论文标题
铁路信号网络基于规则的异常检测
Rule-based Anomaly Detection for Railway Signalling Networks
论文作者
论文摘要
我们提出了一个用于铁路信号的基于规则的异常检测系统，可减轻能够注入控制命令并执行语义攻击的Dolev-yao攻击者的攻击。该系统还减轻了攻击者用来发布LICIT但误入控制消息的折衷信号框的效果。如果我们的对策不采用，我们认为可能导致火车出轨和碰撞的攻击者。我们将铁路操作的安全原则应用于分布式异常检测系统，该系统检查信号和点上的传入命令。提出的异常检测系统检测我们模型的所有攻击而不产生假阳性，而与正常的火车运行相比，它仅需要少量的网络通信和潜伏期开销。
We propose a rule-based anomaly detection system for railway signalling that mitigates attacks by a Dolev-Yao attacker who is able to inject control commands and to perform semantic attacks. The system as well mitigates the effects of a compromised signal box that an attacker uses to issue licit but mistimed control messages. We consider an attacker that could cause train derailments and collisions, if our countermeasure is not employed. We apply safety principles of railway operation to a distributed anomaly detection system that inspects incoming commands on the signals and points. The proposed anomaly detection system detects all attacks of our model without producing false positives, while it requires only a small amount of overhead in terms of network communication and latency compared to normal train operation.
