Positive Train Control Security: An Intrusion-Detection System to Provide Cyber-Situational Awareness

Kolli, Satish; Lampkins, Joshua; Wijesekera, Duminda

doi:10.1109/mvt.2018.2848398

Cited by 7 publications

(1 citation statement)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In recent years, there have been few studies on information security situation awareness of CBTC systems. Kolli et al [24] propose cyber-situation awareness for positive train control system. They design a distributed intrusion detection system, which can collect real-time signaling points and wayside interface unit status information to prevent rail-specific attacks.…”

Section: Related Workmentioning

confidence: 99%

A Novel Hierarchical Situation Awareness Model for CBTC Using SVD Entropy and GRU With PRD Algorithms

Li¹,

Zhao

2021

IEEE Access

View full text Add to dashboard Cite

As a typical and special cyber-physical system, Communication-Based Train Control (CBTC) systems require a different security model from the traditional Information Technology(IT) systems. In this paper, we propose a novel hierarchical situation awareness model for CBTC systems. The two major characteristics of the model are that it can achieve rapid dimensionality reduction of multi-source heterogeneous data, and it can also deal with complex situation variations (such as hacker attacks) by learning, classifying and predicting critical data from the physical layer, network layer and application layer of CBTC systems. The Singular Value Decomposition (SVD) entropy algorithm and Gated Recurrent Unit (GRU) neural network with Progressive Residuals Detecting (PRD) algorithm are proposed to support our hierarchical model. When the singular value entropy threshold is set to 0.85, the SVD entropy algorithm can effectively compress the training and classification time by about 80% while keeping the classification accuracy stable. The mean absolute error between the observed Movement Authority (MA) value and the MA value predicted by the GRU algorithm is 23.96, which can be set as a threshold. Then the PRD algorithm is proposed to continuously calculate the progressive residuals between the two adjacent groups of observations and predictions, and only when the residuals of both two adjacent groups are greater than the threshold, the possible abnormal data can be detected. The denial of service (Dos) attack, Probing attack and data tampering attack are introduced to verify our hierarchical model and the simulation results demonstrate that our model can achieve real-time and precise system situation awareness and alerting.

show abstract

Section: Related Workmentioning

confidence: 99%