| The introduction of the ethernet industrial protocol makes the train control system more open,which is conducive to breaking the status of isolated information,improving the operational efficiency of rail transit and the experience of drivers and passengers.But at the same time,it also brings increasingly severe threats to cyber security.Therefore,it is imperative to strengthen the security protection of train control system.Intrusion detection is one of the key technical means for security protection of train control system which is currently faced with the rapid growth of traffic scale and the frequent occurrence of unknown attacks.Rule-based misuse detection cannot effectively identify unknown attacks,while machine learning based anomaly detection has problems such as difficulty in obtaining real train network communication data,large differences in the simulated communication environment with public test data-sets,overfitting of deep neural networks,and low accuracy of intrusion detection model etc.To address the challenges of anomaly detection mentioned above,a train braking system model is established through dynamic analysis in this thesis.Based on this model,a hardware-in-the-loop simulation platform of train control system is built with the train realtime data protocol,and a simulation dataset of intrusion detection similar to the actual operating environment of the train is obtained by injecting typical attacks.According to the spatiotemporal characteristics of network traffic in train control system,this thesis proposes a spatial feature extraction model based on 1-dimensional multi-scale convolutional neural network and a temporal feature extraction model based on adaptive temporal convolutional network,and adopts the random forest algorithm to fuse the above models to reduce the network generalization error and improve the accuracy of intrusion detection.Based on the intrusion detection dataset obtained from the hardware-in-the-loop simulation platform,this thesis conducts experimental evaluation and comparative tests on the proposed intrusion detection method.The results prove its good performance and the ability to effectively complete intrusion detection tasks in train control system scenario. |