摘要
为提高基于通信的列车运行控制(CBTC)系统的信息安全防护能力,利用网络流量与设备状态信息,研究入侵检测技术。首先,根据列车运行控制系统特点,分析攻击对系统产生的影响;然后,构建网络流量与设备状态检测模型,识别系统异常;最后,应用隐马尔科夫模型(HMM)融合异常检测结果,实现系统故障与恶意入侵的区分。研究表明:该系统可通过对网络流量、设备状态等信息的收集、处理和分析,实现多种攻击的检测,从而提高CBTC系统信息安全防护水平。
In order to improve the ability of information security protection of CBTC,intrusion detection technologies were studied based on the information of network traffic and equipment status.Firstly,according to the characteristics of CBTC,the impacts of different attacks on system were analyzed.Then detection models based on network traffic and equipment status were established to identify system abnormalities.Finally,the Hidden Markov Model(HMM)was applied to build a classifier,and the anomaly detection results were fused to distinguish between system faults and malicious intrusion.The results show that the proposed intrusion detection system(IDS)can realize the detection of various attacks through collection,processing and analysis of information,so as to improve the information security protection ability of CBTC.
作者
宋雅洁
步兵
SONG Yajie;BU Bing(State Key Laboratory of Rail Traffic Control and Safety,Beijing Jiaotong University,Beijing 100044,China)
出处
《中国安全科学学报》
CAS
CSCD
北大核心
2019年第S02期161-167,共7页
China Safety Science Journal
基金
国家自然科学基金资助(61603031)
横向项目(I19L00090)
北京交通大学研究生创新基金资助(I18JB00110)
城市轨道交通北京实验室项目.
作者简介
宋雅洁(1995—),女,河北承德人,硕士研究生,主要研究方向为城市轨道交通信息安全、车地通信等。E-mail:17120267@bjtu.edu.cn;步兵,教授
