processing and reverse tracing processing. The decision generation submodule communicates with the real-time analysis submodule to generate a decision instruction from the execution results of the forward correlation processing and the reverse tracing processing.

9. The apparatus for safe operation as described in claim 8, characterized in that, The real-time analysis submodule includes: a first real-time analysis submodule and a second real-time analysis submodule; The first real-time analysis submodule is communicatively connected to both the data acquisition module and the association rule management submodule to sense network security data and extract network feature vectors, and then perform positive association processing on the standardized network security data. The second real-time analysis submodule is communicatively connected to both the data acquisition module and the association rule management submodule to sense business system data and then perform reverse tracing processing on the standardized business system data.

10. The apparatus for safe operation as described in claim 9, characterized in that, The decision generation submodule includes: a first decision generation submodule and a second decision generation submodule; The first decision generation submodule is communicatively connected to the first real-time analysis submodule to generate the first disposal decision instruction in the positive correlation disposal. The second decision generation submodule is communicatively connected to the second real-time analysis submodule to generate the second disposal decision instruction in the reverse tracing disposal.

11. The apparatus for safe operation as described in claim 10, characterized in that, The collaborative execution module includes: The instruction converter is communicatively connected to both the first and second decision generation submodules. It is used to convert various disposal decision instructions into command formats that can be recognized by network security devices and business operation and maintenance platforms, that is, to convert the first disposal decision instruction into a recognizable third disposal decision instruction and to convert the second disposal decision instruction into a recognizable fourth disposal decision instruction. The security-side actuator, which is communicatively connected to the instruction converter, is used to receive identifiable third-party action decision instructions and send policy configuration, isolation, or blocking instructions to the network security device. The service-side executor is communicatively connected to the instruction converter and is used to receive identifiable fourth-handling decision instructions and send instructions to the service operation and maintenance platform of the signal service system to reduce service risks or to perform fault repair on the signal service system.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the method for ensuring the safe operation of the rail transit signaling system as described in any one of claims 1-5.

13. An electronic device, characterized in that, It includes a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, it implements the method for ensuring the safe operation of a rail transit signaling system as described in any one of claims 1-5.

Images