Artificial immunity is an advanced technology inspired by the theory of natural immunity and follows the principle of natural immunity. It has made remarkable achievements in the field of information security and cyber attack recognition [10]. Artificial immune system can achieve the system security situation awareness without prior knowledge, and continuously enhance its perception performance by the designed evolutionary mutation mechanisms, to perceive the security situation dynamically and accurately, and ensure the safe operation of the system.

The artificial immune system possesses the characteristics of self-learning, self-organization, self-adaptation, highly distributed and long-term memory [11]. Generally, the immune mechanism can be divided into three main stages. The first is the process of immune cells from immaturity to maturity, known as self-tolerance. The second is the process of immune response, in which immune cells match with antigens and form immune memory. The third is the immune feedback process, the specific antibodies are generated and the immune process can be regulated.

GAN is a deep neural network that has been widely used in the field of data learning and data generation [12]. The standard GAN is composed of generator G and discriminator D, the instance samples are generated by the generator and mixed with the real samples, and then randomly sent to the discriminator to distinguish whether the data is real or comes from G. Similar to the adversarial mechanism, optimization objectives, and the dynamic learning process of reinforcement learning [13,14], the core of the GAN network is the adversarial process between the generator G and the discriminator D. For the training process of GAN, the purpose of the generator is to fit the distribution of real samples, so that the discriminator cannot discern real samples or fake data. Through iterative training and optimization, the Nash balance is achieved. During the training process, the parameters of the generator G and the discriminator D are continuously adjusted to achieve better generation effects through dynamic learning. The objective function of GAN can be expressed as (1)minG⁡maxD⁡V(D,G)=Ex∼P(x)[log⁡D(x)]+Ez∼P(z)[log⁡(1−D(G(z)))]where D and G are discriminator and generator, respectively. x is the sample data, z is the random noise. p(x) is the real data distribution, and p(z) is the latent space distribution.

By learning the distribution of real data, GAN can be used to solve the problem of imbalanced data distribution and data generation. In an artificial immune system, the clone selection of specific antibodies is critical for the evolution and variation of antibody populations. Based on the GAN model, the mature antibody vectors are selected and learned, then the generated antibodies are added to the antibody population, enabling the artificial immune system to benefit from a richer population.

For the IT network, Yu [15] propose a multi-objective decision method for network security situation grade assessment. The method first defines membership functions of attribute eigenvalue grades, trust transmission methods, multi-path trust integration, and further establishes a multi-objective decision grade assessment optimization model to obtain the network security situation grades. Wang et al. [16] propose a network security information analysis and network security situation (NSS) model based on data mining, the model cannot only detect network security threats but also evaluate the network security situation with system security indicators. Specifically, the threat data are classified and the risk measurement is conducted. Then the security of each type of threat is measured according to the information characteristics of network attacks. Finally, according to different attack motivations, different evaluation methods are used to obtain comprehensive situation assessment results. Du et al. [17] propose a network security situation assessment model in the SDN environment. The situation elements are mapped to the layers of back propagation (BP) neural network, and the weights and thresholds of the BP neural network are optimized by the cuckoo search algorithm. Specifically, the situation indicators are used as the input data for the BP neural network, and the value of the output layer is the result of the evaluation. Guo et al. [18] propose a defensive random game model, which first analyzes the threat propagation process, establishes the threat propagation-access relationship network, and then designs a random game model of the threat action and protection strategy game. The random game model is used to quantify the network security situation. Yang et al. [19] propose a situation assessment model based on unsupervised learning. The paper applies the variational autoencoder (VAE) and GAN for data feature information extracting and error threshold calculation. Then the situation value is calculated based on the threat probability and threat impact. Specifically, the threat probability is obtained from the test results of each test, and the threat impact is defined by the Common Vulnerability Scoring System (CVSS). Wang et al. [20] propose a network security situation assessment framework based on analytic hierarchy process (AHP). The indicators of basic operation, threat, vulnerability, and asset breakage are considered to establish the assessment model. Three indexes of risk situation, the system operation, and the damage degree are discussed, and the weight factors of the evaluation index are assigned by the AHP process. In the aforementioned research, mathematical models are established to assess the network security situation. However, most of these models adopt subjective evaluation methods or neural network models. Such models are heavily weighted towards subjective factors and lack interpretability. Furthermore, these models analyze the impact of cyber attacks from the network perspective, such as assessing the security risks of the system and obtaining the network security situation value. However, these models do not consider the impact of attacks on the industrial systems operation and cannot be directly applied to train control systems.

For the industrial control systems, Zhang et al. [21] propose a new security situation awareness method for the power grid. First, the power grid security situation evaluation indicators are selected, and then the power grid security situation risks are quantified and divided into different security risk levels. Finally, the power grid security situation prediction model based on deep learning is constructed and the security situation awareness prediction results are verified. Zhang et al. [22] propose a combination active-passive risk source identification method for the terminal area control system, which includes 19 secondary indicators and 3 primary indicators. Then the sparrow search algorithm (ISSA)-extreme learning machine (ELM) framework is used for risk probability prediction. Finally, the overall risk probability obtained by the Bayesian theory and evaluation weight are used to obtain the overall situation assessment value. Zhao et al. [23] propose a wavelet neural network analysis method to obtain the security situation value. The network and control characteristics such as security monitoring, security alarms, security analysis, security audits, and security verification information are selected as indicators. Then the indicators are selected as the sampled dataset to train the wavelet neural network model, and the security situation value of the power control system is set as the output. Li et al. [24] propose a network security situation assessment method for industrial control networks. The information in the sparse data is extracted by the stack autoencoder and the data dimensionality is reduced. The nonlinear mapping relationship of the network status is fitted through the RBF network, and the security situation assessment value of the industrial control network is calculated. However, the above methods do not consider how the security situation of the industrial control system changes when cyber attacks are introduced. Lei et al. [25] propose a smart grid security situation awareness algorithm based on deep reinforcement learning. The situation elements such as network port traffic information, alarm events in the system logs, node vulnerabilities, and known attacks are acquired for situation assessment. The integrated edge computing and deep reinforcement learning method can minimize processing costs on the premise of minimizing attack detection error rates. However, the proposed algorithm evaluates the system security situation solely based on detection metrics, such as detection rate and false alarm rate. Real-time dynamic security situation assessment methods still require further optimization and research.

For the cyber-physical transportation systems (CTS), Yu et al. [26] conducted a comprehensive analysis of the security threats, attack mechanisms, and defense measures of cyber-physical systems from three dimensions: physical domain, cyber domain, and cyber-physical domain. Cyber-physical systems is an important part of Industry 4.0 and faces many security threats, the article discusses the challenges and future directions of current research. Alsulami et al. [27] propose a transfer learning based intelligent intrusion detection system for autonomous vehicle-cyber physical systems. The actual position and actual speed of the autonomous vehicle, the actual position and actual speed of the preceding vehicle, these one-dimensional data are converted into two-dimensional images for input into the pre-trained convolutional neural network (CNN) model. Then the intelligent intrusion detection system using the CNN model to detect the cyberattacks targeting the physical components of an autonomous vehicle through controller area network (CAN). Abdo et al. [28] propose a comprehensive connected and automated transportation system (CATS) cybersecurity research framework that covers multiple levels from individual vehicles to transportation networks, and emphasizes the importance of threat analysis and risk assessment (TARA) tools in cybersecurity research. Specifically, TARA assesses the likelihood and impact of cyber attacks and combines them to derive the CATS risks. The TARA method includes both qualitative and quantitative methods, the qualitative method relies on expert experience to assess network risk, while the quantitative method is based on probability theory and statistical models to assess the likelihood of threats and risks. The above studies introduced the security issues and security assessment methods faced by different transportation modes. However, some security assessment methods are highly subjective and lack a dynamic security assessment process to deal with cyber threats.

In recent years, there have been few studies on situation assessment for CBTC systems. Lu et al. [29] propose a resilience-based security assessment method based on structural information entropy to measure the security level of CBTC systems. The two-dimensional structure entropy is used to evaluate the performance of the cyber domain, and the impact of cyber attacks on the physical domain of the CBTC systems is calculated according to the timetable and running states. The resilience metrics considering both the cyber domain and physical domain are used to analyze the security level of CBTC systems. Kang et al. [30] propose a multi-dimensional Gaussian hidden Markov model approach to quantify the situation awareness value of CBTC systems. The information features, including CPU usage, RAM usage, disk access rate, and network rate, are considered, and an integrated situation awareness value for CBTC systems is derived using entropy weights. However, the research does not closely integrate with the characteristics of the CBTC systems, and it fails to explore the changes in the information security situation when the system suffered cyber attacks. In this paper, we propose a hierarchical security situation assessment approach that combines physical layer and information layer indicators to quantify the security situation under cyber attacks, and the real-time comprehensive security situation assessment value is calculated through the evaluation indicators from both dynamic and static aspects.

As a typical cyber-physical system, CBTC systems integrate physical processes with computing systems, incorporating controllers, actuators, and sensors. Train operations in the physical environment are governed by a computing and communication network, which relies on multi-source sensors for data acquisition. The CBTC architecture is generally divided into two primary layers: the physical layer and the information layer [31]. As depicted in Fig. 1, the physical layer encompasses the state and actions of trains, components, devices, and sensors. The information layer achieves communication and control signal exchange between critical devices such as the zone controller (ZC), computer interlocking (CI), automatic train supervision (ATS), database storage unit (DSU), access point (AP), and vehicle onboard controller (VOBC). This hierarchical structure ensures efficient interaction between the physical and information layers of the system.

The purpose of CBTC systems is to ensure the safe and efficient operation of trains. The physical layer primarily focuses on the acceleration, speed, and location of the train, as well as the observation of the physical characteristics such as train speed and train location. The information layer is mainly concerned with communication and information exchange between the train and the ground. For example, the ZC calculates the correct movement authorization (MA) and sends it to the VOBC of the train through the train-ground network. Cyber attacks do not directly damage the physical characteristics of trains but can indirectly disrupt normal operations through the communication network. For instance, a DoS attack can obstruct the normal communication between trains and the ground, while a data tampering attack can manipulate MA information transmitted between trains and the ground. The results of cyber attacks may lead to anomalies in the physical layer of the system. Therefore, when conducting situation assessment, it is not only necessary to quantify security situation of the information layer under cyber attacks but also consider its impact on the physical layer of the system.

The general structure of the hierarchical security situation assessment approach is shown in Fig. 2. For the physical layer, the impact of cyber attacks on the system is discussed. Specifically, the train punctuality rate and train departure interval are used to evaluate the impact of cyber attacks on the physical layer. For the information layer, the system vulnerabilities, system threats and network characteristics are the main aspects that need to be assessed and quantified. The specific indicators for each aspect are listed and discussed later.

In this section, the train control model is established and the Kalman filter method is used to obtain train state observations. The classical Kalman filter method has uncertain observation errors under cyber attacks. Therefore, we first establish the attack model and then introduce the unscented Kalman filter to estimate the train state under cyber attacks. Then, we calculate the changes in the train punctuality rate and departure interval based on the train state observations. Finally, the quantitative impact of cyber attacks on the physical layer of the train control system can be calculated.

In our hierarchical security situation assessment approach, system vulnerabilities, system threats, and network characteristics are used to quantify the security situation of the information layer. The specific indicators are discussed in detail.

The characteristic of CBTC systems operation is that it operates on a specific line in a fixed direction according to the train operating diagram, and its information interaction and data flow are stable. The artificial immune system can take advantage of the stable data flow to self-learn the data characteristics of the CBTC systems under normal operation, train the immune system model without prior knowledge or data labels, and realize cyber attack perception and security situation assessment.

In AIS, the antigen is the feature vector of network characteristics data. Let the antigen set be Ag={ag|ag∈Sl}, where Sl is the shape space, l represents the dimension of feature strings, including source/destination IP address, source/destination port, protocol type, time, features, traffic, sessions, and so on. The antibody is the detector that recognizes specific antigens. The detector simulates the main functions of immune cells and realizes the main functions such as self-tolerance, cell cloning, and mutation evolution. Let the detector set be (58)D={<d,cnt,age,ρ> | d∈D,cnt∈N,age∈N,ρ∈R}where d represents the detector, cnt represents the sum of antigens matched by the detector, age represents the age of detectors, ρ represents the concentration of detectors, N and R represent the natural number and real number set.

The system vulnerabilities, security threats, and network characteristics indicators are used to quantify the information security situation of the information layer. Specifically, the information security situation is composed of Iv, Tc and Fc. It can be expressed as (70)Hc=ωc1⋅Iv+ωc2⋅Tc+ωc3⋅Fcwhere ωc1, ωc2 and ωc3 are the weights of three indicators, respectively. The detailed algorithm is formulated in Algorithm 1.

Both physical layer and information layer indicators are used for the hierarchical security situation assessment approach. For the physical layer, the main focus is on the impact of cyber attacks on the operation of the CBTC systems, and the total cost is measured from the perspective of time delay and economic loss. For the information layer, changes in system situation are analyzed and characterized from aspects of static and dynamic indicators. The comprehensive situation assessment value SA can be expressed as (71)SA=ω1⋅Cp+ω2⋅Hcwhere ω1 and ω2 are the weights of two indicators, respectively.

The simulation experiments are conducted on the security simulation platform of the National Key Laboratory. As shown in Fig. 3, the simulation platform is built with simulation software and real signal equipment, and supports both wired and wireless train-ground communication modes. The real line data of Beijing Metro Line 7 are used to simulate the tracking operation of multiple trains. In addition, the platform can simulate cyber attacks such as DoS attacks and data spoofing attacks, and restore the operating scenarios and operating status of the system under cyber attacks.

The experimental parameters of the hierarchical security situation assessment approach are listed in Table 2. According to the parameters, the overall impact of cyber attacks on the physical layer Cp, the security situation of information layer Hc, and the comprehensive situation assessment value SA can be calculated by Eqs. (50), (70) and (71), respectively.

Cyber attacks are introduced to verify the effectiveness of our approach. The CBTC systems mainly suffer two types of attacks: DoS attack and data spoofing attack [39]. The DoS attack may infiltrate the CBTC network, and occupy excessive service resources with seemingly legitimate service requests, thus obstructing the system normal operation. The primary objective of the data spoofing attack is to manipulate the payload content within data packets, aiming to disrupt the functionality of CBTC physical equipment.

In the case of a DoS attack, the primary targets are the communication link between the ground wireless AP and VOBC. The authentication attack on the wireless network, known as an authentication DoS, is launched by using the Mdk3 wireless attack tool. This tool depletes AP authentication request resources by simulating randomly generated MAC addresses and sending a large number of authentication requests to the target AP. Consequently, the AP becomes unable to respond to legitimate communication requests. Meanwhile, the TCP DoS attack on wired backbone networks, specifically a TCP SYN Flood, is launched using the LOIC DoS attack tool. The attack floods the service connection queue with TCP data packets, causing network congestion. As a result, devices are unable to respond properly, disrupting the normal operation of trains.

In the case of a data spoofing attack, the payload contents of data packets are modified with the intent of disrupting train operations. The communication link between the ground wireless access point (AP) and VOBC in CBTC systems is used to transmit control commands and train status information. If this communication data is tampered with, it can compromise the safe operation of the train. A typical example is a Man-in-the-Middle (MitM) attack, where an attacker intercepts and modifies data packets between the targeted parties by setting up forwarding on a middleman device. In this paper, the Bettercap attack tool is employed to intercept and tamper with the communication data. By deploying lightweight Bettercap modules, the attacker manipulates MAC address tables and redirects communication, allowing them to act as middlemen to monitor or modify data between the target host and the gateway.

The method in [40] is used to extract the features from the security feature data set. Since each situation indicator had a different value range, the Min-Max Normalization method is used for normalization, which can be expressed as (72)x∗=x−xminxmax−xminwhere x∗ is the normalized value of the situation indicator, x is the original value, xmax and xmin are the maximum and minimum values of the situation indicator, respectively.

The detection rate (DR), false alarm rate (FR) and F1_score are introduced to evaluate the effectiveness of perceiving cyber attacks, which can be described as (73)DR=Recall=TPTP+FN,Precision=TPTP+FP (74)FR=FPFP+TN

(75)F1_score=2×Precision×RecallPrecision+Recall=2×TP2×TP+FP+FNwhere TP represents the number of cyber attacks that are sensed and actually launched, FP represents the number of cyber attacks that are sensed but no actually launched, TN represents the number of cyber attacks that are neither sensed nor actually launched, FN represents the number of cyber attacks that actually launched but not sensed.

First, we present the performance evaluation of the approach for perceiving DoS attacks. The batch size, epochs and noise dimension of the GAN model are 256, 100 and 100, respectively. The loss function and optimizer of the GAN model are binary_crossentropy and Adam, respectively. The activation functions of the GAN model generator G and discriminator D are tanh and sigmoid, respectively. The experimental parameters are listed in Table 3.

The detection rate and false alarm rate for perceiving the authentication DoS attacks are shown in Fig. 4. With the increase of the detector life cycle, the detection rate increases gradually, the false positive rate increases at first and then decreases. When the life cycle of the detector is set to 5 generations, the detection rate is 64.84%, and the false alarm rate is 0.08%. When the life cycle of the detector is set to 25 generations, the detection rate is increased to 96.83%, and the false alarm rate is 0.16%. When the life cycle of the detector is set to 50 generations, the detection rate is increased to 97.09%, and the false alarm rate is 0.06%. The detection rate of the detector with a life cycle of 25 generations is similar to that of 50 generations, and the false alarm rate is maintained at a low level. It can be noted that the time required for the maturity and evolution of the detectors with a life cycle of 25 generations is significantly lower than that of 50 generations. Therefore, it is considered that the detector with a life cycle of 25 generations is the optimal detector, and the performance of the detector is the best.

The detection rate and false alarm rate for perceiving the TCP SYN Flood attacks are shown in Fig. 5. It can be seen that when the life cycle of the detector is short, the false alarm rate is low. With the increase of the detector life cycle, the detection rate increases gradually, and the false positive rate increases at first and then decreases. The overall change trend is similar to the result of perceiving authentication DoS attack. When the life cycle of the detector is set to 25 generations, the detection rate is 98.59%, and the false alarm rate is 1.08%. It has a high detection rate and a low false alarm rate. It can be considered that the detector with a life cycle of 25 generations is the optimal detector.

As shown in Table 4, the different methods are introduced to compare the ability to perceive the TCP SYN Flood attack. The GAN-AIS method is compared with unsupervised learning methods such as AIS [41], convolutional autoencoder and one-class SVM (CAE-OCSVM) [42], synthetic minority oversampling technique and Random Forest (SMOTE-RF) [43], principal component analysis and K-means clustering (PCA-K-Means) [44] and variational autoencoder (VAE) [45] in terms of the detection rate, false alarm rate, F1_score and computation time indicators.

It can be seen from Table 4, the detection rate of GAN-AIS is 98.59%, the false alarm rate is 1.08%, and the F1_score is 0.9921. It has the highest detection rate, a relatively low false alarm rate, and a high F1_score. The reason is that the GAN-AIS approach cannot only learn the network characteristics of the train control system but also further optimize and enrich the detector population through the GAN model. A higher detection rate usually increases the probability of false alarms. However, the proposed GAN-AIS approach can keep the false alarm rate within a relatively low range and maintain a high F1_score value. In addition, compared with other methods, the GAN-AIS approach has a relatively short computation time. Especially when compared with the variational autoencoder (VAE) method, which has a relatively close detection rate, the computation time of GAN-AIS can be reduced by nearly half. Moreover, compared with methods that have a similar computation time, GAN-AIS has a higher detection accuracy. To sum up, the GAN-AIS approach has outstanding comprehensive perception performance.

We assume that due to the redundancy and security mechanism of the system, the DoS attacks will not impact the normal operation of the train, the comprehensive situation assessment value SA can be calculated without considering the impact of cyber attacks on the physical layer. Limited by the relatively closed environment, the CBTC systems are rarely updated and upgraded. Therefore, most of the existing vulnerabilities are outdated, but these vulnerabilities can still reflect the security situation of the system. In our experiments, the system vulnerabilities are scanned through Nessus software, and the reference date for vulnerability age calculation is 31 December 2019. The CVSS information of 10 typical vulnerabilities and the corresponding attack severity are listed in Table 5.

The change in authentication DoS attack during the 90-s observation period is simulated, and the intensity of the authentication DoS attack and the corresponding security situation are shown in Fig. 6. With the intensity of the attack changes, the security situation of the CBTC systems information layer changes, affecting the comprehensive security situation of the CBTC systems. The attack intensity is set from 0.6 M/s to 2.0 M/s, and the security situation value varies from 0.1 to 0.78. The trend of the security situation value curve is similar to that of the attack intensity curve. The greater the intensity of the DoS attack, the higher the security situation value, and vice versa. Moreover, due to the existence of memory detectors, when the same attack persists, the change in situation assessment values is more drastic than that of attack intensity.

As shown in Fig. 7, the TCP DoS attack intensity ranges from 2.9 to 3.8 M/s, and the security situation value varies from 0.1 to 0.92. The trend of the security situation value curve is similar to that of the attack intensity curve. It can be concluded that the security situation curve can characterize the dynamic changes in the security situation in real-time.

In the simulation experiment, the MitM data tampering attack disrupts the train operation by tampering with the data of the normal operation of the train. Due to the fail-safe mechanism of the CBTC systems, if the data received by the train fails to pass verification, the train will initiate an emergency braking procedure. A total of 15 stations and 5 trains are used to simulate the train operation process. The train tracking interval is set to 3 min to simulate train operation during the morning rush period, and the station stop time is set to 30 s. To simplify the experiment, only the upward trains are considered. The data tampering attack is executed during the train operation, and the train operation diagram is affected. The train operation diagram under the cyber attack and the change of situation assessment value are shown in Figs. 8 and 9, respectively.

It can be seen from Fig. 8, the first two trains ran normally according to the train schedule, while the third train suffered a cyber attack when it was running on the track between Station 7 and Station 8. Due to the necessary remedial measures (e.g., equipment restarts and patch upgrades), the third train resumed normal operation 3 min later. But it still affects the normal operation of subsequent trains. The impact of cyber attacks on the physical layer of the train control system can be characterized through the quantitative value of situation assessment. As shown in Fig. 9, the situation assessment value is kept at a low value at first. At the 40th second of the observation period, the train control system suffered a cyber attack, and the system situation value increased significantly. The reason is that the attack had an impact on the physical layer of the train control system, resulting in the time delay and economic losses of several successive trains, which led to the increases of situation assessment value. With the subsequent mitigation or elimination measures taken, the situation becomes stable. However, as the departure interval of the trains is very short, subsequent trains continue to be affected, and the security situation remains at a high level.

For comparison, another experiment is conducted. The train tracking interval is set to 8 min to simulate the train operation in the off-peak period, and the other experiment settings are the same. The train operation diagram under cyber attack and the change of situation assessment value is shown in Figs. 10 and 11, respectively.

It can be seen from Fig. 10, the first two trains run according to the train schedule, while the third train suffered a cyber attack when running on the track between Station 7 and Station 8. Due to the large train operation interval, the subsequent trains are not affected by the third train, and the third train also resumes normal operation 3 min later. As shown in Fig. 11, the situation assessment value initially remains at a low value. At the 40th second of the observation period, the physical layer of the train control system suffered a cyber attack, and the system situation value increased significantly. With the mitigation of the cyber attack, the train operation returned to normal. The security situation value of the train control system decreased to the normal level.

By comparison, it can be concluded that attacks on the train system during the morning peak and off-peak periods have different impacts on the system security situation. During the morning peak, an attack affects a larger number of subsequent trains, resulting in a sustained high security situation value. In contrast, during off-peak periods, the attack causes delays to a single train without affecting the operation of subsequent trains. This is reflected in the security situation, where the situation value initially rises but then returns to normal.