An intrusion detection method of data tampering attack in train control system based on KF

doi:10.16265/j.cnki.issn1003-3033.2019.S1.007

Abstract

Abstract: In order to improve the cyber security protection level of communication-based train control system of urban rail transit train, and effectively detect the potential data tampering attacks suffered by train control system, firstly, the analysis was based on operating principle and the information interaction characteristics of the train control system. And mathematical model of the train tracking operation processes and the attackers' tampering with the train uplink and downlink information was established. Then, the trains' state estimation method and intrusion detection method based on KF and chi-square detector was proposed. At the same time, by improving the Chi-square detector, data tampering attacks could be detected and continuously alarms were output during the attack. Finally, through the semi-physical simulation platform of the laboratory, the simulation was conducted and results were verified. The results show that the intrusion detection method can attack the attackers' data tampering and give a real-time alarm, and the method has an accuracy of more than 95% and a false alarm rate of less than 6%.

Key words: train control system, data tampering attack, intrusion detection system, Kalman Filter (KF), chi-square detector

CLC Number:

X924.2

ZHANG Wei, BU Bing, WANG Hongwei. An intrusion detection method of data tampering attack in train control system based on KF[J]. China Safety Science Journal, 2019, 29(S1): 32-37.

References

[1] WANG Xiaoxuan, LIU Lingjia, TANG Tao, et al. Enhancing communication-based train control systems through train-to-train communications[J]. IEEE Transactions on Intelligent Transportation Systems, 2018, 20(4): 1 544-1 561.
[2] HODO E, BELLEKENS X, HAMILTON A, et al. Shallow and deep networks intrusion detection system: a taxonomy and survey[C]. International Conference on Distributed Computing Systems,2017:1-43.
[3] MICHELL R, CHEN I R. A survey of intrusion detection techniques for cyber-physical systems[J]. ACM Computing Surveys, 2014, 46(4):405-418.
[4] BHUYAN M H, BHATTACHARYYA D K, KALITA J K. Network anomaly detection: methods, systems and tools[J]. IEEE Communications Surveys & Tutorials, 2014, 16(1):303-336.
[5] CARDENAS A A, AMIN S, SASTRY S. Secure control: towards survivable cyber-physical systems[C]. 2008 The 28^th International Conference on Distributed Computing Systems Workshops. IEEE, 2008:495-500.
[6] LIANG Gaoqi, ZHAO Junhua, LUO Fengji, et al. A review of false data injection attacks against modern power systems[J]. IEEE Transactions on Smart Grid, 2016,8(8):1-13.
[7] STOUFFER K A, FALCO J A, SCARFONE K A. Guide to industrial control systems security: supervisory control and data acquisition systems, distributed control systems[M]. Gaithersburg : National Institute of Standards & Technology, 2011:89-102.
[8] MANANDHAR K, CAO Xiaojun, HU Fei, et al. Detection of faults and attacks including false data injection attack in smart grid using Kalman filter[J]. IEEE Transactions on Control of Network Systems, 2014, 1(4):370-379.
[9] MO Y, SIMOPOLI B. Secure control against replay attacks[C]. IEEE 2009 47th Annual Allerton Conference on Communication, Control and Computing. Institute of Electrical and Electronics Engineers, 2009:911-918.
[10] MO Y. Detecting integrity attacks on SCADA systems[J]. IEEE Transactions on Control Systems Technology, 2011, 44(1):1239-1244.
[11] BU Bing, YU F R, TANG Tao. Performance improved methods for communication-based train control systems with random packet drops[J]. IEEE Transactions on Intelligent Transportation Systems, 2014, 15(3):1 179-1 192.
[12] GUO Weiwei, ZHAO Huibing, ZHOU Guo. Verification and analysis of RSSP-1 protocol based on colored Petri nets[C]. Business Computing and Global Informatization (BCGIN), 2012 Second International Conference on. IEEE, 2012:592-595.
[13] 黄平, 彭其渊, 文超. 高速铁路故障分类及其影响列车数模型[J]. 中国安全科学学报, 2018, 28(增2):50-57.
HUANG Ping, PENG Qiyuan, WEN Chao. High-speed railway fault classification and its influence on train number model[J]. China Safety Science Journal, 2018, 28(S2):50-57.
[14] 汪洋, 王俊刚. 基于深度学习算法的铁路列车运行安全检测[J]. 中国安全科学学报, 2018, 28(增2):45-49.
WANG Yang, WANG Jungang. Railway train operation safety detection based on deep learning algorithm[J]. China Safety Science Journal, 2018, 28(S2):45-49.