An intrusion detection method based on machine learning and state observer for train-ground communication systems

Many ensemble and decision-fusion frameworks perform decision-level fusion rather than strict feature-level fusion, aggregating per-model outputs via voting schemes or risk evaluation engines; this design simplifies deployment across diverse ICS domains because existing detectors can be reused while the fusion logic is tuned to plant-specific safety and criticality requirements.

“Second, many frameworks perform decision-level fusion rather than strict feature-level fusion, aggregating per-model outputs via voting schemes or risk evaluation engines; this design simplifies deployment across diverse ICS domains because existing detectors can be reused while the fusion logic is tuned to plant-specific safety and criticality requirements [133-136].”

Gao et al. [136]'s cyber-physical correlation framework combines both layers' outputs to verify whether detected network attacks have a tangible impact on train control, providing an integrated anomaly assessment over hybrid data.

“Finally, a cyber-physical correlation framework combines both layers' outputs to verify whether detected network attacks have a tangible impact on train control, providing an integrated anomaly assessment over hybrid data.”

Gao et al. [136] proposed a cyber-physical hybrid anomaly detection method that couples machine-learning-based network intrusion detection with physical state observation, using a self-constructed train-ground wireless communication simulation dataset.

“Gao et al. [136] proposed a cyber-physical hybrid anomaly detection method that couples machine-learning-based network intrusion detection with physical state observation, using a self-constructed train-ground wireless communication simulation dataset.”

Several ensemble and decision-fusion works go beyond pure 'detection accuracy' and link fused anomaly decisions to higher-level concepts-such as safety integrity, risk scores, or physical impact validation-thereby prioritizing responses to attacks that threaten equipment and process safety instead of treating all alerts as equally important.

“Third, several works go beyond pure 'detection accuracy' and link fused anomaly decisions to higher-level concepts-such as safety integrity, risk scores, or physical impact validation-thereby prioritizing responses to attacks that threaten equipment and process safety instead of treating all alerts as equally important [134,136,137].”

In Gao et al. [136], in an IEEE 802.11 wireless environment, network-layer traffic features-20 statistics including control fields, addresses, and retransmission rates-are used to train RF, GBDT, AdaBoost, and SVM classifiers for detecting DoS, deauthentication, and flooding attacks.

“In an IEEE 802.11 [141] wireless environment, network-layer traffic features-20 statistics including control fields, addresses, and retransmission rates-are used to train RF, GBDT, AdaBoost, and SVM classifiers for detecting DoS, deauthentication, and flooding attacks.”

In Gao et al. [136], at the physical layer, a train dynamics state observer computes residual between measured and estimated position/velocity to determine operational anomalies.

“At the physical layer, a train dynamics state observer computes residual between measured and estimated position/velocity to determine operational anomalies.”

Ensemble and decision-fusion-based hybrid data studies explicitly combine detectors with heterogeneous inductive biases-tree ensembles, kernel methods, deep sequence models, and state observers-so that cyber-layer traffic anomalies and physical-layer process deviations are jointly reflected in the final decision, improving robustness under noisy hybrid data and nonstationary operating regimes.

“First, they explicitly combine detectors with heterogeneous inductive biases-tree ensembles, kernel methods, deep sequence models, and state observers-so that cyber-layer traffic anomalies and physical-layer process deviations are jointly reflected in the final decision, improving robustness under noisy hybrid data and nonstationary operating regimes [133-137].”