铁路通信信号工程技术2026，Vol.23Issue(6)：39-46,64,9.DOI:10.3969/j.issn.1673-4440.2026.06.006
铁路系统APT攻击检测方法研究
Research on APT Attack Detection Method in Railway Systems
韩煜 1李强 2卢瑞铭2
作者信息
- 1. 通号通信信息集团有限公司,北京 100070
- 2. 北京全路通信信号研究设计院集团有限公司,北京 100070
- 折叠
摘要
Abstract
This paper combines the MITRE ATT&CK knowledge base and cyber kill chain model to thoroughly analyze the characteristics and lifecycle of Advanced Persistent Threat(APT)in railway systems,and proposes an APT attack detection method based on a multi-dimensional Gaussian continuous Hidden Markov Model(HMM).This method uses the CPU usage,memory usage,network traffic characteristics,security device alarm information,and node vulnerability metrics of the host system as observation sequences,to achieve the accurate identification of APT attack states through an improved Viterbi algorithm.The experimental results show that the proposed method demonstrates high detection rates and low false alarm rates across the five attack stages of reconnaissance,weaponization,delivery,control,and action,effectively identifying APT attack behaviors and providing timely warnings,and thus offering a new technical solution for ensuring network security in railway systems.关键词
网络安全/APT攻击检测/隐马尔可夫模型Key words
network security/APT attack detection/hidden Markov model分类
交通工程引用本文复制引用
韩煜,李强,卢瑞铭..铁路系统APT攻击检测方法研究[J].铁路通信信号工程技术,2026,23(6):39-46,64,9.
