A Hierarchical Security Situation Assessment Approach for Train Control System under Cyber Attacks

With the integration of informatization and intelligence into the Communication-Based Train Control (CBTC) systems, the system is facing an increasing number of information security threats. As an important method of characterizing the system security status, the security situation assessment is used to analyze the system security situation. However, existing situation assessment methods fail to integrate the coupling relationship between the physical layer and the information layer of the CBTC systems, and cannot dynamically characterize the real-time security situation changes under cyber attacks. In this paper, a hierarchical security situation assessment approach is proposed to address the security challenges of CBTC systems, which can perceive cyber attacks, quantify the security situation, and characterize the security situation changes under cyber attacks. Specifically, for the physical layer of CBTC systems, the impact of cyber attacks is evaluated with the train punctuality rate and train departure interval indicators. For the information layer of CBTC systems, the system vulnerabilities and system threats are selected as static level indicators, and the critical network characteristics are selected as dynamic level indicators to quantify the real-time security situation. Finally, the comprehensive security situation assessment value of the CBTC systems is obtained by integrating the physical and information layer indicators. Simulation results illustrate that the proposed approach can dynamically characterize the real-time security situation of CBTC systems, enhancing the ability to perceive and assess information security risks.