## 6 Conclusions and Future Work  
This research proposes an intelligent security defense framework intended to address key cybersecurity challenges of T2G communications systems, as highlighted in the earlier threat analysis, through three complementary components. The DOA-BPNN intrusion detection model specifically targets network-based attacks identified in the T2G threat model, such as DDoS attacks and unauthorized access attempts that threaten train communication systems. Using the TON_IoT dataset as a baseline, we applied feature selection techniques to extract highly correlated features, reducing dimensionality and redundancy. The Dream Optimization Algorithm was employed to optimize the structure and weights of the BP neural network, resulting in enhanced training stability and detection performance. The Bayesian risk scoring mechanism provides critical context for T2G systems by translating detected anomalies into quantifiable metrics, producing standardized risk scores and level labels that enable operators to understand the potential impact of security incidents on railway operations. By incorporating contextual and probabilistic factors, this  
Figure 12: Comparison of risk scores of three security scenarios before and after defense. mechanism enhances the interpretability of anomaly severity and supports more flexible downstream decision-making. The Q-learning response system offers automated defense selection that is particularly suited to T2G environments, where attack scenarios can rapidly evolve and manual intervention may be delayed, dynamically selecting defense actions that balance risk mitigation and resource efficiency. While using a general IoT dataset for validation, the attack patterns closely resemble those threatening T2G systems, making our framework's performance relevant to railway communication security. Comparative experiments demonstrated improved results in both binary and multi-class classification tasks, with the Full Defense configuration achieving an average risk score reduction of 63.56%, demonstrating strong adaptability and potential for deployment in high-risk T2G communication scenarios. Despite the system's excellent performance in simulation environments, several issues require further exploration. Certain attack types (e.g., ransomware, XSS) still face class imbalance, which can be addressed in future work through data augmentation techniques such as SMOTE or GAN-based synthesis. Additionally, evaluating key operational metrics--such as CPU utilization, response latency, and detection rate--in actual railway operating environments is necessary. A particularly important direction for future research is to apply and validate our framework using railway-specific datasets that contain T2G communication patterns and actual attack samples from railway networks. This will provide more direct evidence of the framework's adaptability to real-world T2G security challenges and strengthen its practical relevance to railway cybersecurity. Further optimization of the reinforcement learning module is required to improve its learning efficiency and decision-making strategies. Future research should streamline the model for lightweight deployment and assess its scalability and performance across other railway control subsystems. Conceptualization, C.S. ; methodology, C.S. ; software, C.S. ; formal analysis, C.S. ; resources, C.Y. ; writing--original draft, C.S. ; writing--review and editing, P.S. ; supervision, W.Z. and H.W. ; funding acquisition, W.Z. All authors have read and agreed to the published version of the manuscript. This work was supported by the China Railway Group Co., Ltd. (Project No. N2024W008). Not applicable. The data presented in this study are available in the public domain.