MSRNet-GLAM: A novel intrusion detection method for train communication network

Intrusion detection techniques play an important role in the security measures of train communication network (TCN). Due to the increasing openness of TCN, its security risk is also increasing, which makes TCN intrusion detection techniques receive more attention. Currently, there is an inherent class imbalance problem in the data samples for TCN intrusion detection. In addition, with the development of intrusion methods, intrusion traffic becomes more stealthy and the boundaries between intrusion traffic and normal traffic become increasingly ambiguous. Together, these issues contribute to the degradation of TCN intrusion detection performance. To address these challenges, A TCN intrusion detection method based on a multi-scale residual network with global and local attention mechanism (MSRNet-GLAM) is proposed. First, a multi-scale residual network is utilized to enhance the model's ability to extract different deep features of network traffic, thus better capturing the differences between categories. Then, the model is guided to focus on learning key information in global and local features by introducing the global and local attention mechanism (GLAM), which reduces the fitting of redundant information in the majority class samples and improves the model's generalization ability and sensitivity to the detection of the minority class samples. In addition, an improved focus loss function (IFL) is introduced to further improve the model's detection ability for minority class samples and stealthy intrusion samples with ambiguous class boundaries by increasing the loss weights of difficult-to-classify samples. A simulation network platform is built to simulate the scenario of TCN under intrusion, and data are collected for the training and validation of the intrusion detection model. Through testing on the simulation platform, the proposed method achieves 99.51 %, 98.98 %, 99.54 %, and 99.26 % in accuracy, precision, recall, and F1 score, respectively, which validates the effectiveness and superiority of the method in TCN intrusion detection.