基于WiSARD无权重神经网络的铁路信号系统入侵检测方法研究  

Research on Intrusion Detection Method for Railway Signal System Based on WiSARD Weightless Neural Network

作　　者：李洪赭 陈建译 闫连山[1] 李赛飞[1] LI Hongzhe;CHEN Jianyi;YAN Lianshan;LI Saifei(School of Information Science&Technology,Southwest Jiaotong University,Chengdu 611756,China;China Railway Guangzhou Group Co.,Ltd.,Guangzhou 510088,China)

机构地区：[1]西南交通大学信息科学与技术学院,四川成都611756 [2]中国铁路广州局集团有限公司,广东广州510088

出　　处：《铁道学报》2023年第7期72-80,共9页Journal of the China Railway Society

基　　金：中国铁路总公司科技研究开发计划(2017X007-C);四川省重大科技专项(2019ZDZX0007);四川省科技计划(2021YJ0372)。

摘　　要：铁路信号系统是保障列车高效安全运行的关键信息基础设施,其安全性直接影响到行车安全。为保证信号系统的网络安全,需准确检测网络入侵。提出基于WiSARD无权重神经网络的铁路信号系统入侵检测方法:采用一种新型数据集构建信号系统流量特征,依据RSSP-I/II协议特点,利用核主成分分析法进行降维处理;选取信号系统中常见的4种攻击方式并结合真实流量组成训练数据集;从准确率和F_(1)两方面,对比WiSARD和其余3类典型神经网络算法分别在单一、混合攻击流量下的性能。实验结果表明:WiSARD在平均准确率和时间开销之间提供了最佳权衡,能有效提高信号系统入侵检测效率,为提升网络安全感知能力提供有力支撑。The safety of railway signal system,as the key information infrastructure to support the efficiency and safety of trains,directly affects train operation safety.In order to ensure the network security of the signal system,an intrusion detection method for railway signal system based on WiSARD weightless neural network was proposed.Based on a new data set,the traffic features of the signal system were constructed.According to the characteristics of RSSP-I/II protocol,the dimensionality reduction was processed by Kernel Principal Component Analysis.Then,the training data set was comprised of four common attack modes in the signal system selected along with real traffic.Finally,from the perspective of accuracy and F_(1),the performances of WiSARD and the other three typical neural network algorithms under single and mixed attack traffic were compared respectively.The experimental results indicate that WiSARD provides the best trade-off between the average accuracy and the time cost,which can effectively improve the intrusion detection efficiency of the signal system and offer strong support for enhancing the network security awareness ability.

关 键 词：铁路信号系统 网络安全 入侵检测 神经网络 

分 类 号：TP309.1[自动化与计算机技术—计算机系统结构] U284.95[自动化与计算机技术—计算机科学与技术]