为解决城市轨道交通场景下如何有效应对高级持续性威胁(advanced persistent threat，APT)这一难题，提 出将攻击溯源图与深度流量学习相结合的方法，集成攻击重构与流量监控，实现对APT 攻击的判断和检测。通 过实验结果可知，该模型能够实现对APT 攻击的有效溯源。与传统的基于机器学习的APT 攻击检测模型比较， 这种组合模型在检测准确率、精确度、召回率等指标方面具有明显的优势。

To address the challenge of effectively managing APT in urban rail transit scenarios, this paper proposes a method that combines attack source graphs with deep traffic learning. This integrated approach merges attack reconstruction with traffic monitoring to facilitate identifying and detecting APT attacks. Experimental results demonstrate that this model can effectively trace the sources of APT attacks. Compared to traditional APT attack detection models based on sandboxes or abnormal characteristics, this combined model significantly improves detection accuracy, precision, recall rate, and other performance indicators.

U231

中国中车科技研究开发计划(2023CKA362-1)