| With the development of information technology and the diversification of application requirements,as well as the promotion of 6G research,the Space-Ground integrated network with diversified functions,complementary satellite orbit and easy expansion has become a new networking development direction.The Space-Ground integrated network uses multidimensional information and cooperates with heterogeneous networks to achieve efficient processing of events.The Space-Ground integrated network can be used as a new means of communication for the transmission of high-speed rail core business.High-speed rail core business has higher security requirements because it is closely related to high-speed rail operation.Therefore,it is of great significance to study an effective abnormal traffic detection schemes to ensure the safe communication of high-speed rail core business in the SpaceGround integrated network.This thesis is committed to the research of high-speed rail private network business analysis and modeling,abnormal traffic detection and data tampering detection solutions in the Space-Ground integrated network.The main work is as follows:Firstly,by analyzing the characteristics of Space-Ground integrated network and highspeed rail private network business,it is determined that the core business of high-speed rail should be transmitted through Space-Ground integrated network,including dispatching command business,operation control business,traffic safety monitoring business,emergency rescue business and passenger service business.Considering the demand of abnormal traffic detection,,detailed business analysis and traffic modeling are carried out for the dispatching command business,operation control business,emergency rescue business and passenger service business in the core business.For control services such as dispatch command,operation control,and emergency rescue,starting from the business system structure,analyze the access points of the Space-Ground integrated network,and further analyze the data packet users and flow direction,packet size,content,arrival interval,etc.in the network.Based on the above characteristics,a traffic model is established.Referring to the service classification and traffic modeling results of 3GPP and3GPP2,the traffic model of passenger service class is initially determined,and then validated by fitting the actual network traffic.The traffic model constructed in this thesis can accurately describe the behavior profile of normal traffic and provide a basis for abnormal traffic detection.An abnormal traffic detection algorithm based on traffic characteristics is designed.Based on the high-speed rail traffic model,the algorithm analyzes the possible changes of traffic characteristics when attacked,and realizes the detection of abnormal traffic combined with PCA and OCSVM models.The algorithm mainly includes the key steps of detection feature selection,feature preprocessing,PCA dimensionality reduction,OCSVM model training and abnormal traffic detection.A data tampering detection algorithm based on predictive authentication is designed.Based on the idea of "predict first,then identify",the algorithm is composed of driving permission calculation model,protection curve calculation model and Chi-square test discriminator.The driving permission calculation model and the protection curve calculation model are established according to the train operation state.The train operation permit is simulated at the on-board system end and the on-board protection curve is simulated at the ground control system to obtain the predicted value of train operation permit and speed position information.The discriminator is used to identify the data and determine whether the system is subject to data tampering attack.Finally,the two detection algorithms are simulated and verified,and the detection performance is evaluated by using the true positive rate and false positive rate.The average true positive rate of the abnormal traffic detection model based on the traffic characteristics is97%,and the false positive rate is 2.06%.The data tampering detection model based on predictive discrimination has an average true positive rate of 95.19% and a false positive rate of 1.64%.The implementation results show that the two detection algorithms proposed in this thesis can identify network attack in real time and accurately. |
