###### Abstract  
With the widespread adoption of wireless communication technologies in modern high-speed rail systems, the Train-to-Ground (T2G) communication system for Electric/Diesel Multiple Units (EMU/DMU) has become essential for train operation monitoring and fault diagnosis. However, this system is increasingly vulnerable to various cyber-physical threats, necessitating more intelligent and adaptive security protection mechanisms. This paper presents an intelligent security defense framework that integrates intrusion detection, risk scoring, and response mechanisms to enhance the security and responsiveness of the T2G communication system. First, feature selection is performed on the TON_IoT dataset to develop a Dream Optimization Algorithm (DOA)-optimized backpropagation neural network (DOA-BPNN) model for efficient anomaly detection. A Bayesian risk scoring module then quantifies detection outcomes and classifies risk levels, improving threat detection accuracy. Finally, a Q-learning-based reinforcement learning (RL) module dynamically selects optimal defense actions based on identified risk levels and attack patterns to mitigate system threats. Experimental results demonstrate improved performance in both multi-class and binary classification tasks compared to conventional methods. The implementation of the Bayesian risk scoring and decision-making modules leads to a 63.56% reduction in system risk scores, confirming the effectiveness and robustness of the proposed approach in an experimental environment. a 2025 25 3208 2  
Against this backdrop, ensuring the operational safety and communication stability of Electric Multiple Unit/Diesel Multiple Unit (EMU/DMU) trains has become a critical challenge. The Train Control and Management System (TCMS), serving as the core control platform of modern trains, integrates key subsystems such as traction, braking, and doors through the Train Communication Network (TCN), while enabling real-time monitoring of operational states via maintenance terminals and human-machine interfaces (HMI). While TCMS has significantly improved operational efficiency through digitalization and networking, its external communication interfaces were not originally designed with cybersecurity in mind, leaving them vulnerable to attacks. Among these external interfaces, the Train-to-Ground (T2G) communication channel, in line with the reference architecture from IEC 61375-2-6, plays a central role in relaying real-time data from onboard equipment to ground data centers over 4G/5G or WLAN networks [2], as illustrated in Figure 1. On the train side, the Mobile Communication Gateway (MCG) handles routing, firewall management, and authentication for all outbound traffic, while the Wayside Communication Gateway (WCG) on the ground side manages secure entry from external networks and facilitates connections to back-end services. This channel is responsible for transmitting operational parameters, positional data, analysis data such as Electric Multiple Units Operation Analysis System (EOAS) data, diagnostic messages, and fault logs in real-time or in bulk. Although T2G data exchange typically employs encryption, its exposure to public or carrier-operated networks still leaves it vulnerable to various cyber-physical threats. Potential adversaries may intercept, alter, replay, or block these data flows, whether they be unauthorized individuals in public areas, malicious insiders, or compromised components in the supply chain. As a result, any compromise of the T2G communication system could lead to data leaks, communication failures, or even interruptions in core services. To address the aforementioned challenges, this study proposes an intelligent security defense framework specifically designed for the T2G communication system to enhance the security and adaptive response capabilities of critical train communication links.