###### Abstract
The framework integrates a Dream Optimization Algorithm (DOA)-optimized backpropagation neural network (BP) for intrusion detection, a Bayesian risk scoring mechanism, and a reinforcement learning (RL)-based decision module, forming a closed-loop architecture encompassing detection, evaluation, and response. More specifically, the Industry 4.0/Internet of  
Figure 1: T2G communication system network structure. Things (IoT) and Industrial IoT (IIoT) dataset--TON_IoT--is adopted as the experimental foundation [3, 4, 5]. A hybrid feature selection strategy, combining logistic regression with forward sequential selection, is employed to extract a compact and highly discriminative feature subset. The DOA algorithm [6] is then used to optimize the initial weights and thresholds of the BP neural network [7], resulting in a high-performance intrusion detection model referred to as DOA-BPNN. On top of this, a Bayesian inference-based risk scoring module quantifies real-time threat levels based on detection outputs [8]. The resulting risk scores are fed into a reinforcement learning module, where a Q-learning algorithm dynamically generates optimal defense strategies according to the identified risk levels and attack patterns, thereby mitigating potential threats to the system [9]. The main contributions of this paper are summarized as follows:  
* We analyze the security vulnerabilities of the T2G communication system to identify potential attack surfaces and abnormal behavior patterns. * A hybrid feature selection strategy combining logistic regression and forward sequential selection is proposed to obtain a compact and relevant feature subset, thereby improving model efficiency and generalization. * An intrusion detection model based on DOA-BPNN is developed. The DOA enhances the initialization of network weights, accelerates convergence, and reduces the risk of local minima. Simulation results show that the proposed method achieves improved detection accuracy and training stability compared with the standard BP model. * A Bayesian risk scoring mechanism is introduced to quantify threat levels based on detection results. It incorporates detection confidence, anomaly intensity, and contextual adjustment to generate standardized real-time risk scores, enhancing threat perception and supporting dynamic defense decisions. * A reinforcement learning-based response module is incorporated, using Q-learning to adaptively select optimal defense actions under varying risk levels and attack types. This enables closed-loop, feedback-driven responses, providing intelligent and scalable protection for the T2G communication system. * To comprehensively evaluate the proposed framework, comparative experiments are conducted with other optimization algorithms in both binary and multi-class classification tasks. The framework's effectiveness is also evaluated in scenarios with and without active response mechanisms. The remainder of this paper is organized as follows. Section 2 reviews recent studies on train control system security and intrusion detection. Section 3 analyzes major threat models and attack classifications targeting the T2G communication system. Section 4 presents the proposed framework, detailing the dataset, feature selection method, and the detection-evaluation-response pipeline. Section 5 provides experimental results and analysis. Section 6 concludes the paper and outlines directions for future work.