基于KF的列控系统数据篡改攻击检测方法

An intrusion detection method of data tampering attack in train control system based on KF

为提高城市轨道交通列车运行控制系统信息安全保护级别、针对列控系统面临的潜在数据篡改攻击进行有效检测。首先基于列控系统的运行原理以及信息交互特性,对列车追踪运行过程、攻击者篡改列车上下行信息过程进行数学建模;其次提出基于卡尔曼滤波器(KF)的列车状态估计方法和基于卡方检测器相结合的入侵检测方法,通过对卡方检测器进行改进,使之能够检测数据篡改攻击并在攻击期间持续输出报警;最后通过半实物仿真平台进行仿真,并给出验证结果。结果表明:入侵检测方法可以对攻击者的数据篡改攻击给出实时报警,且具有95%以上的准确率和6%以下的误报率。

In order to improve the cyber security protection level of communication-based train control system of urban rail transit train,and effectively detect the potential data tampering attacks suffered by train control system,firstly,the analysis was based on operating principle and the information interaction characteristics of the train control system.And mathematical model of the train tracking operation processes and the attackers’tampering with the train uplink and downlink information was established.Then,the trains’state estimation method and intrusion detection method based on KF and chi-square detector was proposed.At the same time,by improving the Chi-square detector,data tampering attacks could be detected and continuously alarms were output during the attack.Finally,through the semi-physical simulation platform of the laboratory,the simulation was conducted and results were verified.The results show that the intrusion detection method can attack the attackers’data tampering and give a real-time alarm,and the method has an accuracy of more than 95%and a false alarm rate of less than 6%.