基于双向AC算法的列车通信网络异常入侵检测系统设计

Design of Abnormal Intrusion detection System for Train communication network based on bidirectional AC algorithm

摘要:

列车通信网络异常流量的类型和形式多样化，特征提取难度较大，异常入侵检测效果较差，为此，设计基于双向AC算法的列车通信网络异常入侵检测系统。采集层利用网络数据采集器，在列车通信网络内，采集列车通信网络信息；存储层以分布式存储、列式存储与结构化存储方式，存储采集的信息；分析层利用协议解析模块，解析信息，得到符合规范的信息。其中，深度包过滤模块利用白名单技术深度包过滤符合规范的信息，提取关键信息；入侵特征模式提取模块能够在关键信息内提取异常入侵特征模式；特征模式匹配模块利用双向AC算法，自动匹配提取的特征模式与入侵特征模式库内的特征模式；入侵响应模块通过分析自动匹配结果，完成列车通信网络异常入侵检测。可视化层以可视化的报表形式，呈现异常入侵检测结果。实验结果表明，该系统可有效采集列车通信网络信息，完成异常入侵特征模式提取，该系统可快速自动匹配异常入侵特征模式，异常入侵检测精度较高。

Abstract:

The types and forms of abnormal traffic in train communication networks are diverse, and feature extraction is difficult. The effectiveness of abnormal intrusion detection is poor. Therefore, a train communication network abnormal intrusion detection system based on bidirectional AC algorithm is designed. The collection layer utilizes a network data collector to collect train communication network information within the train communication network; The storage layer stores the collected information through distributed storage, columnar storage, and structured storage methods; The analysis layer utilizes a protocol parsing module to parse information and obtain information that meets the specifications. Among them, the deep packet filtering module utilizes whitelist technology to filter compliant information and extract key information; The intrusion feature pattern extraction module can extract abnormal intrusion feature patterns from key information; The feature pattern matching module utilizes a bidirectional AC algorithm to automatically match the extracted feature patterns with the feature patterns in the intrusion feature pattern library; The intrusion response module completes abnormal intrusion detection in the train communication network by analyzing the automatic matching results. The visualization layer presents anomaly intrusion detection results in the form of visual reports. The experimental results show that the system can effectively collect train communication network information and extract abnormal intrusion feature patterns. The system can quickly and automatically match abnormal intrusion feature patterns, and the accuracy of abnormal intrusion detection is high.