摘要
针对铁路网络安全需求中加密威胁难检测,加密业务与加密流量监管困难的现状,特别是加密流量分析粒度不够,技术支撑性不足等问题,设计了由数据获取子系统、特征建模子系统、智能分析子系统、配置管理子系统组成的基于智能算法协同的铁路网络加密流量智能监测系统,阐述了基于两阶段长短期记忆(LSTM,Long Short-Term Memory)网络的加密流量异常识别、基于Elmo+LSTM+SelfAttention模型的加密流量应用类型识别关键技术。该系统有助于提升加密流量监测技术水平、增强铁路网络安全综合防御能力,也为未来铁路领域网络与信息系统安全运行维护提供了技术支撑。
Aiming at the current situation of difficult detection of encrypted threats and difficulties in the supervision of encrypted services and encrypted traffic in railway network security requirements, especially the problems such as insufficient granularity of encrypted traffic analysis and insufficient technical support. This paper designed a railway network encrypted traffic intelligent monitoring system based on intelligent algorithm collaboration, which was composed of data acquisition subsystem, feature modeling subsystem, intelligent analysis subsystem and configuration management subsystem, and described the key technologies of application type identification of encrypted traffic based on the Elmo+LSTM+Self-Attention model and exception identification of encrypted traffic based on two-stage Long Short-Term Memory(LSTM) network. The system helps to improve the encrypted traffic monitoring technology,enhance the comprehensive defense capability of railway network security, and also provides technical support for the safe operation and maintenance of the network and information system in the future railway field.
作者
尹虹
赵闪
李泽
王蕊
岳超
YIN Hong;ZHAO Shan;LI Ze;WANG Rui;YUE Chao(Institute of Computing Technologies,China Academy of Railway Sciences Corporation Limited,Beijing 100081,China;Xingtang Telecommunications Technology Co.Ltd.,Beijing 100191,China;General Office,CHINA RAILWAY,Beijing 100844,China)
出处
《铁路计算机应用》
2022年第10期6-9,共4页
Railway Computer Application
基金
中国国家铁路集团有限公司科研开发计划重点课题(N2020W006)。
关键词
加密流量监测
人工智能
铁路网络
智能监测系统
机器学习
encrypted traffic monitoring
artificial intelligence
railway network
intelligent monitoring system
machine learning
