Key Technologies Of Cyber Security Situation Awareness For Train Control Systems

With the improvement of informationization and automation,the cyber security problems of the train control system are becoming increasingly serious.Performing cyber security situational awareness,which is dynamically and comprehensively evaluate and quantify the cyber security level,is critical for enhancing the security protection level of train control systems of urban rail transit.However,due to the wide spatial distribution,massive number of devices and complex heterogeneous data formats,it is difficult to implement data acquisition and fusion,which are a potential barrier for cyber security awareness of train control systems.Based on the hierarchical structure and operation mechanisms of the train control system,combined the feature of software and hardware platform and the temporal and spatial variation of data flow,the cyber security situation assessment of single point equipment is realized with Hidden Markov Model(HMM),and then a multi-scale situation quantification method of subsystem and whole system through traffic weight is developed.Finally,based on the evolution process of cyber security risks,a cyber security situation prediction method based on Autoregressive Integrated Moving Average(ARIMA)is proposed.The main contents of this thesis are as follows:(1)Combining with architecture characteristics and information flow distribution characteristics of train control systems,the static and dynamic metrics of the train control system are respectively analyzed for single equipment,subsystems and the whole system.According to software and hardware attributes of computer nodes and distribution rules of interfaces,the key indicators of cyber security situation of the train control system are obtained,and the basic framework of situational awareness is proposed.(2)The state division method of cyber security situation indexes of train control systems based on statistical features.According to the statistical characteristics of the equipment indexes and communication link indexes,the probability density distribution function of the index is determined based on the maximum likelihood estimation and the K-S test(Kolmogorov-Smirnov test).The Lloyd-Max method is applied to implement the non-uniform amplitude partitioning of cyber situation indexes,which provides data base for situational awareness.(3)HMM-based cyber security situation assessment method for rail transit train control system.The cyber security situation is regarded as a hidden state based the observable indexes,and the fusion of single device and multiple indicators is realized based on multi-dimensional HMM.On this basis,according to the importance of equipment in subsystems and the whole system,combined with the interactive characteristics of information flow in the system,the multi-scale situation is analyzed and evaluated hierarchically based on flow weight.(4)ARIMA-based cyber security situation prediction method for rail transit train control system.Based on the evolution process of cyber security risks and the time-domain characteristics of cyber security situation,the prediction of cyber security situation trend is realized according to ARIMA.Simulation results show that the cyber security situation awareness method proposed in this thesis can effectively reflect the impact of cyber security events in train control system,and can accurately predict the situation trends in the short term,which is helpful to understand the comprehensive cyber security level of train control systems for operators.