Detecting Intrusions in CBTC Systems with Mixed-Mode Operations

Communication-Based Train Control (CBTC) systems are automatic train control systems that rely on wireless data transmissions to provide safe and efficient railway operations. However, integrating wireless technologies has rendered railways vulnerable to cyber attacks. The current body of research concerning CBTC security does not consider that most railway operators deploy this system alongside a secondary train control system, known as external interlocking. The integration of these two train control systems allows for the operation of both CBTC-capable and CBTC-incapable trains along the same railway. This integration is termed a mixed-mode operation in the IEEE 1474.1 standard for CBTC performance and functional requirements. This work proposes a machine learning-based intrusion detection system for wireless communications in mixedmode operations to address the aforementioned gap in the literature. The detection methods proposed in this work were evaluated in a simulated railway environment that integrated the CBTC system with an external interlocking. Multiple machine learning models have been trained on the resultant data transmissions of both systems under normal and attack conditions. The experimental results provide valuable insights into which models can best meet the requirements of an integrated CBTC-external interlocking railway to ensure the integrity and availability of wireless transmissions.