Rail transit-oriented function and information security integrated analysis system and method

Abstract

The application discloses a rail transit-oriented function and information security integrated analysis system and method, and belongs to the field of rail transit control. The system integrates a large language model and an automatic process, realizes joint evaluation of function safety and information safety of a train control system in a unified framework, can automatically generate a STPA model skeleton, unsafe control behaviors and cause scenarios, calculates a risk level and a minimum reinforcement measure scheme, and finally outputs an integrated analysis report and a visual chart, effectively solving the problems of separation of function and information safety analysis, dependence on manual work, low efficiency and inconsistent results in traditional methods, and significantly improving the automation, consistency and engineering practical value of safety evaluation.

Description

Technical Field

[0001] This invention relates to the field of rail transit control, and in particular to an integrated analysis system and method for functional and information security in rail transit. Background Technology

[0002] Currently, a critical technical problem urgently needs to be addressed in the safety assessment practice of train operation control systems (train control systems) in the rail transit field: the analysis processes for functional safety and information security are separated, making it difficult to form a unified overall risk view. Functional safety typically follows standards such as EN 50126 / 50129 and IEC 61508, focusing on preventing personal injury, equipment damage, and operational interruptions; while information security, based on standards such as TS 50701, GB / T 20984, and ISO / IEC 27005, focuses on assessing the confidentiality, integrity, availability, and compliance of risks such as cyberattacks and data breaches. Due to the lack of a unified loss definition and risk level system, the two sets of analyses are difficult to directly integrate in terms of models, parameters, and results. It is impossible to comprehensively present the overall risk level of "functional safety + information security" on a single risk matrix, and it is also difficult to simultaneously consider both types of safety requirements when designing reinforcement solutions.

[0003] Among existing safety analysis techniques, System-Theoretic Process Analysis (STPA) is considered an effective tool for analyzing complex control systems. This method abstracts the system into a closed-loop structure of "controller—controlled process—actuator—feedback," analyzing unsafe control behaviors and their causal scenarios at the system level. It is particularly suitable for modern, highly software-based, and networked train control systems. Existing research and practice (including modeling using the PASTA plugin) have attempted to apply STPA to analyze train control systems, for example, around RBCs... Control structures are constructed for onboard equipment and other devices, and unsafe control behaviors such as erroneous command issuance, delayed or premature command issuance, and their possible causes are enumerated. These methods provide a systematic approach to addressing the incomplete coverage of purely hardware fault analysis methods.

[0004] However, existing technical solutions have significant shortcomings. First, functional safety and information security are typically separated into two independent analysis processes, making it difficult to assess how factors such as cyberattacks can cause functional failures or quantify their combined impact within the same framework. Second, existing STPA analyses heavily rely on manual expert work. From abstracting control structures and identifying insecure control behaviors to exhaustively listing and probabilities of numerous causal scenarios, experts must manually deduce each scenario. This is not only extremely labor-intensive and time-consuming, but also prone to omissions, redundant modeling, and inconsistent risk assessment standards due to human limitations and memory biases, resulting in insufficient reproducibility and traceability of analysis results. Finally, from an engineering application perspective, models and reports are often scattered across different documents, making it difficult to update them synchronously and maintain consistency.

[0005] In summary, for complex train control systems, there is an urgent need for a new analytical method and technical tool that can achieve integrated assessment of functional safety and information security, and significantly reduce the repetitive workload of experts. An ideal solution should enable joint modeling and automated analysis under a unified risk framework, improving the overall efficiency, consistency, and traceability of safety assessments. Summary of the Invention

[0006] To overcome the shortcomings of existing technologies, this invention provides a unified and automated analysis framework to simultaneously assess the functional safety and information security risks of train control systems, significantly reduce the repetitive workload of security experts, and improve the consistency, efficiency, and traceability of the analysis.

[0007] The specific technical solution adopted in this invention is as follows: A first aspect of the present invention provides an integrated analysis system for functional and information security in rail transit, the system comprising: The input and modeling layer is used to constrain and collect information on the control structure, unacceptable losses, hazards, process model information, and descriptions of optional reference inputs of the train control system. Optional reference inputs include one or more of the following: associated design documents, applicable technical standards, and historical statistical data. The large model generation layer is used to call the large language model based on the input and the input information provided by the modeling layer to automatically generate STPA model files that conform to the STPA / PASTA syntax rules, generate unsafe control actions and multiple causal scenarios, and provide a probability level and related hazard estimate for each causal scenario. The syntax and consistency verification layer is used to automatically verify the syntax format and model element reference consistency of the STPA model file output by the large model generation layer. Risk assessment and minimum hardening layer are used to conduct a unified comprehensive risk assessment based on the verified causal scenarios and their associated probability levels and loss severity, and to solve for the minimum hardening measures set that meet the preset risk objectives and simultaneously cover functional safety and information security risks through a set coverage algorithm. The report and visualization output layer is used to automatically generate analysis reports and visualization charts containing a unified risk matrix, a list of causal scenarios, and reinforcement solutions based on the calculation results of the risk assessment and minimum reinforcement layer. The expert review layer is used to manually review and correct the intermediate results generated by the large model generation layer, and feed the correction results back to the syntax and consistency verification layer to form an analysis loop.

[0008] Specifically, the input and modeling layer includes: The system input template module is used to guide the definition of the overall overview of the train control system, the unacceptable losses to functional safety and information security and their severity levels, the system-level hazards related to functional safety and information security derived from the losses, and the key states of the control structure and process model; The control structure modeling module is used to construct the control structure model of the train control system based on expert input. The model includes at least a controller, a controlled object, a communication channel, and the control information and feedback information transmitted therein.

[0009] Specifically, the large model generation layer includes: The STPA skeleton generation module is used to automatically generate an initial STPA model file containing loss, hazard, system constraints and control structure based on the input and information provided by the modeling layer. The unsafe control behavior generation module is used to automatically enumerate and generate four types of unsafe control behaviors for each control action in the constructed control structure. The four types of unsafe control behaviors include: not provided, incorrectly provided, timing error, and stop time error. The causative scenario and probability generation module is used to generate multiple causative scenarios for each generated unsafe control action, and automatically evaluate and label the probability level and related hazards for each generated causative scenario in combination with the input optional auxiliary knowledge. The optional auxiliary knowledge includes empirical rules of general industrial systems and one or more of the following: design documents, technical standards, historical statistical accident data or expert prior estimates that can be provided by the input layer.

[0010] Furthermore, the estimation of the probability level by the cause scenario and probability generation module is based on the determination of the cause scenario type and the selection of the corresponding analysis model for quantitative calculation; the analysis model includes at least one of the following: a logical predicate chain model for malicious attacks, an exponential distribution model for system component failures caused by non-human random factors, a human reliability analysis model for human error, and a conditional probability model for environmental factors.

[0011] Specifically, the syntax and consistency verification layer includes: The syntax checking module is used to check whether the format of each element in the STPA model file conforms to the predetermined syntax specifications; The consistency check module is used to check whether the reference relationships between the elements in the STPA model file are correct and consistent.

[0012] Specifically, the risk assessment and minimum reinforcement layer include: The probability mapping module is used to map the probability level of each causative scenario to a preset frequency range, and calculate the risk contribution of each scenario to the corresponding loss by combining it with the loss severity associated with it. The risk matrix calculation module is used to summarize the risk contribution of all relevant causal scenarios for each loss type, determine and generate a unified risk matrix based on the highest probability and severity, and present functional safety and information security risks using the same set of risk level standards. The minimum reinforcement solution module is used to solve for the minimum set of reinforcement measures under the constraints of a preset risk target, based on the predefined "causing scenario-reinforcement measure" mapping relationship and by applying the set coverage algorithm. The preset risk target is to ensure that the risk level of each loss type does not exceed or is not higher than a specified level.

[0013] Furthermore, the minimum reinforcement solution module is configured to output at least one solution result containing a minimum set of reinforcement measures and a corresponding list of covered and uncovered cause scenarios, for expert review and decision-making.

[0014] Specifically, the report and visualization output layer includes: The report generation module is used to automatically generate a text analysis report based on the analysis process and results, which includes the unified risk matrix, a detailed list of causal scenarios, the minimum set of reinforcement measures solved and their coverage, and can be exported in multiple formats based on templates; The visualization module is used to generate at least one visualization chart based on the analysis results data, which is used to display the risk distribution, the proportion of risk types, and the effect comparison before and after the implementation of reinforcement measures.

[0015] Specifically, the expert review layer includes: The expert review module provides an interface for unified manual review and modification of unsafe control actions, causative scenarios and their probability levels, and candidate hardening measures generated by the large model generation layer. The update module is used to automatically update the relevant STPA model files and intermediate analysis documents based on the correction results of the expert review module, and trigger the syntax and consistency verification layer, risk assessment and minimum hardening layer to re-execute the corresponding processes to achieve iterative optimization of the analysis results.

[0016] Furthermore, the manual review provided by the expert review module includes at least one of the following operations: The automatically generated causal scenarios are merged, deleted, or supplemented. Adjust the likelihood level of the causative scenario; The initial reinforcement measures are recommended to be adjusted to correspond to existing or planned feasible engineering implementation measures.

[0017] In a second aspect, based on the same inventive concept as the first aspect of the present invention, a method for integrated functional and information security analysis of rail transit is provided, applied to an integrated functional and information security analysis system for rail transit provided in the first aspect of the present invention. The method includes the following steps: S1. Utilize the input and modeling layer to collect and structurally describe the control structure, unacceptable losses and severity, hazards, process model information, and optional reference inputs of the target train control system; S2. Based on the structured description information, the STPA model file conforming to the STPA / PASTA syntax rules is automatically generated using the large model generation layer, and unsafe control actions, causal scenarios, and scenario probability level estimates are generated. S3. Perform syntax and reference consistency checks on the STPA model file using the syntax and consistency check layer; S4. Using risk assessment and minimum hardening layer, conduct integrated risk assessment of functional safety and information security for the verified causal scenarios, combined with their associated probability and loss severity, and solve for the minimum hardening measures set that meet the preset risk objectives. S5. Utilize the report and visualization output layer to automatically generate comprehensive reports and visualizations that include risk assessment results and reinforcement plans; S6. Provides an interface for expert review and correction, corrects intermediate analysis results based on expert feedback, and triggers re-verification and risk assessment of the affected parts, forming a closed-loop analysis process.

[0018] Specifically, in step S2: The generation probability level estimation is based on the determination of the cause scenario type and the selection of the corresponding analysis model for quantitative calculation; wherein, the analysis model includes at least one of the following: a logical predicate chain model for malicious attacks, an exponential distribution model for system component failures caused by non-human random factors, a human reliability analysis model for human error, and a conditional probability model for environmental factors.

[0019] Specifically, in step S4: The risk assessment specifically involves calculating the risk contribution for each causative scenario based on the severity and probability level of the associated loss, and determining the aggregate risk level of the loss type based on the maximum probability and corresponding severity of all related causative scenarios under each loss type. The process of finding the minimum set of reinforcement measures that satisfies the preset risk target is achieved by experts defining candidate reinforcement measures for some scenarios or scenario types in advance, and obtaining the minimum set of measures that ensures the risk level of all loss types is not higher than the preset threshold by solving the set coverage problem based on the mapping relationship between "causing scenario-reinforcement measures".

[0020] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. Achieve an integrated security risk view: Through a unified functional and information security loss definition system and an integrated analysis process, the long-standing problem of the two types of security analysis being "two separate entities" has been solved. For the first time, it is possible to comprehensively present risks caused by all root causes, such as network attacks, system failures, and human operational errors, in the same risk matrix, providing comprehensive technical basis for decision-making.

[0021] 2. Significantly improve assessment efficiency and reduce expert burden: By leveraging the powerful knowledge understanding and inductive capabilities of the large language model, the STPA model construction, unsafe control behavior enumeration, and generation and preliminary rating of a wide range of causal scenarios were automatically completed. These steps, which were originally highly dependent on expert experience and time-consuming, significantly shortened the analysis cycle and minimized human oversight and bias.

[0022] 3. Ensure consistency and traceability of the analysis process: Through strict structured input constraints and automatic verification of syntax and logic consistency, the standardization, consistency and traceability of the entire chain from model building and risk analysis to report generation are ensured, making the assessment results more objective and authoritative.

[0023] 4. Provide engineering guidance for optimal decision-making: The system can not only identify risks, but also intelligently solve the minimum set of reinforcement measures that meet the target risk constraints based on the "scenario-measure" mapping. This enables reinforcement decision-making to move from qualitative to quantitative, taking into account both safety and economy, and providing direct decision support for the optimal allocation of safety engineering resources.

[0024] 5. Achieve a high-quality human-machine collaborative closed loop: An expert review and feedback module was designed, allowing security experts to review, correct, and confirm the generated content (such as causal scenarios, probability ratings, and reinforcement measures) at key nodes in the entire automated analysis process. This ensures that the machine intelligence output meets professional expectations and forms a virtuous feedback closed loop of "automated generation - expert verification - model iterative optimization," guaranteeing the practicality and reliability of the analysis results.

[0025] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures pointed out in the description, claims and drawings. Attached Figure Description

[0026] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 This is a schematic diagram of the structure of an integrated analysis system for functional and information security in rail transit according to one embodiment of the present invention.

[0028] Figure 2 This is a schematic diagram of a method for integrated analysis of functional and information security for rail transit, according to one embodiment of the present invention. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] Example 1: In one embodiment, such as Figure 1 As shown in the figure, this embodiment provides an integrated analysis system for functional and information security in rail transit, the system comprising: The input and modeling layer is used to constrain and collect information on the control structure, unacceptable losses, hazards, process model information, and descriptions of optional reference inputs of the train control system. Optional reference inputs include one or more of the following: associated design documents, applicable technical standards, and historical statistical data. The large model generation layer is used to call the large language model based on the input and the input information provided by the modeling layer to automatically generate STPA model files that conform to the STPA / PASTA syntax rules, generate unsafe control actions and multiple causal scenarios, and provide a probability level and related hazard estimate for each causal scenario. The syntax and consistency verification layer is used to automatically verify the syntax format and model element reference consistency of the STPA model file output by the large model generation layer. Risk assessment and minimum hardening layer are used to conduct a unified comprehensive risk assessment based on the verified causal scenarios and their associated probability levels and loss severity, and to solve for the minimum hardening measures set that meet the preset risk objectives and simultaneously cover functional safety and information security risks through a set coverage algorithm. The report and visualization output layer is used to automatically generate analysis reports and visualization charts containing a unified risk matrix, a list of causal scenarios, and reinforcement solutions based on the calculation results of the risk assessment and minimum reinforcement layer. The expert review layer is used to manually review and correct the intermediate results generated by the large model generation layer, and feed the correction results back to the syntax and consistency verification layer to form an analysis loop.

[0031] Furthermore, in this embodiment, the input and modeling layer includes: The system input template module is used to guide the definition of the overall overview of the train control system, the unacceptable losses to functional safety and information security and their severity levels, the system-level hazards related to functional safety and information security derived from the losses, and the key states of the control structure and process model; The control structure modeling module is used to construct the control structure model of the train control system based on expert input. The model includes at least a controller, a controlled object, a communication channel, and the control information and feedback information transmitted therein.

[0032] Furthermore, the input and modeling layer also includes optional reference inputs for associated design documents (such as system architecture specifications, interface specifications, etc.), applicable technical standards (such as EN 50126 / 50129, TS 50701, GB / T 24338.1, GB / T 20984, etc.), and historical / statistical accident data or loss probability estimates given by experts, which facilitates loss definition, hazard identification, and probability classification.

[0033] Furthermore, the definition of unacceptable loss, under the same caliber, includes loss types stemming from functional safety and information security, and these loss types include at least: personal injury, equipment damage, operational interruption, data breach, and compliance failure.

[0034] Furthermore, in this embodiment, the large model generation layer specifically includes: The STPA skeleton generation module is used to automatically generate an initial STPA model file containing loss, hazard, system constraints and control structure based on the input and information provided by the modeling layer. The unsafe control behavior generation module is used to automatically enumerate and generate four types of unsafe control behaviors for each control action in the constructed control structure. The four types of unsafe control behaviors include: not provided, incorrectly provided, timing error, and stop time error. The causative scenario and probability generation module is used to generate multiple causative scenarios for each generated unsafe control action, and automatically evaluate and label the probability level and related hazards for each generated causative scenario in combination with the input optional auxiliary knowledge. The optional auxiliary knowledge includes empirical rules of general industrial systems and one or more of the following: design documents, technical standards, historical statistical accident data or expert prior estimates that can be provided by the input layer.

[0035] Furthermore, in the large model generation layer, the STPA skeleton generation module automatically generates an initial STPA model file conforming to the PASTA model file syntax based on the input template, including the initial STPA skeleton of loss, hazard, system constraints, and control structure. The unsafe control behavior generation module, after generating four types of unsafe control behaviors, needs to write them into the initial STPA skeleton generated by the STPA skeleton generation module.

[0036] Furthermore, the causal scenario and probability generation module estimates the probability level based on the determination of the causal scenario type and selects the corresponding analysis model for quantitative calculation; the analysis model includes at least one of the following: a logical predicate chain model for malicious attacks, an exponential distribution model for system component failures caused by non-human random factors, a human reliability analysis model for human error, and a conditional probability model for environmental factors.

[0037] Furthermore, in this embodiment, the syntax and consistency verification layer includes: The syntax checking module is used to check whether the format of each element in the STPA model file conforms to the predetermined syntax specifications; The consistency check module is used to check whether the reference relationships between the elements in the STPA model file are correct and consistent.

[0038] Specifically, in the syntax and consistency verification layer, the syntax checking module checks the order of the four types of unsafe control behaviors in the STPA model file, the line format of the loss scenario section, the annotation specifications, and the legality of references, preventing syntax errors. The consistency checking module checks whether the references between control actions, process model states, hazards, and losses are consistent, preventing problems such as "referring to non-existent objects."

[0039] Furthermore, in this embodiment, the risk assessment and minimum reinforcement layer include: The probability mapping module is used to map the probability level of each causative scenario to a preset frequency range, and calculate the risk contribution of each scenario to the corresponding loss by combining it with the loss severity associated with it. The risk matrix calculation module is used to summarize the risk contribution of all relevant causal scenarios for each loss type, determine and generate a unified risk matrix based on the highest probability and severity, and present functional safety and information security risks using the same set of risk level standards. The minimum reinforcement solution module is used to solve for the minimum set of reinforcement measures under the constraints of a preset risk target, based on the predefined "causing scenario-reinforcement measure" mapping relationship and by applying the set coverage algorithm. The preset risk target is to ensure that the risk level of each loss type does not exceed or is not higher than a specified level.

[0040] Furthermore, the minimum reinforcement solution module is configured to output at least one solution result containing a minimum set of reinforcement measures and a corresponding list of covered and uncovered cause scenarios, for expert review and decision-making.

[0041] Furthermore, the risk levels include extremely high risk, relatively high risk, medium risk, relatively low risk, and extremely low risk.

[0042] Furthermore, in this embodiment, the report and visualization output layer includes: The report generation module is used to automatically generate a text analysis report based on the analysis process and results, which includes the unified risk matrix, a detailed list of causal scenarios, the minimum set of reinforcement measures solved and their coverage, and can be exported in multiple formats based on templates; The visualization module is used to generate at least one visualization chart based on the analysis results data, which is used to display the risk distribution, the proportion of risk types, and the effect comparison before and after the implementation of reinforcement measures.

[0043] Specifically, the visualization module includes charts such as pie charts, bar charts, and flowcharts.

[0044] Furthermore, in this embodiment, the expert review layer includes: The expert review module provides an interface for unified manual review and modification of unsafe control actions, causative scenarios and their probability levels, and candidate hardening measures generated by the large model generation layer. The update module is used to automatically update the relevant STPA model files and intermediate analysis documents based on the correction results of the expert review module, and trigger the syntax and consistency verification layer, risk assessment and minimum hardening layer to re-execute the corresponding processes to achieve iterative optimization of the analysis results.

[0045] Furthermore, the manual review provided by the expert review module includes at least one of the following operations: The automatically generated causal scenarios are merged, deleted, or supplemented. Adjust the likelihood level of the causative scenario; The initial reinforcement measures are recommended to be adjusted to correspond to existing or planned feasible engineering implementation measures.

[0046] Specifically, the update module automatically writes back the STPA model file based on the expert review results, re-executes the verification and risk calculation, and realizes a closed loop of "machine generation + human correction".

[0047] Furthermore, in this embodiment, the various modules of the integrated analysis system for functional and information security of rail transit are connected through file interfaces and script calls: the input and modeling layer drives the large model generation module to generate the 'STPA' skeleton, and the skeleton, unsafe control behaviors and scenarios are corrected by experts and verified by scripts before entering the risk assessment and minimum reinforcement layer, and finally the report and visualization output layer outputs the report and visualization results; experts can modify the intermediate products in any iteration round and trigger the next round of automatic calculation.

[0048] The above embodiments receive standardized definitions of loss, hazard, and control structures through the input and modeling module, fundamentally bridging the risk perspectives of functional safety and information security. The core lies in the use of a large language model-driven generation module, which automatically generates a complete STPA analysis framework: including a model skeleton, a list of unsafe control behaviors, causal scenarios, and preliminary probability level estimates. This significantly reduces the arduous manual labor required for security experts to perform systematic modeling, scenario enumeration, and probability assignment from scratch. Through the built-in risk assessment and hardening solution module, the system combines expert experience with algorithms to scientifically solve for the minimum-cost hardening scheme that meets the target risk level, ensuring the accuracy of resource allocation. Simultaneously, the system's embedded syntax and consistency verification module, as well as the expert review and feedback module, constitute a closed-loop verification and iterative optimization mechanism combining human and machine, ensuring not only the quality and logical consistency of automatically generated results but also making the analysis process transparent, traceable, and the results repeatable, significantly improving the consistency, efficiency, and engineering level of security assessment work.

[0049] Example 2: In one embodiment, such as Figure 2 As shown, this embodiment provides an integrated analysis method for functional and information security in rail transit, applied to an integrated analysis system for functional and information security in rail transit provided by this invention. The method includes the following steps: Step S1: Collect and structure the control structure, unacceptable losses and severity, hazards, process model information, and optional reference inputs of the target train control system using the input and modeling layer; Step S2: Based on the structured description information, use the large model generation layer to automatically generate an STPA model file that conforms to the STPA / PASTA syntax rules, and generate unsafe control actions, causal scenarios, and scenario probability level estimates. Step S3: Perform syntax and reference consistency checks on the STPA model file using the syntax and consistency check layer; Step S4: Using risk assessment and minimum hardening layer, conduct an integrated risk assessment of functional safety and information security for the verified causal scenarios, combining their associated probability and loss severity, and solve for the minimum set of hardening measures that meet the preset risk objectives. Step S5: Utilize the report and visualization output layer to automatically generate a comprehensive report and visualization results that include risk assessment results and reinforcement plans; Step S6: Provide an interface for expert review and correction, correct intermediate analysis results based on expert feedback, and trigger re-verification and risk assessment of the affected parts to form a closed-loop analysis process.

[0050] Specifically, in step S1 of this embodiment, the step of collecting and structurally describing the control structure, unacceptable losses, hazards, process model information, and optional reference inputs of the target train control system using the input and modeling layer includes: The process model information and optional reference inputs of the target train control system are as follows: This describes how the RBC (Rail Control Center) operates. The train is issued a departure permit, temporary speed limit, and emergency stop information. Report location, speed, and confirmation information; list system boundaries and assumptions, such as not modeling all trackside equipment separately, but abstractly representing them through input signals such as "route status, occupancy information, and temporary speed limits"; optional reference inputs: supplementary related design documents, applicable technical standards (such as EN 50126 / 50129, TS 50701, GB / T 24338.1, GBT 20984, etc.) and historical / statistical accident data or loss probability estimates given by experts, to provide a basis for subsequent likelihood classification (A–F) and risk matrix calculation.

[0051] The unacceptable losses are defined as follows: personal injury (catastrophic), damage to vehicles and facilities (severe), environmental pollution (severe), operational disruption (medium), reputational compliance (medium), data breach (lower level), and property damage (medium).

[0052] The system hazards are defined as such as "an erroneous or expired train permit is in effect", "the train is not in a braking state when necessary", "continued operation when safety-related information is inconsistent", "unauthorized access or control", etc., and are associated with the type of loss.

[0053] The control structure is defined as: RBC, Treat Train as a controller / communication channel / controlled object, and list control actions (issueMA, revokeMA, eStop, alarm), input / output signals, and key process model states (occupancy status, identity binding status, MA freshness, path consistency, TSR status, link status, etc.).

[0054] Specifically, in step S2 of this embodiment, the automatic generation of an STPA model file conforming to the STPA / PASTA syntax rules using the large model generation layer, and the generation of unsafe control actions, causal scenarios, and scenario probability level estimates, specifically includes: Skeleton generation utilizes a large language model to read templates and automatically generate STPA model files containing loss, hazard, system constraints, and control structures, ensuring that the structure conforms to PASTA syntax requirements.

[0055] Insecure control actions are generated. For each control action (issueMA, revokeMA, eStop, alarm) of RBC, four types of insecure control behaviors are generated, including: notProviding, such as "MA not issued / updated when preconditions are met"; providing, such as "MA issued incorrectly when block is occupied"; tooEarlyOrLateOrWrongOrder, such as "MA issued prematurely before identity binding is completed"; and stoppedTooSoonOrLate, such as "high privileges maintained for too long without tightening". The generated results are written to the insecure control behavior section of the STPA model file and the markdown review document.

[0056] The estimation of the causative scenario and its probability level is based on the determination of the causative scenario type and the selection of the corresponding analysis model for quantitative calculation. The analysis model includes at least one of the following: a logical predicate chain model for malicious attacks, an exponential distribution model for system component failures caused by non-human random factors, a human reliability analysis model for human error, and a conditional probability model for environmental factors.

[0057] Furthermore, the logical predicate chain model for malicious attacks models the attack paths in the attack graph using logical predicate chains, and its path success rate is calculated as follows:

[0058] In the formula, Indicates the first The overall success probability of each attack path; This indicates the total number of attack nodes contained in this attack path, which is the total number of steps that the attacker needs to overcome to complete the entire path. Indicates the first in the attack path Individual attack nodes, such as 'wireless channel penetration' or 'successful exploitation'; Indicates the first step in the attack path All the preceding parent nodes that the attacker needs to successfully complete the attack node, i.e., the attacker's prerequisite parent nodes. A step-by-step attack must first break through the set of preceding attack nodes; The conditional "driving the donkey" means that, assuming all preceding parent nodes have been successfully breached by the attacker, the first... The probability that an attack node itself is successfully compromised.

[0059] Furthermore, the exponential distribution model for system component failures caused by non-human random factors follows an exponential distribution model. This exponential distribution model is used for probability calculation of hardware failure scenarios, and its expression is:

[0060] In the formula, Indicates the first The cumulative failure probability of a hardware component failing within a specified runtime; Indicates the first The constant failure rate of a hardware component represents the probability of that hardware failing per unit of time. In rail transit scenarios, this parameter is usually taken from industry reliability standards or historical operation and maintenance statistics. This indicates the actual cumulative runtime of the hardware components.

[0061] Furthermore, the human reliability analysis model for human error employs Human Reliability Analysis (HRA) to evaluate scenarios related to human error causes. This involves decomposing key operational tasks to identify basic human events that could lead the system into an unsafe state and assigning them a baseline human error probability. Based on this, performance influencing factors such as task complexity, time pressure, human-computer interface design, and training and experience levels are introduced to adjust the baseline probability. The calculation form is typically expressed as follows:

[0062] In the formula, Represents the corrected actual probability of human error; This represents the baseline probability of human error for critical operational tasks. This indicates the total number of performance impact factors considered in the evaluation; Indicates the first The correction coefficient corresponding to each performance impact factor is used to amplify or reduce the baseline error probability based on the actual performance of that factor.

[0063] Furthermore, the conditional probability model for environmental factors is used to assess causal scenarios related to environmental and external factors using quantitative or semi-quantitative analysis methods, provided that historical statistical data or physical mechanisms are available. For continuous environmental stress factors, their impact on equipment failure rates can be described using a reliability model; for discrete external events, a conditional probability model is used to estimate the probability of system failure under specific environmental event conditions. Its basic form is...

[0064] In the formula, This represents the total probability that the final output system will fail due to external environmental factors. It represents the prior probability of a specific external environmental event (such as strong electromagnetic interference, extreme weather, etc.) occurring on its own, and is usually taken from historical meteorological / operation and maintenance statistics along the rail transit line; "Conditional driving" refers to the conditional possibility that the target rail transit system will fail given that environmental event E has already occurred.

[0065] Furthermore, in step S3 of this embodiment, the STPA model file is subjected to syntax and reference consistency checks using a syntax and consistency verification layer, including: Are all four categories of unsafe control behaviors complete and in the correct order? Does the format of the loss scenario line conform to the agreement? Does it contain errors such as referencing non-existent unsafe control behaviors, dangers, or losses?

[0066] Furthermore, the scenario format includes a scenario number, a corresponding unsafe control behavior number, a Chinese description, a probability level, and a reference to the hazard number.

[0067] Furthermore, in step S4 of this embodiment: The risk assessment specifically involves calculating the risk contribution for each causative scenario based on the severity and probability level of the associated loss, and determining the aggregate risk level of the loss type based on the maximum probability and corresponding severity of all related causative scenarios under each loss type. The process of finding the minimum set of reinforcement measures that satisfies the preset risk target is achieved by experts defining candidate reinforcement measures for some scenarios or scenario types in advance, and obtaining the minimum set of measures that ensures the risk level of all loss types is not higher than the preset threshold by solving the set coverage problem based on the mapping relationship between "causing scenario-reinforcement measures".

[0068] Specifically, risk assessment and minimum hardening solution involves risk matrix calculation and minimum hardening solution, including: calculating the risk contribution of each scenario to each loss based on its severity and probability level, and determining the aggregated risk level according to "maximum probability + severity"; outputting the corresponding risk level (extremely high risk / high risk / medium risk / low risk / extremely low risk) for each loss type, forming a unified risk matrix; experts pre-define candidate hardening measures for some scenarios or scenario types (such as "dual-bearer communication link", "sequential processing of license issuance", "centralized management of rate limiting parameters", "dual-person review of critical operations"); the script solves the problem using set coverage or approximation algorithms based on the "scenario-measure" mapping and target risk level, including: Solution A: the minimum set of measures that ensures each loss risk level is no higher than "medium"; Solution B: a further compression based on A, ensuring each loss risk level is strictly lower than "medium"; outputting a list of covered and uncovered scenarios under each solution for expert review.

[0069] Furthermore, in step S5 of this embodiment, the report and visualization output layer is used to automatically generate a comprehensive report and visualization results that include risk assessment results and reinforcement solutions. This includes: automatically generating risk matrices, loss analysis reports, and visualization charts (type distribution pie charts, risk change diagrams, before-and-after reinforcement comparisons, etc.) for functional safety and information security dimensions; and simultaneously generating summary tables and graphs for PPT presentation, which are convenient for use in reviews and reports.

[0070] Furthermore, in step S6 of this embodiment, the provision of an expert review and correction interface corrects intermediate analysis results based on expert feedback and triggers re-verification and risk assessment of the affected parts, forming a closed-loop analysis process. Specifically, safety experts review, correct, and confirm the causal scenarios, probability levels, and associated initial reinforcement measures suggestions automatically generated by the large model based on their knowledge of the train control system domain.

[0071] Furthermore, the review, revision, and determination specifically include: Merge obviously duplicated scenarios, delete unreasonable scenarios, and add missing key scenarios; Adjust the probability levels for overly optimistic or overly conservative approaches; Match the reinforcement plan with existing or planned engineering measures, and remove measures that are not feasible or have extremely low cost-effectiveness; Write the review results back to the review document and update the loss scenario segment and reinforcement scheme association information in the STPA model file simultaneously.

[0072] The above implementation scheme will "systematize, automate, and make traceable" the traditionally highly expert-dependent and fragmented STPA analysis process of train control, and simultaneously address functional safety and information security issues in a unified model, while providing a quantitative minimum hardening solution. Compared with existing technologies, it has significant structural improvements and engineering application value.

[0073] Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A functional and information security integrated analysis system for rail transit, characterized in that, include: The input and modeling layer is used to constrain and collect information on the control structure, unacceptable losses, hazards, process model information, and descriptions of optional reference inputs of the train control system. Optional reference inputs include one or more of the following: associated design documents, applicable technical standards, and historical statistical data. The large model generation layer is used to call the large language model based on the input and the input information provided by the modeling layer to automatically generate STPA model files that conform to the STPA / PASTA syntax rules, generate unsafe control actions and multiple causal scenarios, and provide a probability level and related hazard estimate for each causal scenario. The syntax and consistency verification layer is used to automatically verify the syntax format and model element reference consistency of the STPA model file output by the large model generation layer. Risk assessment and minimum hardening layer are used to conduct a unified comprehensive risk assessment based on the verified causal scenarios and their associated probability levels and loss severity, and to solve for the minimum hardening measures set that meet the preset risk objectives and simultaneously cover functional safety and information security risks through a set coverage algorithm. The report and visualization output layer is used to automatically generate analysis reports and visualization charts containing a unified risk matrix, a list of causal scenarios, and reinforcement solutions based on the calculation results of the risk assessment and minimum reinforcement layer. The expert review layer is used to manually review and correct the intermediate results generated by the large model generation layer, and feed the correction results back to the syntax and consistency verification layer to form an analysis loop.

2. The system as described in claim 1, characterized in that, The input and modeling layer includes: The system input template module is used to guide the definition of the overall overview of the train control system, the unacceptable losses to functional safety and information security and their severity levels, the system-level hazards related to functional safety and information security derived from the losses, and the key states of the control structure and process model; The control structure modeling module is used to construct the control structure model of the train control system based on expert input. The model includes at least a controller, a controlled object, a communication channel, and the control information and feedback information transmitted therein.

3. The system as described in claim 1, characterized in that, The large model generation layer includes: The STPA skeleton generation module is used to automatically generate an initial STPA model file containing loss, hazard, system constraints and control structure based on the input and information provided by the modeling layer. The unsafe control behavior generation module is used to automatically enumerate and generate four types of unsafe control behaviors for each control action in the constructed control structure. The four types of unsafe control behaviors include: not provided, incorrectly provided, timing error, and stop time error. The causative scenario and probability generation module is used to generate multiple causative scenarios for each generated unsafe control action, and automatically evaluate and label the probability level and related hazards for each generated causative scenario in combination with the input optional auxiliary knowledge. The optional auxiliary knowledge includes empirical rules of general industrial systems and one or more of the following: design documents, technical standards, historical statistical accident data or expert prior estimates that can be provided by the input layer.

4. The system as described in claim 3, characterized in that, The estimation of the probability level by the cause scenario and probability generation module is based on the determination of the cause scenario type and the selection of the corresponding analysis model for quantitative calculation. The analysis model includes at least one of the following: a logical predicate chain model for malicious attacks, an exponential distribution model for system component failures caused by non-human random factors, a human reliability analysis model for human error, and a conditional probability model for environmental factors.

5. The system as described in claim 1, characterized in that, The syntax and consistency verification layer includes: The syntax checking module is used to check whether the format of each element in the STPA model file conforms to the predetermined syntax specifications; The consistency check module is used to check whether the reference relationships between the elements in the STPA model file are correct and consistent.

6. The system as described in claim 1, characterized in that, The risk assessment and minimum reinforcement layer include: The probability mapping module is used to map the probability level of each causative scenario to a preset frequency range, and calculate the risk contribution of each scenario to the corresponding loss by combining it with the loss severity associated with it. The risk matrix calculation module is used to summarize the risk contribution of all relevant causal scenarios for each loss type, determine and generate a unified risk matrix based on the highest probability and severity, and present functional safety and information security risks using the same set of risk level standards. The minimum reinforcement solution module is used to solve the minimum set of reinforcement measures under the constraints of a preset risk target, based on the predefined "causing scenario-reinforcement measure" mapping relationship and by applying the set coverage algorithm. The preset risk target is to ensure that the risk level of each loss type does not exceed or is not higher than a specified level.

7. The system as described in claim 1, characterized in that, The minimum reinforcement solution module is configured to output at least one solution result containing a minimum set of reinforcement measures and a corresponding list of covered and uncovered cause scenarios for expert review and decision-making.

8. The system as described in claim 1, characterized in that, The report and visualization output layer includes: The report generation module is used to automatically generate a text analysis report based on the analysis process and results, which includes the unified risk matrix, a detailed list of causal scenarios, the minimum set of reinforcement measures solved and their coverage, and can be exported in multiple formats based on templates; The visualization module is used to generate at least one visualization chart based on the analysis results data, which is used to display the risk distribution, the proportion of risk types, and the effect comparison before and after the implementation of reinforcement measures.

9. The system as described in claim 1, characterized in that, The expert review layer includes: The expert review module provides an interface for unified manual review and modification of unsafe control actions, causative scenarios and their probability levels, and candidate hardening measures generated by the large model generation layer. The update module is used to automatically update the relevant STPA model files and intermediate analysis documents based on the correction results of the expert review module, and trigger the syntax and consistency verification layer, risk assessment and minimum hardening layer to re-execute the corresponding processes to achieve iterative optimization of the analysis results.

10. The system as described in claim 9, characterized in that, The manual review provided by the expert review module includes at least one of the following operations: The automatically generated causal scenarios are merged, deleted, or supplemented. Adjust the likelihood level of the causative scenario; The initial reinforcement measures are recommended to be adjusted to correspond to existing or planned feasible engineering implementation measures.

11. A method for integrated functional and information security analysis of rail transit, characterized in that, Applied to the system as described in any one of claims 1 to 10, the method comprises: The input and modeling layers are used to collect and structure information on the control structure, unacceptable losses, hazards, process model information, and optional reference inputs of the target train control system. Based on the structured description information, the large model generation layer automatically generates STPA model files that conform to the STPA / PASTA syntax rules, and generates unsafe control actions, causal scenarios, and scenario probability level estimates. The syntax and reference consistency of the STPA model file are checked using a syntax and consistency verification layer. By utilizing risk assessment and minimum hardening layers, a risk assessment integrating functional safety and information security is conducted on the verified causal scenarios, taking into account their associated probability and the severity of loss. The minimum set of hardening measures that meet the preset risk objectives is then solved. By utilizing the report and visualization output layer, a comprehensive report and visualization results containing risk assessment results and reinforcement solutions are automatically generated; It provides an interface for expert review and correction, corrects intermediate analysis results based on expert feedback, and triggers re-verification and risk assessment of the affected parts, forming a closed-loop analysis process.

12. The method as described in claim 11, characterized in that: The generation probability level estimation is based on the determination of the cause scenario type and the selection of the corresponding analysis model for quantitative calculation; the analysis model includes at least one of the following: a logical predicate chain model for malicious attacks, an exponential distribution model for system component failures caused by non-human random factors, a human reliability analysis model for human error, and a conditional probability model for environmental factors.

13. The method as described in claim 11, characterized in that: The risk assessment specifically involves calculating the risk contribution for each causative scenario based on the severity and probability level of the associated loss, and determining the aggregate risk level of the loss type based on the maximum probability and corresponding severity of all related causative scenarios under each loss type. The process of finding the minimum set of reinforcement measures that satisfies the preset risk target is achieved by experts defining candidate reinforcement measures for some scenarios or scenario types in advance, and obtaining the minimum set of measures that ensures the risk level of all loss types is not higher than the preset threshold by solving the set coverage problem based on the mapping relationship between "causing scenario-reinforcement measures".

Images