Abstract:Real-time Ethernet has been applied to train control and management system (TCMS) of 250km/h Fuxing Electric Multiple Units (EMUs) and some urban rail vehicles. The openness of the Ethernet communication protocol poses a risk of intrusion attacks on the train communication network. It is, therefore, necessary that a safety protection technology is introduced to the train communication network based on real-time Ethernet. In this paper, a train communication network intrusion detection system based on anomaly detection and attack classification is proposed. Firstly, the paper built an anomaly detection model based on support vector machines (SVM). The particle swarm optimization-support vector machines (PSO-SVM), and genetic algorithm-support vector machines (GA-SVM) optimization algorithms are used to optimize the kernel function parameters of SVM. Secondly, the paper built two attack classification models based on random forest. They are iterative dichotomiser3 (ID3) and classification and regression tree (CART). And then, the built intrusion detection and attack classification model is tested by using the public data set knowledge discovery and data mining-99(KDD-99) and the data set of the simulation train real-time Ethernet test bench. PSO-SVM improves the intrusion detection accuracy from 90.3% to 95.75%, GA-SVM improves the detection accuracy from 90.3% to 95.85%. The training time of the PSO-SVM algorithm was higher than that of the GA-SVM algorithm, and much higher than that of the SVM, without optimization. Both ID3 and CART models are verified valid in the attack classification, while the ID3 algorithm obtained 100% accuracy on the training set, and only 32.89% accuracy on the test set, ID3 has a poor classification accuracy of the data outside of the training set. Also, the classification time is very long for ID3 compared with CART. So the comprehensive experimental results show that the intrusion detection system of train real-time Ethernet can use the GA-SVM model for detection of abnormal data. After passing the normal data, the CART model can be used to distinguish between the types of attacks to better complete subsequent responses and operations. Compared with the anomaly detection model based on SVM, the proposed model improves intrusion detection accuracy. And the proposed attack classification algorithm based on CART can improve the computing speed while ensuring the precision of classification.

An Effective Intrusion Detection System Based on Network Traffic and Packets for CBTC

An Intrusion Detection Method of Data Tampering Attack in Communication-Based Train Control System.

Hybrid Intrusion Detection with Decision Tree and Critical State Analysis for CBTC

CBF-IDS: Addressing Class Imbalance Using CNN-BiLSTM with Focal Loss in Network Intrusion Detection System

Hybrid Intrusion Detection System for Complicated Network

A Novel Intrusion Detection Model Using a Fusion of Network and Device States for Communication-Based Train Control Systems

Intrusion Detection Methods in Communication-Based Train Control Systems Based on Relative Entropy and Trust Evaluation

An Intrusion Detection Method Based on Machine Learning and State Observer for Train-Ground Communication Systems

A Novel Machine Learning Based Intrusion Detection Method for 5G Empowered CBTC Systems

A transfer learning-based intrusion detection system for zero-day attack in communication-based train control system

A Comprehensive Resilient Control Strategy for CBTC Systems Through Train-to-Train Communications under Malicious Attacks

A Cross-Layer Defense Scheme for Edge Intelligence-Enabled CBTC Systems Against MitM Attacks

Detecting Temporal Attacks: an Intrusion Detection System for Train Communication Ethernet Based on Dynamic Temporal Convolutional Network.

Data-Driven Intrusion Detection for Intelligent Internet of Vehicles: A Deep Convolutional Neural Network-Based Method

A Resilience-Based Security Assessment Approach for CBTC Systems

An Intrusion Detection System Based on Machine Learning for CAN-Bus.

Security Analysis for CBTC Systems under Attack–Defense Confrontation

An Intrusion Detection System Based on the Double-Decision-Tree Method for In-Vehicle Network

Anomaly Detection and Attack Classification for Train Real-Time Ethernet

Attacks and Counter Defense Mechanisms for CBTC Systems: System Modeling and Availability Analysis.

A Hybrid Intrusion Detection Method Using Improved Stacking Ensemble Algorithm and False Positive Elimination Strategy for CBTC