ANOMALY DETECTION AND ATTACK CLASSIFICATION FOR TRAIN REALTIME ETHERNET

Abstract

Cyberattacks and abnormalities are
becoming more common in current rail
networks due to their increasing dependence
on real-time Ethernet-based connectivity.
Manual monitoring solutions are not up to
the task of detecting these threats. Manual
solutions sometimes use static thresholds and
established rules to detect suspicious traffic,
which may lead to slower reaction times,
human mistake, and an inability to keep up
with changing attack trends. Because of
these restrictions, sophisticated and
automated intrusion detection systems are
essential. The goal of this project is to create
a system that uses machine learning to
identify cyberattacks and abnormalities in
railway communication networks by
analyzing real-time data. Using a Tkinterbased graphical user interface, users may
import, prepare, and analyze datasets using a
variety of classifiers, such as Support Vector
Machines (SVM), Random Forest, Decision
Trees, and sophisticated optimization
methods like Genetic Algorithms (GA) and
Particle Swarm Optimization (3SO).
Selecting features using SFS, GA, and PSO
improves model performance while reducing
dimensionality. The system is taught to
identify harmful traffic, such port scans and
denial-of-service assaults, using datasets like
KDD99. These datasets include information
on network behaviors and characteristics,
such as protocol type, service, and flag
status. Compared to more conventional
approaches, SVM with GA and PSO
achieves an accuracy of up to 99% in
experiments. The paramount need of
protecting transport facilities, the
compromise of which might have disastrous
effects, is the driving force behind this
initiative. By incorporating smart algorithms
that can adjust to new dangers, the suggested
system provides an automated, scalable, and
powerful substitute for human detection
techniques. It has an easy-to-understand UI
that makes it great for usage in real-world
settings, and it speeds up and enhances the
accuracy of detection. In the end, this study
enhances cyber resilience in railway
networks by addressing the limits of human
intrusion detection methods and proposing
an effective ML-driven alternative