The invention discloses a distributed train control network intrusion detection method and a system, and a storage medium, and the method comprises the steps: capturing all TRDP messages passing through a switch in real time, and carrying out the protocol recognition and analysis of the TRDP messages; performing compliance detection on each field of the analyzed message according to a detection rule base to obtain a compliance message; performing feature extraction on a historical database composed of compliance messages and then taking the historical database as input of a neural network, training the neural network, and obtaining an anomaly detection model; and for new train control network data, marking abnormal data flow of the train control network by using the anomaly detection model and generating corresponding alarm information. According to the method, known-type attacks and unknown-type attacks of the train control network can be detected, computing resource constraints of a vehicle-mounted network management switch and the real-time requirement for detection of the known-type attacks can be met, and the capacity of detecting the unknown-type attacks through message flow features and application data is achieved; and the detection real-time performance and accuracy are greatly improved.

    本发明公开了一种分布式列车控制网络入侵检测方法、系统、存储介质,实时捕获经由交换机的所有TRDP报文,并对有TRDP报文进行协议识别与解析;根据检测规则库对解析后的报文各字段进行合规性检测,获得合规报文;将由合规报文组成的历史数据库经特征提取后作为神经网络的输入,训练所述神经网络,得到异常检测模型;对于新的列车控制网络数据,利用所述异常检测模型标记出列车控制网络异常数据流并产生相应的告警信息。本发明可以检测出列车控制网络的已知类型攻击和未知类型攻击,既可满足车载网管交换机的计算资源约束和对已知类型攻击检测的实时性要求,又具备通过报文流特征和应用数据检测未知类型攻击的能力,极大地提高了检测实时性和准确性。


    Access

    Download


    Export, share and cite



    Title :

    Distributed train control network intrusion detection method and system, and storage medium


    Additional title:

    分布式列车控制网络入侵检测方法、系统、存储介质


    Contributors:
    LUO XIANGUANG (author) / QIN YUANQING (author) / LI WEI (author) / TU HAO (author) / ZENG JUN (author) / ZHANG YANG (author) / PENG SIWEI (author) / YANG XIAOBO (author)

    Publication date :

    2022-01-07


    Type of media :

    Patent


    Type of material :

    Electronic Resource


    Language :

    Chinese


    Classification :

    IPC:    H04L TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION , Übertragung digitaler Information, z.B. Telegrafieverkehr / B61L Leiten des Eisenbahnverkehrs , GUIDING RAILWAY TRAFFIC



    DISTRIBUTED TRAIN CONTROL NETWORK INTRUSION DETECTION METHOD, SYSTEM, AND STORAGE MEDIUM

    LUO XIANGUANG / QIN YUANQING / LI WEI et al. | European Patent Office | 2023

    Free access

    Train reconnection control method and system, train and storage medium

    SONG XUHUI / WU JIAN / XIONG WEI | European Patent Office | 2025

    Free access

    Electric train, train power supply system, control method and storage medium

    LIU HUA / SHENG LI / LV QINGZENG et al. | European Patent Office | 2025

    Free access

    TRAIN OPERATION SYSTEM, TRAIN OPERATION METHOD, CONTROL CIRCUIT, AND STORAGE MEDIUM

    IURA HIROKI / TAIRA AKINORI / SANO HIROYASU et al. | European Patent Office | 2022

    Free access

    Train network, communication method, train, electronic equipment and storage medium

    WANG XIANG / CUI YULONG / WANG GUANGMAO et al. | European Patent Office | 2021

    Free access