Lightweight NB-XGB fusion-based intrusion detection method for CBTC onboard systems

Addressing the critical challenges of data class imbalance, low detection accuracy, and insufficient real-time performance in existing intrusion detection systems for communication-based train control (CBTC) systems, this study proposes a novel lightweight intrusion detection method for CBTC onboard equipment based on a fused Naive Bayes-extreme gradient boosting (NB-XGB) model. The proposed approach operates through two coordinated phases: an offline training phase and an online detection phase. In order to identify an ideal feature subset with greatest relevance and minimal redundancy, the CICIDS2017 and CBTCset datasets are preprocessed and then subjected to correlation-based feature selection during the offline phase. The extracted features are then balanced using a hybrid sampling approach that combines edited nearest neighbors (ENN) undersampling and synthetic minority over-sampling technique (SMOTE), after which the naive Bayes (NB) and XGBoost models are integrated through static weighted fusion to establish the classification foundation. To provide effective real-time detection for online deployment, knowledge distillation technology transfers the learned information from the trained NB-XGB fusion model to a lightweight multilayer perceptron (MLP) student model. The method’s efficacy is demonstrated by experimental evaluation on the CICIDS2017 and CBTCset datasets, where the NB-XGB fusion model outperforms comparative models such as K-nearest neighbors (KNN), NB, and isolation forest (IForest) with notable accuracies of 0.9961 and 0.9557. It simultaneously demonstrates the effectiveness of the proposed method. Additional lightweight validation confirms the distilled model’s inference speed of 0.16 ms per sample, sufficiently verifying the solution’s real-time capabilities for practical CBTC intrusion detection scenarios.