面向城市轨道交通典型应用场景的高级持续性威胁检测技术  

Advanced Persistent Threat(APT)Detection Technology for Typical Application Scenarios in Urban Rail Transit

作　　者：张洪军 吕默 高阳 ZHANG Hongjun;LYU Mo;GAO Yang(CRRC Changchun Rail Transit Co.,Ltd.,Changchun 130062)

机构地区：[1]中车长春轨道客车股份有限公司,长春130062

出　　处：《都市快轨交通》2024年第4期16-23,共8页Urban Rapid Rail Transit

基　　金：中国中车科技研究开发计划(2023CKA362-1)。

摘　　要：为解决城市轨道交通场景下如何有效应对高级持续性威胁(advanced persistent threat,APT)这一难题,提出将攻击溯源图与深度流量学习相结合的方法,集成攻击重构与流量监控,实现对APT攻击的判断和检测。通过实验结果可知,该模型能够实现对APT攻击的有效溯源。与传统的基于机器学习的APT攻击检测模型比较,这种组合模型在检测准确率、精确度、召回率等指标方面具有明显的优势。To address the challenge of effectively managing APT in urban rail transit scenarios,this paper proposes a method that combines attack source graphs with deep traffic learning.This integrated approach merges attack reconstruction with traffic monitoring to facilitate identifying and detecting APT attacks.Experimental results demonstrate that this model can effectively trace the sources of APT attacks.Compared to traditional APT attack detection models based on sandboxes or abnormal characteristics,this combined model significantly improves detection accuracy,precision,recall rate,and other performance indicators.

关 键 词：轨道交通 网络安全 APT攻击 攻击溯源图 深度学习 

分 类 号：U231[交通运输工程—道路与铁道工程]