Network security situation real-time evaluation method and system based on urban rail transit

Abstract

The invention discloses a network security situation real-time evaluation method and system based on urban rail transit, and the method comprises the steps: collecting original data from a plurality of heterogeneous data sources of an urban rail transit network, carrying out the standardization processing, and generating a standardized security event; constructing a digital twin map; calculating the risk probability of nodes in the graph by using a time-space diagram neural network model, predicting an attack path and evaluating the service influence; a stream processing engine is adopted to consume a standardized security event in real time, and model reasoning, node risk probability updating, attack path prediction and service influence evaluation are performed on a local sub-graph related to the current event in the digital twin graph; and performing real-time parameter fine tuning on the space-time diagram neural network model through an online learning mechanism, and updating the space-time diagram neural network model through an incremental learning mechanism. According to the technical scheme, real-time dynamic prediction and active defense of urban rail network security threats are achieved, and the situation awareness capability and the autonomous protection level of key infrastructures are remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of urban rail transit network security technology, and in particular to a method and system for real-time assessment of network security status based on urban rail transit. Background Technology

[0002] As a critical urban infrastructure, the safe and stable operation of urban rail transit systems directly impacts public travel efficiency, social order, and even public safety. With the deepening of "smart urban rail" construction, urban rail systems are rapidly developing towards networking, intelligence, and interconnectivity. However, this deep integration has also significantly expanded the cyberattack surface, making the cybersecurity situation in urban rail increasingly severe. Urban rail networks are no longer isolated information networks, but complex mega-systems tightly coupled with physical operating systems (such as signaling, train control, and passenger services). A successful cyberattack can trigger a chain reaction between cyberspace and physical space, leading to train service disruptions, passenger delays, and even safety accidents, causing significant economic losses and adverse social impacts.

[0003] Currently, cybersecurity analysis for urban rail transit generally employs traditional methods based on security information and event management systems. These methods primarily use rule engines or simple correlation analysis to centrally process and present alerts from security devices such as firewalls and intrusion detection systems. However, faced with the unique and complex business environment and massive amounts of heterogeneous data characteristic of urban rail transit systems, traditional methods reveal the following limitations that urgently need to be addressed: First, the depth of data fusion is insufficient, making it difficult to form a holistic perspective. The cybersecurity situation of urban rail transit is not solely determined by security device alarms, but is deeply influenced by the operational status and dependencies of underlying business systems (such as the Automatic Train Signaling System (ATS), Automatic Train Control System (ATC), and Passenger Information System (PIS)). Existing methods mainly rely on cybersecurity data, lacking systematic integration and correlation of multi-source heterogeneous data such as business logs, network traffic, and asset information. "Information silos" exist between various data types, and analysis engines cannot understand deep business logic issues such as "what impact might an abnormal network connection have on the issuance of control commands to the signaling system." This results in analysis remaining superficial and failing to assess the true risk of security incidents from the system's top level.

[0004] Second, threat analysis capabilities are static and isolated, unable to dynamically perceive attack evolution. Traditional correlation analysis rules are usually predefined and static, making it difficult to deal with complex attacks such as Advanced Persistent Threats (APTs) that have multi-stage and latent characteristics. The lateral movement of attackers within the urban rail network is a dynamic process that spans different network areas and affects multiple business systems. Existing methods lack the ability to model this spatiotemporal dynamics. They cannot effectively capture the spread path of attack behavior in the spatial dimension (such as penetration from the office network to the signal production network), nor can they predict the attacker's next stage target and its potential impact on business continuity in the temporal dimension. This leads to security analysts facing a large number of isolated alerts, making it difficult to quickly outline the complete "attack chain" and "impact chain," thus missing the best response opportunity.

[0005] Third, the analytical models have poor adaptability and cannot adapt to the rapidly changing urban rail transit environment. The urban rail transit system itself is constantly evolving; the launch of new business systems, network topology adjustments, and the emergence of new attack methods are all common occurrences. Most existing analytical models adopt a periodic offline training and update model, resulting in significant lag. The models cannot quickly adjust themselves based on real-time data streams. When new attack patterns or business changes occur that were not included in the training data, the model's analytical performance drops sharply, requiring substantial manpower and resources for data relabeling and full model retraining, demonstrating a severe lack of agility.

[0006] In summary, existing technologies suffer from three core shortcomings in the specific and critical scenario of urban rail transit: incomplete data perception, static and rigid analytical capabilities, and lagging system adaptation. Therefore, there is an urgent need in this field for a cybersecurity analysis method capable of deeply integrating multi-source data, dynamically predicting threat propagation, and possessing continuous online learning capabilities. This would enable a fundamental shift from passive response to proactive prediction, and from localized alerts to global awareness, thereby providing a robust security guarantee for the stable operation of urban rail transit. Summary of the Invention

[0007] The purpose of this invention is to provide a method and system for real-time assessment of network security situation based on urban rail transit, so as to solve the problems of one-sided data perception, static and rigid analysis capabilities, and system adaptive lag in the existing technology.

[0008] To achieve the above objectives, in a first aspect, the present invention provides a method for real-time assessment of cybersecurity status quo based on urban rail transit, comprising: Raw data is collected from multiple heterogeneous data sources in the urban rail transit network, and the raw data is standardized to generate standardized safety events. Construct and dynamically update a digital twin map to characterize the urban rail transit network; The digital twin graph is represented as an attribute graph. After feature engineering of the nodes and edges, it is input into a spatiotemporal graph neural network model. The spatiotemporal graph neural network model is used to calculate the risk probability of nodes, predict attack paths, and assess the impact on business. The standardized security events are consumed in real time using a stream processing engine, and model reasoning is performed on the local subgraphs related to the current event in the digital twin graph through incremental calculation to update the risk probability of nodes, attack path prediction, and business impact assessment. The spatiotemporal graph neural network model is fine-tuned in real time through an online learning mechanism, and updated through an incremental learning mechanism.

[0009] Optionally, the raw data includes: Real-time alarms and log data from network security devices, including firewalls, intrusion detection systems, and antivirus systems; Operation logs and business alarm data from business systems, including signaling systems, train automatic control systems, and passenger information systems; Traffic logs and status information from basic switching devices, including network switches and routers.

[0010] Optionally, the standardization process for the original data includes: The raw data is parsed by calling a parser that matches the format of the data source through a syntax parsing layer; the parser includes a regular expression parser for processing unstructured text logs, a structured parser for processing structured data, and a dictionary mapping parser for semantic transformation of coded data. The semantic normalization layer maps the parsed raw event types to predefined standard event types and maps the severity levels customized by each vendor to a unified numerical level. The context enrichment layer associates normalized events with the asset database and vulnerability database, supplementing the business attributes and vulnerability information of asset entities.

[0011] Optionally, the digital twin graph includes asset entities, business service entities, business process entities, physical device entities, and organizational role entities, as well as their network communication relationships, business dependencies, and logical hierarchical relationships.

[0012] Optionally, the business dependencies include soft dependencies, hard dependencies, control dependencies, and usage dependencies.

[0013] Optionally, the construction and dynamic updating of the digital twin map characterizing the urban rail transit network includes: Initialization is performed by importing network topology diagrams, system architecture design documents, and configuration management database information. Automatically discover network communication relationships between asset entities by using network scanning tools and network traffic data analysis; By analyzing communication traffic and logs between business systems in real time, the business dependencies between business service entities can be automatically inferred.

[0014] Optionally, the feature engineering of nodes and edges includes: For each node in the attribute graph, a feature vector is constructed that integrates static attributes and dynamic time series features. The static attributes include asset value weights and business criticality indices, and the dynamic time series features include the number of security events associated with the node within a preset time window, the distribution of security event types, and the anomaly score of resource performance indicators. Assign weights or embedding vectors to edges in the attribute graph, the weights or embedding vectors being determined based on the relation type represented by the edges.

[0015] Optionally, the spatiotemporal graph neural network model is constructed by stacking multiple spatiotemporal blocks, each of which includes a spatial convolutional layer and a temporal convolutional layer; The spatial convolutional layer is implemented using a graph attention network to calculate the attention coefficients for each node's neighbors in order to capture the propagation characteristics of cybersecurity threats in the spatial dimension. The temporal convolutional layer is implemented using gated recurrent units to process the feature vectors of each node at consecutive time steps in order to capture the evolution pattern of threats in the temporal dimension.

[0016] Optionally, the prediction of attack paths and assessment of business impact includes: Based on the node risk probability and edge weights output by the model, the most likely attack path from compromised nodes to critical business entities and its probability of occurrence are generated using an improved shortest path algorithm or a Monte Carlo random walk algorithm. Based on the predicted attack path, the business dependency graph is traversed to calculate its potential impact on upper-layer business services, and the results are output in a quantitative manner.

[0017] Optionally, the step of consuming the standardized security events in real time using a stream processing engine and performing model reasoning on the local subgraphs related to the current event in the digital twin graph through incremental calculation includes: The topology of the digital twin graph and the latest feature vectors of the nodes are maintained in the memory of the stream processing engine; When the standardized security event arrives, only a local subgraph centered on the event-related node and within a predetermined number of hops is extracted; The spatiotemporal graph neural network model is triggered to perform forward propagation inference only on the local subgraph, updating the node's risk probability, attack path prediction, and business impact assessment.

[0018] Optionally, the real-time parameter fine-tuning of the spatiotemporal graph neural network model through an online learning mechanism includes: Establish a feedback mechanism: when the attack path predicted by the model is confirmed by subsequent security events, it is recorded as a positive sample; if the prediction does not occur, it is recorded as a negative sample. The parameters of the spatiotemporal graph neural network model are continuously fine-tuned using a mini-batch gradient descent method, utilizing real-time generated positive and negative sample streams.

[0019] Optionally, updating the spatiotemporal graph neural network model through an incremental learning mechanism includes: When significant concept drift is detected, the data involving the new concept is stored in the incremental learning dataset; Regularly initiate offline incremental learning tasks, and train the model using elastic weight consolidation algorithms or progressive network algorithms on the basis of the old model to prevent catastrophic forgetting; After training and validation are completed, the new model version will be seamlessly replaced with the online model through hot deployment.

[0020] Secondly, the present invention also provides a real-time cybersecurity situation assessment system based on urban rail transit, comprising: The data acquisition and processing module is configured to acquire raw data from multiple heterogeneous data sources in the urban rail transit network, perform standardized processing on the raw data, and generate standardized safety events. The map management module is configured to build and dynamically update a digital twin map characterizing the urban rail transit network. The risk assessment module is configured to represent the digital twin graph as an attribute graph, perform feature engineering on the nodes and edges, and then input the graph into a spatiotemporal neural network model. The spatiotemporal neural network model is used to calculate the risk probability of the nodes, predict the attack path, and assess the business impact. The real-time stream processing module is configured to consume the standardized security events in real time using a stream processing engine, and to perform model reasoning on the local subgraphs in the digital twin graph related to the current event through incremental calculation, updating the risk probability of nodes, attack path prediction, and business impact assessment. The self-learning update module is configured to fine-tune the parameters of the spatiotemporal graph neural network model in real time through an online learning mechanism, and update the spatiotemporal graph neural network model through an incremental learning mechanism.

[0021] Compared with the prior art, the technical solution of the present invention has at least the following technical effects: 1. This invention introduces a dynamic threat propagation modeling method based on a spatiotemporal graph neural network model. It abandons the traditional correlation analysis based on static rules and uses the spatiotemporal graph neural network model as the core analysis engine. The method can simultaneously capture the correlation of network security threats in the spatial dimension (across network regions and along business dependency chains) and the sequential evolution pattern in the temporal dimension. This enables the system to dynamically simulate the attacker's lateral movement path, predict its next stage target, and quantitatively assess the potential impact of the attack path on the continuity of core business. This achieves a qualitative change from "isolated alerts" to "overall understanding of the attack chain and impact chain".

[0022] 2. This invention designs an adaptive evolution mechanism integrating online learning and incremental learning, solving the pain points of traditional security analysis models being slow to update and unable to adapt to rapidly changing environments. By fusing online learning (millisecond-level parameter fine-tuning based on real-time data streams to ensure the model fits the current network state) and incremental learning (absorbing new knowledge without full retraining when new attack patterns or business changes occur), the system possesses the ability to continuously self-optimize, significantly improving its agility and robustness in the face of new and unknown threats and changes in the business environment, and overcoming the high maintenance costs and response delays caused by periodic offline updates.

[0023] 3. This invention achieves a deep integration of multi-source heterogeneous data standardization and streaming real-time analysis. Through a sophisticated standardization adaptation algorithm and a real-time analysis architecture based on a stream processing engine, it seamlessly connects multiple stages such as data acquisition, graph construction, intelligent analysis, and learning updates, forming a highly efficient closed-loop system. In particular, incremental computation enables millisecond-level risk inference for large-scale graphs, ensuring the real-time performance required for critical infrastructure security analysis and realizing the full pipelineization and automation of data processing, knowledge updates, and threat analysis.

[0024] 4. This invention enhances the depth and breadth of situational awareness, achieving a global perspective. By integrating multi-dimensional data from IT, OT, and business through a digital twin graph, security managers can clearly grasp the complex relationships between assets, networks, and businesses, fundamentally changing the previous passive situation of "seeing the trees but not the forest." It enhances the predictability and foresight of threat analysis, transforming passive response into proactive defense. Based on a spatiotemporal graph neural network model, it can deduce the full picture and future trajectory of attacks, enabling security teams to provide early warnings and block critical attack paths before attackers achieve their final goals. This moves the security protection checkpoint forward, guiding operations personnel to prioritize hardening critical nodes and achieve precise deployment. The system automatically completes the correlation, filtering, sorting, and impact analysis of massive amounts of alarms, freeing security personnel from tedious "alarm noise" and allowing them to focus on high-value decisions and response actions. Simultaneously, online and incremental learning mechanisms greatly reduce the manual intervention and offline training time required for model maintenance, significantly reducing the human and resource costs of security operations.

[0025] 5. This invention enhances the system's adaptability and resilience, ensuring long-term effectiveness. Facing the continuous evolution of urban rail transit systems and the ever-changing challenges of cyber threats, the self-learning capability of this invention ensures that the analysis model will not become obsolete over time. Whether new services are launched or new attack methods emerge, the system can maintain a high level of detection and analysis capabilities through smooth knowledge updates, providing continuous, reliable, and forward-looking security protection for this critical information infrastructure of urban rail transit. Attached Figure Description

[0026] Figure 1 This is a flowchart illustrating a real-time cybersecurity situation assessment method based on urban rail transit, provided by an embodiment of the present invention. Figure 2 This is a schematic diagram of a process for standardizing raw data from multiple heterogeneous data sources, provided by an embodiment of the present invention. Figure 3 This is a flowchart illustrating the digital twin map construction and updating process provided in an embodiment of the present invention; Figure 4 A schematic diagram illustrating the process of threat propagation modeling and analysis using a spatiotemporal graph neural network model provided in an embodiment of the present invention; Figure 5 A flowchart illustrating a real-time incremental inference process based on a stream processing engine, provided as an embodiment of the present invention; Figure 6 This is a schematic diagram illustrating the workflow of an online learning and incremental learning mechanism for a model provided in an embodiment of the present invention. Detailed Implementation

[0027] The technical solutions, structural features, achieved objectives, and effects of the present invention will be described in detail below with reference to the accompanying drawings in the embodiments of the present invention.

[0028] It should be noted that the accompanying drawings are in a very simplified form and use non-precise proportions. They are only used to facilitate and clarify the purpose of illustrating the embodiments of the present invention, and are not intended to limit the implementation conditions of the present invention. Therefore, they have no substantial technical significance. Any modifications to the structure, changes in the proportional relationship, or adjustments to the size should still fall within the scope of the technical content disclosed in the present invention, provided that they do not affect the effects and objectives that the present invention can produce.

[0029] It should be noted that, in this invention, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only the expressly listed elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus.

[0030] Please see Figure 1 , Figure 1 A flowchart illustrating a real-time cybersecurity situation assessment method based on urban rail transit, provided as an embodiment of the present invention, includes: Step S1: Collect raw data from multiple heterogeneous data sources in the urban rail transit network, standardize the raw data, and generate standardized safety events; Step S2: Construct and dynamically update a digital twin map representing the urban rail transit network; Step S3: Represent the digital twin graph as an attribute graph, perform feature engineering on the nodes and edges, and input them into the spatiotemporal graph neural network model. The spatiotemporal graph neural network model is used to calculate the risk probability of nodes, predict attack paths, and assess the impact on business. Step S4: Use a stream processing engine to consume the standardized security events in real time, and perform model reasoning on the local subgraphs related to the current event in the digital twin graph through incremental calculation, and update the risk probability, attack path prediction and business impact assessment of the nodes; Step S5: Fine-tune the parameters of the spatiotemporal graph neural network model in real time through an online learning mechanism, and update the spatiotemporal graph neural network model through an incremental learning mechanism.

[0031] Specifically, in some embodiments, please refer to Figure 2 , Figure 2 This is a flowchart illustrating the standardization process (step S1) of raw data from multiple heterogeneous data sources according to an embodiment of the present invention. Step S1 includes: Raw data is collected from multiple heterogeneous data sources in the urban rail transit network through a lightweight agent or interface. The raw data includes real-time alarm and log data from network security devices, including firewalls, intrusion detection systems, and antivirus systems; operation logs and business alarm data from business systems, including signaling systems, train automatic control systems, and passenger information systems; and traffic logs and status information from basic switching equipment, including network switches and routers.

[0032] To cope with sudden data traffic spikes, all collected raw data first enters a buffer queue (such as Redis) for traffic shaping and temporary storage to ensure the stability and throughput of subsequent processing.

[0033] Subsequently, the syntax parsing layer is entered, where the corresponding parser is invoked based on the format characteristics of different data sources: For unstructured text logs (such as Syslog), a regular expression parser is used, with the system predefined regular expression rule template library for common device logs, such as the regular expression group used to parse Cisco ASA firewall logs, from which fields such as source IP, destination IP, port, protocol, and action can be extracted; for structured data such as JSON and XML (such as business alarms from modern API interfaces), a structured parser is used, which directly locates and extracts key fields through JSONPath or XPath; for encoded data (such as specific OIDs in SNMP Trap), a dictionary mapping parser is used, which converts encoded values ​​into descriptive information with semantic meaning based on a predefined dictionary.

[0034] After the syntax parsing is completed, the semantic normalization layer is entered. This layer maintains a predefined standard event type dictionary, which maps the parsed raw event types to a unified standard event type. For example, alarms about "port scanning" from different vendors' IDS (such as Port Scan, PortSweep) are uniformly mapped to the standard type ATTACK_RECONNAISSANCE. At the same time, vendor-defined severity levels (such as Cisco's 0-5 levels, Microsoft's Low / High / Critical levels) are mapped to a unified numerical level (such as 0-10).

[0035] Next, in the context enrichment layer, the normalized events are associated with the asset database and vulnerability database: by matching the IP address in the event with the configuration management database (CMDB) or automatically discovered asset information, the business attributes of the asset entity are supplemented (e.g., "this IP belongs to the Line 2 ATS application server"); if the event involves a known vulnerability, the corresponding vulnerability information is automatically associated. Finally, standardized security events containing timestamps, source assets, target assets, standard event types, unified severity levels, and rich context information are generated and pushed to real-time message buses such as Kafka using efficient serialization formats such as Avro or Protobuf for subsequent modules to consume.

[0036] For example, consider the following scenario: An unusual login attempt against the signal system server is detected.

[0037] The system collected three types of raw data: Firewall log: "2024-01-15 10:30:25 DENY TCP 192.168.10.5:58432 -> 10.10.1.100:3389"; IDS alert: "Alert: Multiple RDP connection attempts from suspicious IP"; and Business system log: "ATS_Server: 10:30:25 - Failed authentication attempt from 192.168.10.5".

[0038] The firewall logs were parsed using a regular expression parser, extracting the source IP as 192.168.10.5, the target IP as 10.10.1.100, the port as 3389, and the action as DENY. The IDS alarms were parsed using a structured parser (assuming they were in JSON format), extracting the alarm type as "RDP brute force attack" and the source IP as 192.168.10.5. The ATS logs were processed using custom parsing logic, extracting the time as 10:30:25, the event as "authentication failed," and the source IP as 192.168.10.5.

[0039] At the semantic normalization layer, the above three types of events are uniformly mapped to the standard event type ATTACK_BRUTE_FORCE, the severity level is uniformly normalized to 8 (high risk), and the protocol type is uniformly identified as RDP.

[0040] At the context enrichment layer, the target IP 10.10.1.100 was matched with the CMDB and identified as the "Line 2 ATS core server", and its business importance was marked as "extremely high". At the same time, the vulnerability database was consulted and the server was found to have the CVE-2020-0601 vulnerability. The source IP 192.168.10.5 was identified as being located in the "office network area".

[0041] The final output of the standardized security event includes the timestamp "2024-01-15T10:30:25Z", the event type "ATTACK_BRUTE_FORCE", the source asset "192.168.10.5", the target asset "Line 2 ATS core server", the severity level 8, the protocol "RDP", the description "RDP brute-force attack against the signal system server", and the vulnerability information CVE-2020-0601, the source location "office network area" and the business criticality "extremely high". This event is pushed to the real-time message bus in a standardized format.

[0042] Specifically, in some embodiments, please refer to Figure 3 , Figure 3 This is a flowchart illustrating the digital twin map construction and updating process (step S2) according to an embodiment of the present invention. Step S2 includes: First, a semantic model of the graph is designed, defining entity types, attributes, and relationships. The entity types are then expanded beyond conventional assets to include business service entities (such as "Automatic Train Monitoring System (ATS_Service"), business process entities (such as "Train Arrival and Stopping Process"), physical equipment entities (such as "Train #101" and "Platform Door"), and organizational role entities (such as "Dispatcher"), thus forming a more comprehensive digital twin representation covering multiple dimensions of IT, OT, and operational business. Secondly, the relationship types are further refined, including three core relationships: network communication relationships, such as ConnectsTo (indicating IP reachability) and RoutesThrough (indicating traffic passes through a network device); business dependency relationships, including DependsOn (soft dependency, such as the Passenger Information System PIS_Service depending on data provided by the Automatic Train Monitoring System ATS_Service), HostedOn (hard dependency, such as a business service running on a specific server), Controls (control relationship, such as ATC_Service controlling the operating status of a specific train), and Uses (use relationship, such as a dispatcher using an ATS workstation to perform operations); and logical hierarchy relationships, including Part Of (indicating affiliation, such as a switch belonging to the "signaling system safety network").

[0043] After completing the semantic model design, the graph is constructed and updated: First, through static initialization, structured information such as network topology diagrams, system architecture design documents, and configuration management databases (CMDB) are imported to build the initial skeleton of the graph, including network connections between assets, service deployment relationships, and business logic links. Then, the graph content is continuously evolved through a dynamic automated discovery mechanism. Among them, network relationship discovery uses network scanning tools (such as Nmap) and NetFlow traffic data analysis to automatically identify the actual communication behavior between assets and update the ConnectsTo relationship accordingly. Business dependencies are automatically inferred by analyzing the communication traffic and operation logs between business systems in real time. For example, if continuous system monitoring finds that the PIS server frequently obtains train arrival information from the ATS server, the relationship PIS_Service --DependsOn--> ATS_Service can be established automatically or semi-automatically. At the same time, intelligent maintenance of dependencies is achieved by combining an expert rule engine. For example, a preset rule "If the process of asset A continuously sends heartbeat packets to a specific service port of asset B, then A is considered to depend on B" is used to trigger the creation or update of the relationship when the condition is met, thereby realizing the automated and dynamic maintenance of business dependencies.

[0044] For example, consider the following scenario: constructing a dependency graph for train operation control services.

[0045] During the ontology design phase, entity types are defined as follows: Asset (including Server, NetworkDevice, Workstation), BusinessService (including ATS_Service, ATC_Service, PIS_Service), PhysicalDevice (including Train, PlatformDoor, SignalEquipment), and Vulnerability (including CVE); relationship types are defined as follows: DependsOn (business dependency), HostedOn (running on), Controls (control relationship), and ConnectedTo (network connection).

[0046] During the static initialization phase, the system imports the network topology diagram and establishes network connections between switches, routers, and servers. Simultaneously, it imports the business architecture document, constructing the logical control link from ATS_Service to ATC_Service to train control. Attributes for each asset are initialized, including IP address, operating system, affiliated line, and maintenance department. During the dynamic automation discovery phase, NetFlow traffic analysis reveals high-frequency communication between the ATS server (IP: 10.10.1.100) and the ATC controller (IP: 10.10.2.50), and the system automatically establishes a ConnectedTo relationship between them. Furthermore, analysis of business logs reveals that the PIS system calls the ATS system's train position interface before each train arrival. Based on the expert rule "If system A calls system B's API ≥ 5 times per minute, then A DependsOn B," the system automatically establishes a business dependency relationship from PIS_Service to ATS_Service.

[0047] The final graph fragment contains the following structure: office network PCs connect to the firewall via the ConnectedTo relationship, and the firewall then connects to the core switch; the core switch connects to the ATS server, which hosts the ATS_Service via the HostedOn relationship; the ATS_Service supports the ATC_Service and PIS_Service via the DependsOn relationship; the ATC_Service controls train #101 via the Controls relationship; and the PIS_Service drives the platform display screen via the Controls relationship. This graph fully integrates network, services, physical devices, and business logic, providing a high-fidelity, dynamically evolving foundational data structure for subsequent threat propagation modeling based on spatiotemporal graph neural networks.

[0048] Specifically, in some embodiments, please refer to Figure 4 , Figure 4 This is a flowchart illustrating the threat propagation modeling and analysis (step S3) using a spatiotemporal graph neural network model provided in an embodiment of the present invention. Step S3 includes: First, the generated digital twin graph is represented as an attribute graph G=(V,E,AV,AE), where V is the set of nodes, E is the set of edges, AV is the node attribute, and AE is the edge attribute (such as relationship type, weight). In the graph structure of the attribute graph, each node represents an entity, including assets, business services, physical devices, or organizational roles; each edge represents the relationship between these entities, such as network connection (ConnectsTo), business dependency (DependsOn), and hosting (HostedOn).

[0049] Next, feature engineering is performed on nodes and edges: For node features AV, the feature vector of each node integrates static attributes (such as asset value weights and business criticality indices) and dynamic time-series features (such as the number of associated security events, type distribution, and CPU / memory usage anomaly scores within the past T time period). For edge features AE, different weights or embedding vectors are assigned according to different relationship types. For example, the propagation weight of the DependsOn relationship may be higher than that of ConnectsTo because the business dependency is more direct and the risk is higher.

[0050] Based on the attribute graph, a spatiotemporal graph neural network (ST-GNN) model is constructed, consisting of spatial and temporal convolutional layers. The spatial convolutional layers employ a graph attention network (GAT), which captures spatial dependencies by calculating attention coefficients for each node's neighbors, enabling the model to learn the differences in the importance of information propagation between different nodes. The temporal convolutional layers use gated recurrent units (GRUs) to process the feature vectors of each node at consecutive time steps, thereby capturing the patterns of threat evolution over time. To capture threat propagation patterns over longer distances (multi-hops) and time spans, multiple spatiotemporal blocks consisting of "spatial convolutional layers + temporal convolutional layers" are stacked. Finally, through ST-GNN model inference, the "risk probability" of each node in the graph at the current time is calculated. Based on the node's risk probability and the edge weights, an improved shortest path algorithm (such as Dijkstra's algorithm considering risk probability) or Monte Carlo random walk is used to generate the most probable attack path from compromised nodes to key targets. In addition, based on the predicted attack path, the business dependency graph is traversed to calculate its potential impact on upper-layer business services, and this impact is output in a quantitative manner.

[0051] For example, consider the following scenario: simulating the risk of ransomware spreading from the office network to the signal system. In this embodiment, the graph structure represents 1500 asset nodes and 200 business service nodes, as well as 4500 connections and 800 business dependencies. Each node has a 256-dimensional feature vector. During the feature engineering phase, the ATS server node has a static weight of 0.95 (extremely high), and dynamic features include RDP attack count: 3, CPU anomaly: 0.1, and memory usage: 0.6; while the office network PC node has a static weight of 0.3, and dynamic features include suspicious processes: 1, external connection count: 15, and login failures: 2. Regarding edge features, the DependsOn relationship weight is set to 0.9, the ConnectedTo relationship weight is set to 0.7, and the HostedOn relationship weight is set to 1.0. During the ST-GNN model inference process, spatial convolution used GAT to detect abnormal behavior of the office network PC (192.168.10.5). By calculating its impact on neighbors, it was found that the path weight to the ATS server was the highest (0.85). Temporal convolution used GRU to analyze time series data and identified typical ransomware attack patterns, such as port scanning → RDP brute-force → suspicious file creation. Subsequently, in the threat propagation simulation, the risk value of the office network PC was calculated to be 0.65. After being transferred to the ATS server via a jump server, the risk value increased to 0.72, and the risk value of further affecting the ATC service was 0.68. The most likely attack path was predicted to be office network PC → jump server → ATS server → ATC service → train control, with a probability of 72% and an estimated impact time of 2-4 hours. Finally, business impact analysis was conducted, and the results showed that this attack would affect the automatic train dispatching and real-time location monitoring services, potentially causing delays on 5 lines, affecting approximately 20,000 passengers, and with an estimated economic loss of 500,000-1,000,000 RMB per hour.

[0052] Specifically, in some embodiments, please refer to Figure 5 , Figure 5 This is a flowchart illustrating a real-time incremental inference process (step S4) based on a stream processing engine according to an embodiment of the present invention. Step S4 includes: Employing a modern stream processing framework (such as Apache Flink) as the real-time analytics engine (stream processing engine), Flink's stateful stream processing capabilities are well-suited for this scenario. Its key advantage lies in its built-in state management capabilities. The topology (nodes, edge relationships) of the digital twin graph and the latest feature vector of each node are resident in memory as the job state, and the parameters of the trained Spatiotemporal Graph Neural Network (ST-GNN) model are loaded into memory. Standardized security events are continuously consumed from Kafka. Internally, the Flink job maintains a dynamic subgraph state, which stores the local graph structure (nodes and edges) related to the currently active events, as well as the state of each node. The latest feature vectors; when a new event arrives, the engine does not recalculate on the entire graph, but only triggers ST-GNN model inference on the local subgraph associated with the event. For example, an attack event against server A will only trigger risk recalculation on nodes within a K-hop neighbor range centered on A. This incremental calculation is the key to achieving millisecond-level response. The calculated updated risk scores, newly predicted attack paths, and other results are written to high-speed storage (such as Redis) in real time for front-end display and simultaneously pushed back to a result topic in Kafka to trigger automated response or online learning in step five.

[0053] For example, consider the following scenario: Real-time detection and response to DDoS attacks against the PIS system. At 14:25:03 on September 21, 2025, the system detects that the CPU utilization of the PIS server (IP address 10.20.1.10) instantly reaches 95%. This abnormal behavior is standardized and generates a standardized security event, which flows into the Kafka topic "pis_high_cpu_event". The Flink job consumes this event in real time and immediately updates the dynamic characteristics of the PIS server node in memory, including CPU utilization updated to 0.95, network traffic updated to 1.2Gbps (abnormally high), and connection count updated to 8500 (normal value is 200-300). Subsequently, the system extracts a local subgraph within a 3-hop neighbor range centered on the PIS server. This subgraph includes the PIS server, the upstream ATS server, and other related information. The system includes 15 nodes and 28 edges, such as the service, downstream platform displays, and connected load balancers, which is much smaller than the 1700 nodes in the full graph. On this local subgraph, the ST-GNN model performs forward propagation inference, with the entire computation taking less than 50 milliseconds. The output shows that the risk value of the PIS service node rapidly increases from 0.2 to 0.8. Finally, at 14:25:05, the system generates and pushes a real-time alarm, with the alarm type being "DDoS attack detection," the affected system being the "PIS Passenger Information System," and the risk level being marked as "severe." The recommended measures include "starting traffic cleaning and switching to a backup server." At the same time, the system automatically triggers an automated response mechanism, calls the API to enable DDoS protection devices, and completes the closed-loop process from event perception to risk assessment to response execution.

[0054] Specifically, in some embodiments, please refer to Figure 6 , Figure 6 This is a schematic diagram of the workflow (step S5) of the online learning and incremental learning mechanism for a model provided in an embodiment of the present invention. Step S5 includes: The system achieves continuous model evolution through a dual mechanism of online learning and incremental learning. In terms of online learning, the system establishes a feedback loop: when a "high-risk path" predicted by the model is confirmed by subsequent security events (such as concrete evidence of intrusion), the positive sample is recorded; conversely, if the prediction does not occur, it is recorded as a negative sample. Using these real-time generated feedback sample streams, the parameters of the spatiotemporal graph neural network model are continuously and incrementally adjusted using mini-batch gradient descent. Flink's machine learning library (Flink ML) natively supports this streaming model update, enabling the model to quickly adapt to the latest attack tactics.

[0055] In terms of incremental learning, when significant concept drift is detected (such as the emergence of new attack patterns or large-scale changes in business systems), the system initiates an incremental learning process: First, data involving new concepts (such as new attack logs) is stored in a specific incremental learning dataset; then, an offline incremental learning task is launched periodically (e.g., daily). This task does not discard the old model but uses it as a basis for training using only the new incremental learning dataset; to overcome catastrophic forgetting, techniques such as Elastic Weight Consolidation (EWC) or Progressive Networks are used to penalize drastic modifications to parameters that are important to the old task while learning new knowledge, thereby protecting existing knowledge from being forgotten; after training and validation, the new model version seamlessly replaces the online model through hot deployment without stopping the real-time analysis service.

[0056] For example, consider the following scenario: adapting to a new ransomware attack pattern in industrial control systems. Between 09:00 and 12:00 on September 20, 2025, the system detected a new attack pattern—an encryption attack targeting PLC controllers. The model previously predicted two risky paths: path A (probability 60%) and path B (probability 40%). The attacker did indeed follow path A and successfully encrypted three PLC controllers. Based on this, the system generates a positive sample, which includes the attack feature vector, the predicted path "A", the actual path "A", and a reward value of +1.0. It then fine-tunes the ST-GNN model parameters using online gradient descent (learning rate = 0.001), focusing on adjusting the attention weights related to PLC attacks. After the update, the predicted probability of path A in similar attack scenarios increases to 75%.

[0057] For example, due to the new deployment of a 5G-based train ground communication system in urban rail transit, the system detected a significant change in its business architecture, triggering an incremental learning process. During a week-long new data collection phase, the system acquired communication pattern data between 5G base stations and trains, new network topology relationships, and changes in business dependencies, compiling this data into an incremental learning dataset containing 5,000 new system operation samples. During incremental training, the EWC algorithm (forgetting penalty coefficient ewc_lambda = 1000) was used, with 50 training epochs. Training results showed that the accuracy for the old task remained at 98.2% (decreasing by only 0.3%), while the accuracy for the new task reached 95.7%, and the training time was only 2 hours (significantly reduced compared to the 12 hours required for full training). Finally, at 02:00 on January 28, 2024 (during off-peak business hours), the system performed a hot model switch: first, the current model model_v2.1.ckpt was backed up, and the new model model_v2.2.ckpt was loaded. After a 15-minute stress test to verify its stability, the analysis request traffic was gradually routed from 10% to 50% to 100% to the new model. The entire process was seamless for the user, the system smoothly completed the upgrade, and successfully identified the attack patterns targeting the new 5G network, fully demonstrating the synergistic value of online learning and incremental learning mechanisms in ensuring the timeliness and stability of the model.

[0058] Based on the same inventive concept, this embodiment also provides a real-time cybersecurity situation assessment system for urban rail transit, including: The data acquisition and processing module is configured to acquire raw data from multiple heterogeneous data sources in the urban rail transit network, perform standardized processing on the raw data, and generate standardized safety events. The map management module is configured to build and dynamically update a digital twin map characterizing the urban rail transit network. The risk assessment module is configured to represent the digital twin graph as an attribute graph, perform feature engineering on the nodes and edges, and then input the graph into a spatiotemporal neural network model. The spatiotemporal neural network model is used to calculate the risk probability of the nodes, predict the attack path, and assess the business impact. The real-time stream processing module is configured to consume the standardized security events in real time using a stream processing engine, and to perform model reasoning on the local subgraphs in the digital twin graph related to the current event through incremental calculation, updating the risk probability of nodes, attack path prediction, and business impact assessment. The self-learning update module is configured to fine-tune the parameters of the spatiotemporal graph neural network model in real time through an online learning mechanism, and update the spatiotemporal graph neural network model through an incremental learning mechanism.

[0059] Based on the real-time cybersecurity situation assessment system for urban rail transit provided in this embodiment, the real-time cybersecurity situation assessment method for urban rail transit provided in the foregoing embodiments of the present invention can be implemented, realizing real-time dynamic prediction and proactive defense against cybersecurity threats to urban rail transit, and significantly improving the situational awareness capability and autonomous protection level of critical infrastructure.

[0060] Although the present invention has been described in detail through the preferred embodiments above, it should be understood that the above description should not be considered as a limitation of the present invention. Various modifications and substitutions to the present invention will be apparent to those skilled in the art after reading the above description. Therefore, the scope of protection of the present invention should be defined by the appended claims.

Claims

1. A real-time network security situation evaluation method based on urban rail transit, characterized in that, The method comprises the following steps: Collecting raw data from multiple heterogeneous data sources of the urban rail transit network, standardizing the raw data, and generating standardized safety events; Building and dynamically updating a digital twin graph representing the urban rail transit network; Representing the digital twin graph as an attribute graph, and inputting the nodes and edges into a spatio-temporal graph neural network model after feature engineering, which is used to calculate the risk probability of nodes, predict attack paths, and evaluate business impact; Using a stream processing engine to consume the standardized safety events in real time, and through incremental calculation, updating the risk probability of nodes, attack path prediction, and business impact evaluation of the local subgraph related to the current event in the digital twin graph; Through an online learning mechanism, the spatio-temporal graph neural network model is updated in real time.

2. The cyber security posture real-time assessment method of claim 1, wherein, The raw data includes: Real-time alarms and log data from network security devices, including firewalls, intrusion detection systems, and antivirus systems; Operation logs and business alarm data from business systems, including signal systems, train automatic control systems, and passenger information systems; Traffic logs and state information from basic switching devices, including network switches and routers.

3. The cyber security posture real-time assessment method of claim 1, wherein, The standardization processing of the raw data includes: Parsing the raw data through a syntax parsing layer by calling a parser matching the data source format; the parser includes a regular expression parser for processing unstructured text logs, a structured parser for processing structured data, and a dictionary mapping parser for semantic conversion of encoded data; Mapping the parsed raw event types to predefined standard event types through a semantic normalization layer, and mapping the severity levels defined by each manufacturer to a unified numerical level; Through a context enrichment layer, the normalized events are associated with asset libraries and vulnerability libraries to supplement the business attributes and vulnerability information of asset entities.

4. The cyber security posture real-time assessment method of claim 1, wherein, The digital twin graph includes asset entities, business service entities, business process entities, physical device entities, and organization role entities, as well as their network communication relationships, business dependency relationships, and logical hierarchical relationships.

5. The cyber security posture real-time assessment method of claim 4, wherein, The business dependency relationships include soft dependency relationships, hard dependency relationships, control relationships, and usage relationships.

6. The cyber security posture real-time assessment method of claim 1, wherein, The method for building and dynamically updating a digital twin graph representing the urban rail transit network includes: Initializing the construction by importing network topology graphs, system architecture design documents, and configuration management database information; Automatically discovering network communication relationships between asset entities through network scanning tools and network traffic data analysis; Automatically inferring business dependency relationships between business service entities through real-time analysis of communication traffic and logs between business systems.

7. The cyber security posture real-time assessment method of claim 1, wherein, The feature engineering of nodes and edges includes: constructing a feature vector for each node in the attribute graph, the feature vector fusing static attributes and dynamic time series features; the static attributes include asset value weight and business criticality index, the dynamic time series features include the number of security events associated with the node within a preset time window, the distribution of security event types, and the abnormal score of resource performance indicators; assigning a weight or embedding vector to each edge in the attribute graph, the weight or embedding vector being determined based on the relationship type represented by the edge.

8. The network security posture real-time evaluation method of claim 1, wherein, the spatio-temporal graph neural network model is constructed by stacking multiple spatio-temporal blocks, each spatio-temporal block including a spatial convolution layer and a temporal convolution layer; the spatial convolution layer is implemented using a graph attention network, which is used to calculate an attention coefficient for each node's neighbor to capture the propagation characteristics of network security threats in the spatial dimension; the temporal convolution layer is implemented using a gated recurrent unit, which is used to process the feature vectors of each node at consecutive time steps to capture the evolution patterns of threats in the time dimension.

9. The cyber security posture real-time assessment method of claim 1, wherein, The predicted attack path and business impact evaluation includes: based on the node risk probability output by the model and the weight of the edge, using an improved shortest path algorithm or a Monte Carlo random walk algorithm, generating the most likely attack path from the compromised node to the critical target and its probability of occurrence; according to the predicted attack path, traversing the business dependency graph to calculate its potential impact on the upper-layer business services, and outputting in a quantitative manner.

10. The cyber security posture real-time assessment method of claim 9, wherein, The stream processing engine is used to consume the standardized security events in real time, and the spatio-temporal graph neural network model is used to perform model inference on the local subgraph related to the current event in the digital twin graph in an incremental manner, including: maintaining the topology of the digital twin graph and the latest feature vectors of the nodes in the memory of the stream processing engine; when the standardized security event arrives, only extract the local subgraph within a predetermined hop range centered on the event-related node; trigger the spatio-temporal graph neural network model to perform forward propagation inference only on the local subgraph, update the node risk probability, attack path prediction and business impact evaluation.

11. The cyber security posture real-time assessment method of claim 1, wherein, The spatio-temporal graph neural network model is continuously fine-tuned in real time through an online learning mechanism, including: establishing a feedback mechanism, when the model's predicted attack path is confirmed by subsequent security events, recording it as a positive sample, if the prediction does not occur, recording it as a negative sample; using the real-time generated positive and negative sample stream, continuously fine-tuning the parameters of the spatio-temporal graph neural network model in a small batch gradient descent manner.

12. The cyber security posture real-time assessment method of claim 1, wherein, The spatio-temporal graph neural network model is updated through an incremental learning mechanism, including: when a significant concept drift is detected, store the data related to the new concept in the incremental learning dataset; periodically start an offline incremental learning task, use the elastic weight consolidation algorithm or the progressive network algorithm to train on the basis of the old model to prevent catastrophic forgetting; after training and verification, replace the online model with the new model version seamlessly through hot deployment.

13. A real-time evaluation system for network security situation based on urban rail transit, characterized in that, ​ a collection processing module configured to collect raw data from a plurality of heterogeneous data sources of the urban rail transit network, and to perform standardization processing on the raw data to generate standardized security events; a graph management module configured to construct and dynamically update a digital twin graph for representing the urban rail transit network; a risk assessment module configured to represent the digital twin graph as an attributed graph, and to input nodes and edges into a spatio-temporal graph neural network model after feature engineering, the spatio-temporal graph neural network model being used to calculate risk probabilities of the nodes, predict attack paths, and assess business impacts; a real-time stream processing module configured to use a stream processing engine to consume the standardized security events in real time, and to perform model reasoning on a local subgraph related to a current event in the digital twin graph through incremental calculation, and to update risk probabilities of the nodes, attack path predictions, and business impact assessments; a self-learning update module configured to perform real-time parameter fine-tuning on the spatio-temporal graph neural network model through an online learning mechanism, and to update the spatio-temporal graph neural network model through an incremental learning mechanism.

Images