Detecting Intrusions in Communication-Based Train Control Systems

Communication-Based Train Control (CBTC) systems are being widely used as a control and signalling system for railways. They allow trains to communicate with infrastructural components through wireless communications to receive operational commands, and to include Ethernet-based communications inside them to perform traction and braking operations. These communication technologies make railway systems vulnerable to cyber-attacks that can disrupt traction and braking operations and threaten trains' safety. Attacks can take place without the driver noticing, which might lead to collisions. In this work, we propose an Intrusion Detection System (IDS) based on Machine Learning (ML) to detect attacks on traction and braking operations performed inside the train. This IDS analyzes trains' mobility data and classifies them into normal and attack data. No previous work proposed an IDS to detect attacks on trains' mobility. Therefore, the proposed IDS helps train control centers to detect such attacks and take appropriate measures to avoid hazardous incidents. To evaluate this system, a realistic network of trains was simulated using Simulation of Urban MObility (SUMO) on part of the railway in Berlin, Germany. We compared the performance of three ML classifiers: K-Nearest Neighbours, Naive Bayes and Random Forests. The results show that Random Forests performed the best with a classification accuracy between 94% and 99%. Additionally, three plausibility checks were proposed to enhance the detection accuracy by 1% to 3%.