## 2 Related Work
[20] developed a hybrid deep learning model that first employs convolutional neural network (CNN) layers to extract key features from the input data and then uses long short-term memory (LSTM) layers to capture temporal dependencies. Experimental results on the NSL-KDD dataset showed significant improvements in the detection accuracy of abnormal network activities, particularly in recognizing complex attack patterns. [PERSON] et al. [21] introduced an intrusion detection method based on a Hybrid Kernel Extreme Learning Machine (HKELM), which combines radial basis function and polynomial kernels. Model parameters are optimized using a hybrid strategy that integrates Differential Evolution (DE) and Gravitational Search Algorithm (GSA), and feature reduction is performed via Kernel Principal Component Analysis (KPCA). The proposed method achieved excellent detection performance and computational efficiency across the KDD99, UNSW-NB15, and Tennessee Eastman (TE) industrial process datasets. [PERSON] et al. [22] proposed an intrusion detection model that combines an entropy-based Particle Swarm Optimization (EPSO) algorithm with a backpropagation neural network (BPNN). By dynamically adjusting the inertia weight of the PSO, the algorithm improved global search capability and significantly enhanced the optimization of weights and thresholds in the BP network. The EPSO-BPNN model achieved a detection accuracy of 92.90% on the KDD Cup 99 dataset, outperforming traditional BP, Support Vector Machine (SVM), and standard PSO-BPNN approaches. Intrusion detection is commonly based on network traffic analysis, which requires processing features such as statistical attributes, correlation, behavioral patterns, payload content, and port information to identify suspicious activities. However, such data processing imposes a considerable computational burden on onboard train devices, which are typically resource-constrained in terms of energy and processing capacity [23]. Behavior-based detection approaches aim to discover potential threats--such as botnets--by identifying deviations from historical communication patterns. These methods often rely on a baseline of normal behavior, which can make it difficult to detect advanced persistent threats employing stealthy strategies [24]. Therefore, lightweight, efficient, and deployable IDS architectures are essential for train-mounted embedded systems [25]. To address this, a lightweight IDS framework was proposed, which utilizes a stochastic gradient descent classifier (SGDC) in combination with four ridge regression-based feature selection algorithms. Their system extracts the most effective feature subsets from large-scale datasets and achieves high detection performance while significantly reducing both training and testing time. The experimental results of three benchmark datasets--KDD-CUP-1999, Bott-IoT-2018, and N-BalIoT-2021--demonstrate its effectiveness in constrained environments [26]. Following this approach, this study proposes a BPNN-based intrusion detection system optimized using the DOA algorithm. A Bayesian risk scoring mechanism is further incorporated to assess the threat level of each detected instance, and the results are fed into a reinforcement learning-based decision module. This closed-loop architecture allows for adaptive and optimal defense decisions for train operations, while minimizing security risks under limited computational resources.