Monitoring cyberthreats in railway systems: A hybrid framework for detecting stealthy data tampering attacks

Railway cybersecurity has become a critical concern as the integration of advanced monitoring systems increases reliance on technology. Cyberattacks targeting railway systems can disrupt operations, compromise data integrity, and mislead maintenance decisions, jeopardizing safety and efficiency. Despite these risks, existing detection methods often struggle to address stealthy data tampering attacks designed to either mask failures or trigger unnecessary maintenance. To remedy this gap, this article proposes a novel framework combining Turnout Lifecycle Analysis (TLA) and Expected Behavior Analysis (EBA), complemented by a weighted, modified Dempster–Shafer theory to integrate threat estimations from both approaches. The proposed framework supports the detection of stealthy cyberattacks and the diagnosis of turnout faults, while enabling resilient decision-making under uncertainty. The framework is validated on simulated cyberattack scenarios, successfully identifying six out of seven attacks while reducing false positives. The results highlight the potential of this framework to give railway maintenance operators more accurate insights, help improve decision-making, and help enhance the safety and resilience of railway operations against cyberthreats.