## 2 Related Work  
From the perspective of train operation, data transmission between onboard and ground systems in EMU/DMU can essentially be regarded as a wireless communication process. To date, most research on intrusion detection in railway wireless communication has focused on communication-based train control (CBTC) systems. [PERSON] et al. [10] introduced a two-layer T2G intrusion detection; the first layer employs machine learning (RF/GBDT) on IEEE 802.11 traffic to spot attacks and the second layer uses a state observer to monitor key physical variables like movement authority. This approach minimizes false alarms while swiftly detecting threats that jeopardize train safety. A method was proposed that combines network status and device condition to identify anomalous traffic, with the added capability of distinguishing cyberattacks from random system faults [11], and their approach achieved a true positive rate (TPR) of 97.64%. [PERSON] et al. [12] developed a transfer learning-based intrusion detection system for CBTC, utilizing an optimized 1D convolutional neural network and long short-term memory network to automatically capture spatial and temporal features in network data. Simulated annealing was used for hyperparameter tuning, achieving an attack detection accuracy of up to 99.32%. [PERSON] et al. [13] proposed a hybrid intrusion detection framework that integrates an improved stacking ensemble algorithm with a false-positive suppression strategy. By optimizing base classifier probabilities and applying Bayesian optimization for hyperparameter tuning, the method demonstrated excellent performance on both the KDD99 and CBTC simulation datasets. With the growing deployment of 5G, [PERSON] et al. [14] investigated 5G-enabled intrusion detection strategies for CBTC. Their experiments showed that, whether using decision trees or convolutional neural networks, classification performance in both binary and multi-class tasks improved significantly after feature selection--highlighting the importance of proper data preprocessing and feature engineering for intrusion detection system (IDS) performance. [PERSON] et al. [15] introduced a self-generated encoding technique that uses train message timestamps to dynamically generate encryption sequences. This method was designed to detect stealthy false data injection (FDI) attacks in the Train-Ground Communication System (TGCS), enabling the effective detection of anomalous activity. [PERSON] et al. [16] further extended intrusion detection research to TCMS by analyzing actual train operational data. They defined critical context features influencing intrusion detection within CBTC communication, including physical, network, environmental, and operational contexts. A variety of algorithms were evaluated, including Naive Bayes, logistic regression, k-nearest neighbors, random forest, XGBoost, isolation forest, local outlier factor, and elliptical envelope, all confirming the importance of context-aware information in train-related intrusion detection. In recent years, researchers have employed a wide range of techniques for intrusion detection, including signature-based, anomaly-based, and behavior-based approaches, particularly for identifying botnet activity [17]. With the advancement of machine learning, IDS have increasingly incorporated machine learning algorithms to overcome the limitations of traditional detection methods [18]. [PERSON] et al. [19] proposed a network intrusion detection model based on Particle Swarm Optimization (PSO) and XGBoost, where PSO is used to automatically optimize the hyperparameters of the XGBoost classifier. The model was evaluated on the NSL-KDD dataset and demonstrated superior performance in identifying rare attack types such as User-to-Root (U2R) and Remote-to-Local (R2L), outperforming standard XGBoost, Bagging, and random forest classifiers in overall accuracy. [PERSON] et al.