A method and system for intrusion detection based on trust metrics

Abstract

The application discloses an intrusion detection method and system based on credibility measurement, and belongs to the technical field of intrusion detection of train control systems. The intrusion detection method based on credibility measurement comprises the following steps: acquiring category characteristic data and numerical characteristic data, forming a characteristic vector, constructing a multi-dimensional credibility measurement system, and acquiring a comprehensive credibility measurement value; based on the characteristic vector and the comprehensive credibility measurement value, a characteristic sample set with time sequence characteristics is generated; based on the time sequence characteristic samples of the characteristic sample set, a structured and labeled security characteristic data set is formed; based on the security characteristic data set, an initial sparrow population is generated through chaotic mapping, and then the penalty factor and the kernel function parameter of a support vector machine are iteratively optimized through wandering disturbance, so that an anomaly detection model is acquired; and the security characteristic data set is inputted to acquire an anomaly detection result. The method can reduce the occurrence probability of threat false positives or false negatives, realize effective active defense against unknown threats, and guarantee the safety of the train control system.

Description

Technical Field

[0001] This application belongs to the field of intrusion detection technology for train control systems, and specifically relates to an intrusion detection method and system based on trust metrics. Background Technology

[0002] As rail transit transforms towards intelligence and digitalization, the information security of the high-speed train operation control system, which serves as the "nerve center" for directing the safe and efficient operation of high-speed trains, is a crucial factor in determining public safety.

[0003] Existing train control systems generally employ redundant fault-tolerant architectures to avoid catastrophic consequences from single points of failure. They also ensure data transmission integrity and authenticity by patching the communication protocol stack and safeguard against specific threats. However, these methods add security features to existing systems, lacking proactive security defenses. They cannot provide real-time, dynamic, and reliable assessments of the overall system's operational status, relying instead on passive responses to threats based on preset rules. With the emergence of persistent threats and other new attack methods, train control system security is compromised. Effective responses to unknown threats exploiting zero-day vulnerabilities or masquerading as normal business operations are difficult. Furthermore, intrusion detection technologies for detecting unknown threats lack sufficient data to build accurate baselines, relying on fixed-threshold intrusion detection rules or broad analysis rules. This makes it difficult to precisely distinguish between fluctuations in normal business operations and malicious threats, leading to numerous false alarms that disrupt normal operations. Conversely, relaxing rules to avoid false alarms can easily increase false negatives, further compromising system security. Summary of the Invention

[0004] To address the aforementioned issues, this application provides an intrusion detection method, system, device, medium, and program based on trust metrics. This method accurately distinguishes between fluctuations in normal business operations and threats posed by malicious behavior, reduces the probability of false or missed threat detections, achieves effective proactive defense against unknown threats, and ensures the security of the train control system.

[0005] One intrusion detection method based on trust metrics includes the following steps: Collect and acquire category feature data and numerical feature data to form feature vectors, and at the same time construct a multi-dimensional trust measurement system to obtain the comprehensive trust measurement value of the device; Based on the feature vector and the comprehensive confidence metric, the sample is sliced ​​and aggregated according to a preset time window to generate a feature sample set with temporal characteristics. Based on the time-series feature samples of the feature sample set, the behaviors are classified and labeled through a security labeling mechanism to form a structured, labeled security feature dataset. Based on the security feature dataset, an initial sparrow population is generated through chaotic mapping, and then the penalty factor and kernel function parameters of the support vector machine are iteratively optimized through wandering perturbation to obtain an anomaly detection model. Input the security feature dataset into the anomaly detection model to obtain anomaly detection results.

[0006] Furthermore, after obtaining the anomaly detection result, the following steps are included: Based on the anomaly detection results, an intrusion quantification assessment is performed to obtain the intrusion level; Based on the anomaly detection results and the intrusion level, a defense strategy is matched using a preset knowledge base; Based on the aforementioned defense strategy, a simulation is conducted to perform a preliminary assessment and obtain the risk level. Based on the risk level, the defense strategy is re-matched through the preset knowledge base until the risk level is lower than the preset level, at which point the defense strategy is sent back to the preset knowledge base for updating.

[0007] Furthermore, the process of collecting and acquiring category feature data and numerical feature data to form feature vectors, and simultaneously constructing a multi-dimensional trust measurement system to obtain the comprehensive trust measurement value of the device, includes the following steps: Collect and parse communication protocol messages, log data, and network traffic data to obtain the category feature data and the numerical feature data; The categorical feature data is one-hot encoded, and the numerical feature data is normalized to form the feature vector; Construct the multi-dimensional trust measurement system to evaluate the trust status of the device and obtain the comprehensive trust measurement value.

[0008] Furthermore, the construction of the multi-dimensional trust measurement system to evaluate the trust status of the device and obtain the comprehensive trust measurement value of the device includes the following steps: Assess the static reliability of the equipment and obtain static measurement results; Assess the dynamic reliability of the equipment and obtain dynamic measurement results; Assess the reliability of the device's performance and obtain performance measurement results; Based on the static measurement results, the dynamic measurement results, and the performance measurement results, the comprehensive reliability measurement value is evaluated and obtained.

[0009] Further, the step of slicing and aggregating the feature vectors and the comprehensive confidence metric value according to a preset time window to generate a feature sample set with temporal characteristics includes the following steps: Set a preset time window; The feature vectors and the comprehensive confidence metric values ​​within each preset time window are aggregated and transformed to obtain the feature sample set with temporal characteristics.

[0010] Furthermore, the time-series feature samples based on the feature sample set are categorized and labeled using a security labeling mechanism to form a structured, labeled security feature dataset, including the following steps: The feature sample set is divided into core point clusters, boundary point clusters, and noise point clusters; Based on the category feature data and the numerical feature data corresponding to the boundary point cluster, the boundary point cluster is verified, and the boundary point cluster is merged into the core point cluster and the noise point cluster. The core point cluster is additionally equipped with a trusted tag; The noise point cluster is additionally labeled with an untrusted tag; Based on the core point cluster and the noise point cluster, a security feature dataset is obtained.

[0011] Furthermore, the process of generating an initial sparrow population based on the security feature dataset through chaotic mapping, and then iteratively optimizing the penalty factor and kernel function parameters of the support vector machine through wandering perturbation to obtain an anomaly detection model, includes the following steps: Based on the aforementioned security feature dataset, an initial sparrow population is generated through chaotic mapping. Based on the initial sparrow population, the sparrow positions are iteratively updated by applying wandering perturbation, and the fitness values ​​are evaluated and obtained. Based on the fitness value, obtain the penalty factor and the kernel function parameters; An anomaly detection model is obtained based on the penalty factor and the kernel function parameters.

[0012] Furthermore, the step of performing an intrusion quantification assessment based on the anomaly detection results to obtain the intrusion level includes the following steps: Based on the anomaly detection results, the corresponding threat severity, impact scope, and business relevance are assessed through a vulnerability scoring system. The intrusion level is calculated based on the severity of the threat, the scope of impact, and the business relevance.

[0013] Furthermore, the severity of the threat is obtained using the following formula:

[0014] in, The severity of the threat, This is the attack vector for a network attack. The complexity of network attacks. The extent of the impact of the cyberattack; The scope of influence is obtained using the following formula:

[0015] in, The scope of influence, This represents the number of devices directly connected to the abnormal node. The number of business links indirectly affected by abnormal nodes; The business relevance is obtained using the following formula:

[0016] in, For the aforementioned business relevance, This describes the abnormal events in the anomaly detection results. As the core business, For semantic similarity; The intrusion level is obtained using the following formula:

[0017] in, The intrusion level is defined as [the specified level].

[0018] An intrusion detection system based on the same concept and a trust metric includes: The acquisition module is used to collect and acquire category feature data and numerical feature data, form feature vectors, and build a multi-dimensional trust measurement system to obtain the comprehensive trust measurement value of the device. The processing module is used to slice and aggregate according to a preset time window based on the feature vector and the comprehensive confidence metric value to generate a feature sample set with temporal characteristics; The annotation module is used to classify and label behaviors based on the time-series feature samples of the feature sample set through a security label annotation mechanism, forming a structured, labeled security feature dataset. The optimization module is used to generate an initial sparrow population based on the security feature dataset through chaotic mapping, and then iteratively optimize the penalty factor and kernel function parameters of the support vector machine through wandering perturbation to obtain an anomaly detection model; The detection module is used to input the security feature dataset into the anomaly detection model and obtain anomaly detection results.

[0019] An electronic device based on the same concept includes: at least one processor and at least one memory, wherein the memory is data-connected to the processor; The memory stores instructions that can be executed by at least one of the processors, and the instructions are executed by at least one of the processors to enable the at least one of the processors to perform the intrusion detection method based on trust metrics as described above.

[0020] A computer storage medium based on the same concept, the computer storage medium storing one or more instructions; When executed by one or more computers, the instructions cause one or more of the computers to implement the intrusion detection method based on trust metrics as described above.

[0021] A computer program product based on the same concept, wherein the computer program product stores at least one computer program, which is loaded and executed by a processor to enable the processor to perform the intrusion detection method based on trust metrics as described above.

[0022] Compared with the prior art, this application has the following advantages: This application's intrusion detection method based on trust metrics can extract categorical and numerical feature data from multi-source heterogeneous train control data and generate feature vectors. It then combines these feature vectors with the comprehensive trust metrics of the devices to obtain a security feature dataset based on time-series aggregation and security labels. This deeply integrates the business logic and security status of the train control system, providing a high-quality data foundation. This allows for a precise baseline for the subsequently constructed anomaly detection model, accurately distinguishing between fluctuations in normal business operations and threats from malicious behavior, thereby reducing the probability of false alarms or missed alarms. Simultaneously, it can automatically iteratively optimize the penalty factor and kernel function parameters of the support vector machine based on chaotic mapping and wandering perturbations to ensure the detection accuracy of the subsequently constructed anomaly detection model. Furthermore, based on the acquired anomaly detection results, it can perform multi-dimensional intrusion quantification assessment, dynamically adapt to the pre-set knowledge base's defense strategy, and update the pre-set knowledge base's defense strategy based on risk levels. This achieves effective proactive defense against unknown threats, ensuring the security of the train control system.

[0023] The intrusion detection system based on trust metrics in this application has the same beneficial effects as the aforementioned intrusion detection method based on trust metrics, and therefore will not be described again here.

[0024] The electronic device of this application, since it is used to perform the intrusion detection method based on trust metrics as described above, has the same beneficial effects as the intrusion detection method based on trust metrics as described above, therefore, it will not be described again here.

[0025] The computer storage medium of this application has the same beneficial effects as the trust-based intrusion detection method described above since it is used to implement the trust-based intrusion detection method described above. Therefore, it will not be described again here.

[0026] The computer program product of this application, since it is used to execute the intrusion detection method based on trust metrics as described above, has the same beneficial effects as the intrusion detection method based on trust metrics as described above, therefore, it will not be described again here.

[0027] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures pointed out in the description, claims and drawings. Attached Figure Description

[0028] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 A flowchart of an intrusion detection method based on trust metrics according to an embodiment of this application is shown; Figure 2 A schematic diagram of an intrusion detection method based on a trust metric according to an embodiment of this application is shown; Figure 3 A flowchart illustrating data annotation according to an embodiment of this application is shown; Figure 4 A flowchart illustrating the detection and classification process according to an embodiment of this application is shown; Figure 5 A schematic diagram illustrating the management principle of a train control terminal according to an embodiment of this application is shown; Figure 6 A flowchart of intrusion quantification assessment according to an embodiment of this application is shown. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0031] Reference Figure 1 and Figure 2 This application provides an intrusion detection method based on trust metrics, comprising the following steps: Collect categorical and numerical feature data to form feature vectors, and simultaneously construct a multi-dimensional trust measurement system to obtain a comprehensive trust measurement value for the device. Based on the feature vectors and the comprehensive trust measurement value, slice and aggregate according to a preset time window to generate a feature sample set with temporal characteristics. Based on the temporal feature samples of the feature sample set, classify and label behaviors through a security labeling mechanism to form a structured, labeled security feature dataset. Based on the security feature dataset, generate an initial sparrow population through chaotic mapping, and then iteratively optimize the penalty factor and kernel function parameters of the support vector machine through walking perturbation to obtain an anomaly detection model. Input the security feature dataset into the anomaly detection model to obtain anomaly detection results.

[0032] Specifically, during system operation, the system continuously collects category and numerical feature data from devices at various levels. Multi-dimensional data analysis is achieved through multiple types of detectors, and the data is preprocessed to form feature vectors. Attribute extraction is performed using statistical methods to construct a multi-dimensional trust measurement system, obtaining comprehensive trust measurement values ​​for devices at each level. Based on the feature vectors and comprehensive trust measurement values, the feature vectors and device comprehensive trust measurement values ​​are combined, sliced ​​and aggregated according to a preset time window to obtain a feature sample set. Security labels are then generated for this feature sample set, resulting in a time-series aggregated security feature dataset with security labels. This deeply integrates the business logic and security status of the train control system, providing a high-quality data foundation. This provides a precise baseline for the subsequently constructed anomaly detection model, accurately distinguishing between fluctuations in normal business operations and threats from malicious behavior, thereby reducing the probability of false alarms or missed alarms. Based on the security feature dataset, an initial sparrow population is generated through chaotic mapping. Then, the penalty factor and kernel function parameters of the support vector machine are iteratively optimized through walking perturbation to obtain an anomaly detection model. The security feature dataset is then input into the anomaly detection model to obtain anomaly detection results. The system can automatically iteratively optimize the penalty factor and kernel function parameters of the support vector machine based on Logistic chaotic mapping and walking perturbation to ensure the detection accuracy of the subsequently constructed anomaly detection model.

[0033] In some specific embodiments of this application, reference is made to Figure 3 After obtaining the anomaly detection results, the following steps are set: Based on the anomaly detection results, an intrusion quantification assessment is performed to obtain the intrusion level. Based on the anomaly detection results and the intrusion level, a defense strategy is matched using a pre-set knowledge base. Based on the defense strategy, a simulation is conducted to perform a pre-assessment and obtain the risk level. Based on the risk level, the defense strategy is re-matched using the pre-set knowledge base until the risk level is lower than the preset level, at which point the defense strategy is updated by sending it back to the pre-set knowledge base.

[0034] Specifically, after obtaining anomaly detection results, an intrusion quantification assessment is performed to calculate the corresponding intrusion level. Based on the anomaly detection results and intrusion level, a corresponding defense strategy is obtained by matching with a preset knowledge base. The obtained defense strategy is then simulated and evaluated based on the anomaly detection results to obtain the risk level when using that strategy. Another defense strategy is then obtained by matching with the preset knowledge base again based on the risk level, and the above steps are repeated until the risk level is lower than the preset level. At this point, the final obtained defense strategy is sent back to the preset knowledge base for updating. This system enables multi-dimensional intrusion quantification assessment of the obtained anomaly detection results, dynamically adapts to the defense strategies in the preset knowledge base, and updates the defense strategies in the preset knowledge base based on risk levels. This achieves effective proactive defense against unknown threats, ensuring the security of the train control system.

[0035] Furthermore, based on the abnormal events in the anomaly detection results and the quantified intrusion level, appropriate defense strategies are matched from a pre-set knowledge base. Since train control terminals are diverse and there is a strong correlation between attack types and defense actions, this method, by constructing a pre-set knowledge base with a four-dimensional index and using a similarity matching algorithm, enables accurate and rapid invocation of strategies.

[0036] The preset knowledge base includes core entries such as intrusion type database, threat level mapping, device type, and preset defense strategies. By encoding abnormal features from anomaly detection results into abnormal feature vectors, the cosine similarity between these vectors and various strategies in the preset knowledge base is calculated to select the optimal initial defense strategy. If the match with the defense strategy is insufficient, an adaptive parameter adjustment mechanism is triggered to ensure the strategy's adaptability to the real-time scenario. The initial defense strategy obtained through matching needs to be simulated and its execution results verified to avoid impacting the normal operation of train control services due to defense actions. By constructing a simulation sandbox for the train control system, the real operating environment of the train control system is replicated, and the execution effect of the defense strategy is pre-evaluated to achieve a balance between defense effectiveness and business continuity. Furthermore, the simulation sandbox of the train control system replicates the dual-ring network topology, device interaction protocols, and real-time business data. After simulating the execution of the initial defense strategy, the simulation sandbox monitors three indicators: business continuity, data integrity, and response timeliness. If the above three indicators fail to meet the standards, the defense strategy parameters are optimized in reverse. After adjusting the parameters, the defense strategy is re-matched through the preset knowledge base until the above three indicators meet the standards. The validated defense strategy will be used as the final execution plan and synchronously sent back to the preset knowledge base. The correlation between abnormal features and defense strategies is updated through a logistic regression model, completing the self-iteration of defense knowledge in the preset knowledge base.

[0037] In some specific embodiments of this application, reference is made to Figure 3 The process involves collecting categorical and numerical feature data to form feature vectors, constructing a multi-dimensional trust measurement system, and obtaining a comprehensive trust measurement value for the device. This includes the following steps: The system collects and parses communication protocol messages, log data, and network traffic data to obtain categorical and numerical feature data. Categorical feature data is one-hot encoded, and numerical feature data is normalized to form feature vectors. A multi-dimensional trust measurement system is constructed to assess the device's trustworthiness and obtain a comprehensive trust measurement value.

[0038] Specifically, the system collects and analyzes communication protocol messages from multi-source heterogeneous train control data, extracting core business instruction features such as "message type identifier, security check code, train permit number, target distance, and speed level," and transforming them into features reflecting business logic. Next, it collects and analyzes log data from the multi-source heterogeneous train control data, extracting features such as "event type, frequency of occurrence, and severity level," and quantifying them into numerical features. Finally, it collects and analyzes network traffic data from the multi-source heterogeneous train control data, and generates statistical features to characterize behavioral patterns based on time window statistics. These features are categorized into categorical feature data and numerical feature data. Min-Max normalization is performed on the numerical feature data, and One-Hot encoding is used on the categorical feature data to eliminate the influence of dimensions, forming the final standardized feature vector. Then, a multi-dimensional trust measurement system is constructed to comprehensively evaluate the trust status of the equipment, thereby obtaining a comprehensive trust measurement value. This provides a data foundation for subsequent security labeling.

[0039] In some specific embodiments of this application, reference is made to Figure 3 To construct a multi-dimensional trust measurement system, assess the trust status of devices, and obtain comprehensive trust measurement values ​​for devices, the following steps are included: Assess the device's static trustworthiness and obtain static measurement results. Assess the device's dynamic trustworthiness and obtain dynamic measurement results. Assess the device's performance trustworthiness and obtain performance measurement results. Based on the static, dynamic, and performance measurement results, evaluate and obtain a comprehensive trustworthiness measurement value.

[0040] Specifically, the trusted status of a device is evaluated from three levels: static, dynamic, and performance. Static metrics based on hashes assess the device's static trusted status by verifying consistency between hardware, firmware, and process hashes and the static security baseline, characterizing static compliance and obtaining static measurement results. Dynamic metrics based on behavioral sequences assess the device's dynamic trusted status monitoring system by evaluating the compliance of business interaction behaviors through call sequences and network communication sequences, obtaining dynamic measurement results. Resource metrics based on performance baselines assess the device's performance trusted status by monitoring CPU, memory usage, and transmission latency, evaluating performance compliance and obtaining performance measurement results. A comprehensive trusted metric value is obtained by combining the static, dynamic, and performance measurement results.

[0041] In some specific embodiments of this application, a feature sample set is obtained by slicing and aggregating based on feature vectors and comprehensive confidence metrics according to preset time windows, including the following steps: setting a preset time window; aggregating the feature vectors and comprehensive confidence metrics within each preset time window to obtain a feature sample set.

[0042] Specifically, to capture the temporal behavior patterns of the train control system, a preset time window is set. Feature vectors and comprehensive confidence metrics are sliced ​​and aggregated according to a unified time window. All feature vectors and comprehensive confidence metrics generated within each preset time window are aggregated. This transforms isolated instantaneous data points into a more representative set of feature samples that reflects the overall behavior pattern of the equipment over a time period, thus providing more comprehensive data input for subsequent clustering and labeling.

[0043] In some specific embodiments of this application, reference is made to Figure 3 Based on the feature sample set, security labels are generated, and a security feature dataset is obtained, including the following steps: The feature sample set is divided into core point clusters, boundary point clusters, and noise point clusters. Based on the categorical and numerical feature data corresponding to the boundary point clusters, the boundary point clusters are validated and then merged into the core and noise point clusters. Trusted labels are added to the core point clusters. Untrusted labels are added to the noise point clusters. A secure feature dataset is obtained based on the core and noise point clusters.

[0044] Specifically, to overcome the difficulty of determining the reliability of a single confidence metric within the middle range, the DBSCAN clustering algorithm (density-based spatial clustering algorithm) is selected. Using the aggregated feature vector and the comprehensive confidence metric as input, the feature sample set is divided into core point clusters, boundary point clusters, and noise point clusters. Points within high-density regions are designated as core point clusters, labeled with confidence tags. Outliers in low-density regions far from any core point clusters are designated as noise point clusters, labeled with untrusted tags. Points located at the edges of the core point clusters are designated as boundary point clusters. These boundary point clusters undergo secondary verification by combining their corresponding categorical and numerical feature data. The boundary point clusters are then merged into the core and noise point clusters according to the verification results, and their labels are further determined. Through these steps, a security feature vector based on the confidence metric is generated—a structured security feature dataset with multi-level security labels and time-series aggregation. This security feature dataset deeply integrates business logic and security status, laying a solid foundation for subsequent training of a high-precision anomaly detection model.

[0045] A multi-dimensional data annotation method integrating communication protocol messages, log data, network traffic data, and trust metrics is proposed. By establishing logical connections among the three, and following the process of data preprocessing, multi-dimensional trust metrics, time window aggregation, and intelligent clustering annotation, a safety label that accurately reflects the operational risks of train control equipment is generated. This provides a reliable training basis for subsequent anomaly detection models and ensures that the annotation results accurately reflect the trust status and potential safety risks of the equipment.

[0046] In some specific embodiments of this application, reference is made to Figure 4 Based on a security feature dataset, an initial sparrow population is generated through chaotic mapping. Then, the penalty factor and kernel function parameters of the support vector machine are iteratively optimized through wandering perturbation to obtain an anomaly detection model, including the following steps: Based on a security feature dataset, an initial sparrow population is generated through chaotic mapping. Using this initial population, sparrow positions are iteratively updated by applying a wandering perturbation, and fitness values ​​are evaluated. Based on these fitness values, penalty factors and kernel function parameters are obtained. Finally, an anomaly detection model is derived based on these penalty factors and kernel function parameters.

[0047] Specifically, a radial basis function (RBF) kernel is used as the kernel function for the classification algorithm. A structured security feature dataset with multi-level security labels and time-series aggregation is used as the training set. First, the penalty factor *c* and kernel parameter *g* of the Support Vector Machine (SVM) to be optimized are determined. A Logistic Chaotic Mapping Improved Sparrow Search Algorithm (SSA) is employed, setting the population size and parameter search range to generate a uniformly distributed initial sparrow population to improve population diversity. Then, the penalty factor and kernel parameter are used as optimization objectives. The fitness function aims to minimize the classification error rate of the training set. The improved Sparrow Search Algorithm iteratively updates the sparrow positions, continuously evaluating the fitness value during the process. Finally, the combination of penalty factor and kernel parameter that optimizes classification performance is output, thus obtaining an anomaly detection model based on the penalty factor and kernel parameter. The optimized anomaly detection model, combined with data labeled with multi-dimensional credibility metrics, enables automatic detection of anomalies in the train control system, providing a basis for subsequent proactive defense. In this process, a random walk perturbation needs to be applied to the combination of penalty factor and kernel function parameters that optimizes classification performance during iteration. This perturbation has a larger range in the early stages of iteration, thus enhancing global exploration capabilities. As iteration continues, the range of the perturbation gradually decreases, thereby strengthening local fine-grained search capabilities and balancing the exploration and utilization of the sparrow search algorithm. Through this method, the performance of escaping local optima and global optimization can be improved while maintaining the efficient search capabilities of the sparrow search algorithm.

[0048] Furthermore, after obtaining the optimal anomaly detection model, a structured security feature dataset with multi-level security labels and based on temporal aggregation is input into the anomaly detection model to obtain anomaly detection results, thereby supporting subsequent proactive defense steps. This application employs a support vector machine (SSA-SVM) optimized by an improved sparrow search algorithm for malicious feature classification, which can address the key impact of parameters (such as penalty function and kernel function parameters) on the performance of the anomaly detection model. Parameter adaptive optimization is achieved by introducing an improved sparrow search algorithm. The global search capability of the algorithm is enhanced through Logistic chaotic mapping and random walk strategies, ensuring a high-precision anomaly detection model with low false positives.

[0049] Furthermore, a Logistic chaotic mapping is used to initialize the sparrow population to improve its diversity and global ergodicity, thereby avoiding problems such as population aggregation or local premature convergence that are prone to occur during traditional random initialization.

[0050] The expression for the Logistic chaotic mapping is:

[0051] Among them, y n As the initial condition, y n Let ∈ [0,1], t be the current iteration number, and b be the control parameter. The control parameter plays a decisive role in the evolution of the Logistic chaotic mapping; that is, the larger the control parameter, the more uniform the distribution of the chaotic mapping. In the embodiments of this application, b is set to 4, at which point the system is in a completely chaotic state, and the distribution of the chaotic mapping is the most uniform. The sequence generated by the initial condition yn under the action of the Logistic chaotic mapping is aperiodic and non-convergent. However, outside the range [0,1], the sequence generated by the initial condition yn under the action of the Logistic chaotic mapping will converge to the corresponding specific value.

[0052] The steps for initializing a sparrow population using Logistic chaotic mapping are as follows: (1) The dimension of the optimization parameters is determined to be 2, corresponding to the penalty factor C and kernel function parameter g of the support vector machine (SVM); (2) Generate non-periodic, non-convergent, and uniformly distributed chaotic sequences through Logistic chaotic mapping; (3) Linearly map the chaotic sequence from the interval [0,1] to the actual search interval of the penalty factor C and the kernel function parameter g; (4) Generate an initial sparrow population with uniform distribution to complete the initialization.

[0053] Furthermore, during the iterative process of sparrow search, a random walk perturbation is applied to the current globally optimal sparrow, thereby enhancing the algorithm's ability to escape local optima and achieving an adaptive balance between global and local search.

[0054] The random walk process can be represented as:

[0055] Where B(t) is the set of random walk steps, cumsum is the calculation of the cumulative sum, and t is the number of random walk steps (the maximum number of iterations is taken in the embodiments of this application); r(t) is a random function, defined as:

[0056] Since the feasible region in the algorithm has boundaries, and the random walk needs to remain within the feasible region, appropriate normalization is required:

[0057] Among them, a i b is the minimum value of the random walk of the i-th dimension sparrow. i It is the maximum value of the random walk of the i-th dimension sparrow. It is the minimum value of the i-th dimension sparrow in the t-th iteration. It is the maximum value of the i-th dimension sparrow in the t-th iteration.

[0058] Assumption Let represent the position of the i-th sparrow in the t-th generation of a sparrow population in the d-th dimension, T be the maximum number of iterations, α be a random number between (0,1], Γ be a random number following a standard normal distribution, L be a matrix of size i×d with all elements being 1, and R be a matrix of size i×d with all elements being 1. [0,1] represents the warning value, and ST∈[0.5,1] represents the safety value. This represents the worst position of the sparrow in the d-th dimension at the t-th iteration. Let A represent the optimal position of a sparrow in the d-th dimension at the (t+1)-th iteration of the population, and let A be a single-row multidimensional matrix with elements of 1 or -1. , It is the current global optimal position, β represents the step size control parameter, and K is [ A random number between [1, 1] representing the direction the sparrow moves, δ is a very small constant to avoid the denominator being 0, f i f represents the fitness value of the i-th sparrow. g f is the optimal fitness value for the current sparrow population. w This is the worst fitness value for the current sparrow population.

[0059] The fitness function is as follows:

[0060] The embodiments of this application design the fitness function to minimize the training set error rate in order to achieve optimal training and testing results. Here, accuracy refers to the training accuracy rate.

[0061] The accuracy rate is shown in the following formula:

[0062] In this classification, TP (True Positive, TP) represents the true positive class, specifically the number of normal samples in normal traffic. FN (False Negative, FN) represents the false negative class, specifically the number of abnormal samples in abnormal traffic. FP (False Positive, FP) represents the false positive class, specifically the number of normal samples in abnormal traffic, i.e., false alarms. TN (True Negative, TN) represents the true negative class, specifically the number of abnormal samples in normal traffic, i.e., missed alarms.

[0063] The sparrow search algorithm process is as follows: Input: Sparrow population The population fitness function is fn = FitnessXi, and the threshold is fn. 0 .

[0064] Output: Optimal individual X(fn) (1) Initialize the population using the Logistic chaotic mapping strategy to initialize the ratio of predators to followers; (2) Calculate fitness value , and sort; (3) The sparrow updates the location of the discoverer, specifically:

[0065] (4) Sparrow updates follower positions, specifically:

[0066] (5) Sparrows update the location of the watchdog, specifically:

[0067] (6) Calculate fitness value And update the sparrow's position; (7) Using random walk Update the optimal sparrow; (8) Calculate fitness value And update the sparrow's position; (9) Whether the stopping condition is met: The current iteration count reaches the maximum iteration count, or the current optimal fitness fn < the threshold fn. 0 If the above conditions are met, exit and output the result X(fn); otherwise, repeat steps 2 to 8 above.

[0068] Furthermore, the overall flow of the intrusion detection method in the embodiments of this application is as follows: First, a structured security feature dataset based on time-series aggregation with multi-level security labels is input, and the security feature dataset is divided into a training set and a validation set according to a preset ratio for subsequent model training and validation.

[0069] Secondly, the key parameters of the SVM to be optimized are identified, namely the penalty factor C and the kernel function parameter g, and their search intervals are pre-defined.

[0070] Furthermore, an initial sparrow population is generated using a Logistic chaotic mapping to improve the population's diversity and global ergodicity, thereby avoiding problems such as population clustering or premature convergence that easily occur with traditional random initialization. The expression for the Logistic chaotic mapping is: The control parameter b is set to 4, which puts the system in a completely chaotic state and generates a uniformly distributed chaotic sequence. The chaotic sequence is then linearly mapped from the interval [0,1] to the search interval of C and g to generate an initial sparrow population. The position of each sparrow represents a set of candidate parameters (C,g), thus completing the initialization.

[0071] Fourth, the improved sparrow search algorithm enters the population iterative optimization process. During this process, the initial division of discoverers and followers is completed according to a preset ratio. Sparrows are then sorted from highest to lowest fitness value to determine the set of discoverers. Then, the positions of discoverers, followers, and watchdogs are updated sequentially to complete the population position update. For the globally optimal individual obtained in the current iteration, a random walk strategy is used for optimization. The random walk process can be represented as: In this algorithm, cumsum is used to calculate the cumulative sum, and r(t) is a binary random function, taking the value of 1 or 3 based on the relationship between the random number rand and 0.5. The result is then normalized to ensure that the optimized optimal individual position remains within the feasible region of the parameters. This random walk strategy enhances global exploration capabilities with a larger walk range in the early stages of iteration, and enhances local fine-tuning search capabilities with a gradually decreasing walk range in the later stages of iteration, achieving a balance between algorithm exploration and development. After completing the random walk optimization, it is determined whether the algorithm's stopping condition is met: either the current iteration count reaches the maximum iteration count, or the current optimal fitness fn < the threshold fn. 0If the stopping condition is not met, return to the discoverer's position update step and continue to the next iteration. If the stopping condition is met, terminate the iteration process and output the optimized penalty factor C and the optimal kernel function parameter g.

[0072] Fifth, the support vector machine model is trained using the above-mentioned optimal parameters, and the false alarm rate and false negative rate of the model are verified on the validation set to ensure that it meets the requirements of the train control system for high reliability, low false alarm rate and low false negative rate for intrusion detection.

[0073] Finally, based on the optimized support vector machine model that has been trained, the system can classify and predict the input data, output intrusion detection results and distinguish threat types, thereby achieving the assessment of the security status of the train control system and the identification of abnormal behaviors.

[0074] In some specific embodiments of this application, reference is made to Figure 5 and Figure 6 Based on the anomaly detection results, an intrusion quantification assessment is performed to obtain the intrusion level, including the following steps: Based on the anomaly detection results, a vulnerability scoring system is used to assess the corresponding threat severity, impact scope, and business relevance. Based on the threat severity, impact scope, and business relevance, the intrusion level is calculated.

[0075] Specifically, based on anomalous events detected in the anomaly detection results, a three-dimensional quantitative model of "threat severity - impact scope - business relevance" is constructed. Using a vulnerability scoring system (CVSS) and the entropy weight method, this model is used to automatically score threat severity, impact scope, and business relevance, obtaining the corresponding scores. Based on these scores, the intrusion level is further calculated.

[0076] In some specific embodiments of this application, the threat severity is obtained using the following formula:

[0077] in, To assess the severity of the threat, This is the attack vector for a network attack. The complexity of network attacks. This refers to the extent of the impact of a cyberattack.

[0078] Specifically, the severity of the threat ( (0-5 points) Referring to the attack impact dimensions of CVSSv4.0, and combining the characteristics of column control attacks, a three-level index is defined: First, the attack vectors of network attacks: remote network attacks (such as tampering with vehicle control commands) are assigned a value of 5, local process injection (such as suspicious processes) is assigned a value of 3, and physical access attacks are assigned a value of 1. Second, the complexity of network attacks: those that can be directly exploited by automated tools (such as tampering with messages) are assigned a value of 5, those that require multiple steps (such as privilege escalation and command tampering) are assigned a value of 3, and those that require physical and logical combinations are assigned a value of 1. Third, the impact of the cyberattack: 5 is assigned to cause the train to brake suddenly, 3 is assigned to cause data distortion (such as positioning deviation), and 1 is assigned to cause only log anomalies.

[0079] The scope of influence is obtained using the following formula:

[0080] in, For the scope of influence, This represents the number of devices directly connected to the abnormal node. This represents the number of business links indirectly affected by abnormal nodes.

[0081] Specifically, the scope of impact ( (0-3 points): Based on graph theory, breadth-first search (BFS) traverses the network topology of the train control system to count the number of devices directly connected to abnormal nodes and the number of business links indirectly affected by abnormal nodes.

[0082] Business relevance is obtained using the following formula:

[0083] in, For business relevance, This describes the abnormal events in the anomaly detection results. As the core business, This represents semantic similarity.

[0084] Specifically, the correlation between train control operations ( (0-2 points): The semantic similarity algorithm of the pre-trained language model (BERT) is used to calculate the semantic similarity between the description of abnormal events in the anomaly detection results and the core business of train control.

[0085] The intrusion level is obtained using the following formula:

[0086] in, This is an intrusion level.

[0087] Specifically, the intrusion level is calculated by combining scores from three dimensions: threat severity, impact scope, and business relevance. A total score is then mapped to determine the intrusion level. Specifically, a Total_Score ≥ 9 indicates an emergency intrusion level; 7 ≤ Total_Score < 9 indicates a high-risk intrusion level; 4 ≤ Total_Score < 7 indicates a medium-risk intrusion level; and Total_Score < 4 indicates a low-risk intrusion level.

[0088] This application provides an intrusion detection system based on trust metrics, comprising: a data acquisition module, a processing module, a labeling module, an optimization module, and a detection module. The data acquisition module collects categorical and numerical feature data to form feature vectors and constructs a multi-dimensional trust metrics system to obtain a comprehensive trust metrics value for the device. The processing module slices and aggregates the feature vectors and comprehensive trust metrics value according to a preset time window to obtain a feature sample set. The labeling module generates security labels based on the feature sample set to obtain a security feature dataset. The optimization module generates an initial sparrow population through chaotic mapping based on the security feature dataset, and then iteratively optimizes the penalty factor and kernel function parameters of the support vector machine through walk perturbation to obtain an anomaly detection model. The detection module inputs the security feature dataset into the anomaly detection model to obtain anomaly detection results.

[0089] Furthermore, by employing acquisition, processing, and labeling modules, a dynamic trust baseline covering the entire train control system is constructed, providing high-quality data with multi-level safety tags for subsequent anomaly detection. Specifically, lightweight trusted chips are embedded in key sensors and actuators such as track circuits, transponders, ground electronic units (LEUs), and axle counting equipment, and their firmware and configurations are statically measured to ensure the trustworthiness of the equipment's startup state. Trusted software bases are deployed in servers of safety-critical systems such as the Radio Block Center (RBC), Train Control Center (TCC), Computer Interlocking (CBI), and Temporary Speed ​​Limiting Server (TSRS), collaborating with underlying trusted chips to build a complete trust chain from hardware to application software, and dynamically measuring its key processes, memory, and network connection behavior in real time. A trusted computing environment is built in the onboard computer to perform performance measurements on core safety software (such as ATP control logic). When the intrusion detection system based on trust metrics is running, the acquisition module continuously collects communication protocol messages, log data, and network traffic data from devices at all levels. It achieves multi-dimensional data analysis through multiple types of detectors. The processing module performs Min-Max normalization on numerical feature data and One-Hot encoding on categorical feature data. Then, it extracts attributes through statistical methods. The labeling module establishes a multi-dimensional network transmission status trust metric function to label abnormal data. By using the evaluation value as a security label to accurately label the corresponding traffic and data sequences, a structured security feature dataset with multi-level security labels and time-series aggregation is obtained. This can transform the raw data into a training set that can be used to train machine learning models.

[0090] Furthermore, by optimizing the module and the detection module as the intelligent analysis hub of the intrusion detection system based on trust metrics, and using security feature datasets labeled with trust metrics for training and analysis, it can accurately identify abnormal behaviors that deviate from the trust baseline. Specifically, a trust security management center is deployed in the station's central computer room, and the core anomaly detection model is trained and optimized using data from across the entire railway network, enabling the detection of cross-regional coordinated attacks.

[0091] Furthermore, the detection module adopts a center-edge collaborative deployment approach. At least one lightweight local detection engine is deployed on each train control terminal (RBC, TCC, ATP mainframe, and its maintenance unit, etc.). This local detection engine continuously performs static and dynamic measurements to achieve real-time anomaly detection on the local train control equipment. When malicious behavior is detected, the detection module can trigger a pre-defined proactive response locally. An optimization module is deployed in the safety management center of the central computer room to perform offline model training on large-scale historical data and parameter optimization of the support vector machine using the sparrow search algorithm. After generating the optimal anomaly detection model, it is distributed to each edge terminal of the train control system via the optimization module. Simultaneously, the safety management center uniformly defines and distributes detection rules and response strategies.

[0092] Furthermore, regarding the abnormal detection results of intrusion detection, a proactive defense module is set up to implement trusted feedback and a hierarchical early warning response mechanism, thereby isolating malicious nodes and preventing malicious programs from spreading in the train control system, thus achieving proactive defense for the train control system. A proactive defense module based on trusted metrics is constructed, enabling the train control terminal to activate a dynamic response proactive defense mechanism when malicious behavior is detected by the abnormal detection results. This promptly alerts the security management center and blocks further penetration of malicious attacks into the terminal.

[0093] Furthermore, when the train control terminal detects a malicious attack originating from an abnormal sensor or onboard device in the field control layer, or finds its credibility to be low, it will add it to the list of nodes to be observed for fine-grained credibility measurement. If it is determined to be a malicious train control sensing device, it will be isolated and removed from the train control system to prevent the malicious program from spreading within the system. Specifically, when the anomaly detection model detects malicious traffic intruding into the train control terminal, it will utilize a multi-layered dynamic response protection mechanism to promptly issue an alarm and take corresponding defense strategies based on a preset knowledge base, including closing the corresponding attacked ports, increasing the measurement frequency, and raising the credibility threshold. (Referring to...) Figure 5 Based on their different roles in management, the active defense of train control terminals can be divided into layers, including the equipment layer, the event layer, and the decision layer.

[0094] The execution layer consists of the train control terminal, which includes the acquisition module, processing module, and annotation module. It is responsible for monitoring itself and the train control sensing equipment, real-time reliable measurement, and anomaly detection. It collects safety events generated by the equipment and sends them to the event layer of the safety management center after preprocessing.

[0095] Both the event layer and the decision layer are located in the security management center. The event layer processes security events provided by the execution layer, merges redundant events, correlates various alarm events, generates unified security alarm events, converts the format, and sends them to the decision layer for further processing. The decision layer also records the security event in the event database and performs management tasks such as searching, displaying, and modifying the log database. The decision layer analyzes the security events provided by the event layer, matches policy defenses, and generates response rules. These rules include, but are not limited to, updating access control policies, updating software whitelists, backing up critical data, temporarily closing vulnerable ports, increasing the frequency of trusted metrics, and raising trusted thresholds. This enables management functions such as adding, deleting, and editing security policies.

[0096] This application provides an electronic device, including at least one processor and at least one memory, wherein the memory is data-connected to the processor.

[0097] The memory stores instructions that can be executed by at least one processor, and the instructions are executed by at least one processor to enable at least one processor to perform the intrusion detection method based on trust metrics as described in any of the above specific embodiments.

[0098] This application provides a computer storage medium that stores one or more instructions.

[0099] When executed by one or more computers, the instructions cause one or more computers to implement the intrusion detection method based on trust metrics as described in any of the specific embodiments above.

[0100] This application provides a computer program product storing at least one computer program, which is loaded and executed by a processor to enable the processor to execute the intrusion detection method based on trust metrics as described in any of the above specific embodiments.

[0101] Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. An intrusion detection method based on trust metrics, characterized in that, Includes the following steps: Collect and acquire category feature data and numerical feature data to form feature vectors, and at the same time construct a multi-dimensional trust measurement system to obtain the comprehensive trust measurement value of the device; Based on the feature vector and the comprehensive confidence metric, the sample is sliced ​​and aggregated according to a preset time window to generate a feature sample set with temporal characteristics. Based on the time-series feature samples of the feature sample set, the behaviors are classified and labeled through a security labeling mechanism to form a structured, labeled security feature dataset. Based on the security feature dataset, an initial sparrow population is generated through chaotic mapping, and then the penalty factor and kernel function parameters of the support vector machine are iteratively optimized through wandering perturbation to obtain an anomaly detection model. Input the security feature dataset into the anomaly detection model to obtain anomaly detection results.

2. The intrusion detection method based on trust metrics according to claim 1, characterized in that, After obtaining the anomaly detection result, the following steps are set: Based on the anomaly detection results, an intrusion quantification assessment is performed to obtain the intrusion level; Based on the anomaly detection results and the intrusion level, a defense strategy is matched using a preset knowledge base; Based on the aforementioned defense strategy, a simulation is conducted to perform a preliminary assessment and obtain the risk level. Based on the risk level, the defense strategy is re-matched through the preset knowledge base until the risk level is lower than the preset level, at which point the defense strategy is sent back to the preset knowledge base for updating.

3. The intrusion detection method based on trust metrics according to claim 1, characterized in that, The process of collecting categorical and numerical feature data to form feature vectors, and simultaneously constructing a multi-dimensional trust measurement system to obtain a comprehensive trust measurement value for the device, includes the following steps: Collect and parse communication protocol messages, log data, and network traffic data to obtain the category feature data and the numerical feature data; The categorical feature data is one-hot encoded, and the numerical feature data is normalized to form the feature vector; Construct the multi-dimensional trust measurement system to evaluate the trust status of the device and obtain the comprehensive trust measurement value.

4. The intrusion detection method based on trust metrics according to claim 3, characterized in that, The construction of the multi-dimensional trust measurement system to evaluate the trust status of the device and obtain the comprehensive trust measurement value of the device includes the following steps: Assess the static reliability of the equipment and obtain static measurement results; Assess the dynamic reliability of the equipment and obtain dynamic measurement results; Assess the reliability of the device's performance and obtain performance measurement results; Based on the static measurement results, the dynamic measurement results, and the performance measurement results, the comprehensive reliability measurement value is evaluated and obtained.

5. The intrusion detection method based on trust metrics according to claim 1, characterized in that, The step of generating a feature sample set with temporal characteristics by slicing and aggregating the feature vector and the comprehensive confidence metric value according to a preset time window includes the following steps: Set a preset time window; The feature vectors and the comprehensive confidence metric values ​​within each preset time window are aggregated and transformed to obtain the feature sample set with temporal characteristics.

6. The intrusion detection method based on trust metrics according to claim 1, characterized in that, The time-series feature samples based on the feature sample set are categorized and labeled using a security labeling mechanism to form a structured, labeled security feature dataset, including the following steps: The feature sample set is divided into core point clusters, boundary point clusters, and noise point clusters; Based on the category feature data and the numerical feature data corresponding to the boundary point cluster, the boundary point cluster is verified, and the boundary point cluster is merged into the core point cluster and the noise point cluster. The core point cluster is additionally equipped with a trusted tag; The noise point cluster is additionally labeled with an untrusted tag; Based on the core point cluster and the noise point cluster, a security feature dataset is obtained.

7. The intrusion detection method based on trust metrics according to claim 1, characterized in that, The process of generating an initial sparrow population based on the security feature dataset through chaotic mapping, and then iteratively optimizing the penalty factor and kernel function parameters of the support vector machine through wandering perturbation to obtain an anomaly detection model, includes the following steps: Based on the aforementioned security feature dataset, an initial sparrow population is generated through chaotic mapping. Based on the initial sparrow population, the sparrow positions are iteratively updated by applying wandering perturbation, and the fitness values ​​are evaluated and obtained. Based on the fitness value, obtain the penalty factor and the kernel function parameters; An anomaly detection model is obtained based on the penalty factor and the kernel function parameters.

8. The intrusion detection method based on trust metrics according to claim 2, characterized in that, The step of performing intrusion quantification assessment and obtaining the intrusion level based on the anomaly detection results includes the following steps: Based on the anomaly detection results, the corresponding threat severity, impact scope, and business relevance are assessed through a vulnerability scoring system. The intrusion level is calculated based on the severity of the threat, the scope of impact, and the business relevance.

9. The intrusion detection method based on trust metrics according to claim 8, characterized in that, The severity of the threat is obtained using the following formula: in, The severity of the threat, This is the attack vector for a network attack. The complexity of network attacks. The extent of the impact of the cyberattack; The scope of influence is obtained using the following formula: in, The scope of influence, This represents the number of devices directly connected to the abnormal node. The number of business links indirectly affected by abnormal nodes; The business relevance is obtained using the following formula: in, For the aforementioned business relevance, This describes the abnormal events in the anomaly detection results. As the core business, For semantic similarity; The intrusion level is obtained using the following formula: in, The intrusion level is defined as [the specified level].

10. An intrusion detection system based on trust metrics, characterized in that, include: The acquisition module is used to collect and acquire category feature data and numerical feature data, form feature vectors, and build a multi-dimensional trust measurement system to obtain the comprehensive trust measurement value of the device. The processing module is used to slice and aggregate according to a preset time window based on the feature vector and the comprehensive confidence metric value to generate a feature sample set with temporal characteristics; The annotation module is used to classify and label behaviors based on the time-series feature samples of the feature sample set through a security label annotation mechanism, forming a structured, labeled security feature dataset. The optimization module is used to generate an initial sparrow population based on the security feature dataset through chaotic mapping, and then iteratively optimize the penalty factor and kernel function parameters of the support vector machine through wandering perturbation to obtain an anomaly detection model; The detection module is used to input the security feature dataset into the anomaly detection model and obtain anomaly detection results.

11. An electronic device, characterized in that, include: At least one processor and at least one memory, wherein the memory is data-connected to the processor; The memory stores instructions that can be executed by at least one of the processors, and the instructions are executed by at least one of the processors to enable the at least one of the processors to perform the intrusion detection method based on trust metrics as described in any one of claims 1 to 9.

12. A computer storage medium, characterized in that, The computer storage medium stores one or more instructions; When executed by one or more computers, the instructions cause one or more of the computers to implement the intrusion detection method based on trust metrics as described in any one of claims 1 to 9.

13. A computer program product, characterized in that, The computer program product stores at least one computer program, which is loaded and executed by a processor to enable the processor to perform the intrusion detection method based on trust metrics as described in any one of claims 1 to 9.

Images