Abstract:Real-time Ethernet has been applied to train control and management system (TCMS) of 250km/h Fuxing Electric Multiple Units (EMUs) and some urban rail vehicles. The openness of the Ethernet communication protocol poses a risk of intrusion attacks on the train communication network. It is, therefore, necessary that a safety protection technology is introduced to the train communication network based on real-time Ethernet. In this paper, a train communication network intrusion detection system based on anomaly detection and attack classification is proposed. Firstly, the paper built an anomaly detection model based on support vector machines (SVM). The particle swarm optimization-support vector machines (PSO-SVM), and genetic algorithm-support vector machines (GA-SVM) optimization algorithms are used to optimize the kernel function parameters of SVM. Secondly, the paper built two attack classification models based on random forest. They are iterative dichotomiser3 (ID3) and classification and regression tree (CART). And then, the built intrusion detection and attack classification model is tested by using the public data set knowledge discovery and data mining-99(KDD-99) and the data set of the simulation train real-time Ethernet test bench. PSO-SVM improves the intrusion detection accuracy from 90.3% to 95.75%, GA-SVM improves the detection accuracy from 90.3% to 95.85%. The training time of the PSO-SVM algorithm was higher than that of the GA-SVM algorithm, and much higher than that of the SVM, without optimization. Both ID3 and CART models are verified valid in the attack classification, while the ID3 algorithm obtained 100% accuracy on the training set, and only 32.89% accuracy on the test set, ID3 has a poor classification accuracy of the data outside of the training set. Also, the classification time is very long for ID3 compared with CART. So the comprehensive experimental results show that the intrusion detection system of train real-time Ethernet can use the GA-SVM model for detection of abnormal data. After passing the normal data, the CART model can be used to distinguish between the types of attacks to better complete subsequent responses and operations. Compared with the anomaly detection model based on SVM, the proposed model improves intrusion detection accuracy. And the proposed attack classification algorithm based on CART can improve the computing speed while ensuring the precision of classification.

An Intrusion Detection Method Based on Machine Learning and State Observer for Train-Ground Communication Systems

A Novel Intrusion Detection Model Using a Fusion of Network and Device States for Communication-Based Train Control Systems

An Intrusion Detection Method of Data Tampering Attack in Communication-Based Train Control System.

A Novel Machine Learning Based Intrusion Detection Method for 5G Empowered CBTC Systems

A Novel Intrusion Detection Method in Train-Ground Communication System

An Effective Intrusion Detection System Based on Network Traffic and Packets for CBTC

Intrusion Detection Methods in Communication-Based Train Control Systems Based on Relative Entropy and Trust Evaluation

Hybrid Intrusion Detection with Decision Tree and Critical State Analysis for CBTC

A Comprehensive Resilient Control Strategy for CBTC Systems Through Train-to-Train Communications under Malicious Attacks

A transfer learning-based intrusion detection system for zero-day attack in communication-based train control system

A Cross-Layer Defense Method for Blockchain Empowered CBTC Systems Against Data Tampering Attacks

Anomaly Detection and Attack Classification for Train Real-Time Ethernet

A Security Defense Method Against Eavesdroppers in the Communication-Based Train Control System

Cross-Layer Defense Methods for Jamming-Resistant CBTC Systems

Intrusion Detection and Network Information Security Based on Deep Learning Algorithm in Urban Rail Transit Management System

An Ensemble Learning-Based Cyber-Attacks Detection Method of Cyber-Physical Power Systems

Research on Communication Network Intrusion Detection Method Based on Machine Learning Algorithm

A Quantitative Situation Awareness Approach for CBTC Systems Based on Multi-dimensional Gaussian Hidden Markov Model

Security Analysis for CBTC Systems under Attack–Defense Confrontation

A 2D Structure Entropy-based Approach to Security Assessment of Communication-based Train Control System

A Cross-Layer Defense Scheme for Edge Intelligence-Enabled CBTC Systems Against MitM Attacks