DERAIL-ML: DEtecting RAilway Cyber-physicaL Attacks using Machine Learning

06/30/2025

Modern railway systems extend far beyond trains, stations, and tracks. They are now digitalised, utilising sensors and actuators, tracking train positions, and controlling track switches. Operations centres coordinate these systems, managing schedules, passenger information, and speed limits, enhancing productivity and reducing human error-related accidents. However, this increasing digitalisation has introduced vulnerabilities that make railways liable to cyber-attacks. Effective log monitoring is crucial for detecting cyber-physical attacks in critical infrastructures. Logs can document operations and identify anomalies. The challenge lies in distinguishing real threats from false alarms caused by sensor noise and inconsistencies. Anomalies can be detected by establishing sequential relationships between sensor data and actuator actions and then monitoring the system for unexpected behaviour. This work explores machine learning methods to automate the detection of anomalies.

Authors in the community:

• 

  J

  João Maria Lopes Inverno

  ist195601

Supervisors of this institution:

• 

  C

  Carlos Nuno da Cruz Ribeiro

  ist13499

electrical-engineering-electronic-engineering-information-engineering - Electrical engineering, electronic engineering, information engineering

eng - English

Instituto Superior Técnico