Bridging Artificial Intelligence and Railway Cybersecurity: A Comprehensive Anomaly Detection Review

Recently, the techniques of industrial control systems (ICS) have developed rapidly, which leads to new cyber threats in this field. The railway system, as a special ICS, is also facing more and more challenges in the intrusion detection and risk evaluation fields. However, compared with other ICS, the intrusion detection and defense methods for railway systems are lagging behind. This paper is a comprehensive review of the application of artificial intelligence (AI) in the railway industry, with a particular focus on cybersecurity. We examine existing anomaly detection methods based on AI and their implementation in ICS and railway operations. We found that machine learning and deep learning algorithms are effective in processing large amounts of network traffic data, modeling normal system behavior, and detecting anomalies. Different AI-based anomaly detection algorithms each have their own strengths and weaknesses, and they hold significant potential for enhancing the cybersecurity of railway systems. While the field of AI in the railway industry is still in its early stages, several case studies demonstrate that AI technologies have already shown considerable promise in safeguarding railway networks. However, there are still numerous challenges in practical applications, such as improving accuracy, generalizability, and robustness. Addressing these challenges will be critical for realizing the full potential of AI in railway cybersecurity and ensuring the safety and efficiency of railway operations in the future. Our work serves as a guide for future explorations, aiming to contribute to the broader discourse of AI applications in industrial cybersecurity.