Research On Intrusion Detection For High Speed Rail Signaling System

With the vigorous development of the domestic high-speed railway construction and the increasingly large-scale high-speed railway signaling system,more and more security threats are brought to the internal communications of the high-speed railway signaling system.In this paper,the vulnerability of high-speed railway signaling system is analyzed.According to the current intrusion detection research for industrial control system and the analysis of the threat of high-speed railway signaling system,intrusion detection system is deployed between TSRS and TCC equipment in secure data network.In view of the difficulty of generating data sets in industrial control systems,this paper analyzes the RSSP-1 protocol of railway dedicated communication and constructs the data set by feature extraction.Secondly,we propose a collaborative fruit fly optimization algorithm with varying step size to optimize the SVM classification model.Experiments on the constructed dataset demonstrate the effectiveness of the improved FOA-SVM intrusion detection model in high-speed railway signaling system.There are several main points about the major tasks and contributions in the thesis.(1)According to the security requirements of industrial control system,an improved high-speed railway signal system architecture is proposed and its functional requirements for intrusion detection model are analyzed.The design of high-speed railway signal system is completed with reference to the intrusion detection model designed for industrial control system.Aiming at the difficulty of data collection in the intrusion detection research oriented to industrial control system,this paper analyzes the data collected from TSRS and TCC equipment by RSSP-1 protocol,extracts the data characteristics according to the message format,and according to its main security Threatening to classify the data and eventually complete the data set construction.(2)According to the characteristics of high-speed railway signaling system,we use network-based anomaly detection to detect and introduce the optimization algorithms of SVM,Drosophila,Genetic Algorithm and Particle Swarm Optimization,and analyze their advantages and disadvantages.In order to solve the defect that Drosophila optimization algorithm is easy to fall into local search,this paper proposes a synergistic Drosophila optimization algorithm with varying step size.Through adaptively changing search distance,the global search ability and the later local optimization balance.(3)Simulation experiments on the constructed datasets show that the improved Drosophila optimization algorithm has a higher classification accuracy than before and also higher than the genetic algorithm and particle swarm optimization algorithm,also confirmed the intrusion detection for high-speed railway signaling system effectiveness.