基于NB-XGB融合的轻量化CBTC车载端入侵检测方法

王国华; 张蕾; 张学军; 逯闯

doi:10.13700/j.bh.1001-5965.2025.0546

基于NB-XGB融合的轻量化CBTC车载端入侵检测方法

doi: 10.13700/j.bh.1001-5965.2025.0546

兰州交通大学电子与信息工程学院，兰州 730070

基金项目:

国家自然基金(61762058)；甘肃省重点研发计划(25YFFA089)：甘肃省自然科学基金(25JRRA190)

详细信息

通讯作者:
E-mail：wangguohua@mail.lzjtu.cn

中图分类号: TP393.08
计量
- 文章访问数: 454
- HTML全文浏览量: 82
- PDF下载量: 23
- 被引次数: 0
出版历程
- 收稿日期: 2025-08-05
- 录用日期: 2025-12-08
- 网络出版日期: 2026-01-04
- 整期出版日期: 2026-07-31

Lightweight NB-XGB fusion-based intrusion detection method for CBTC onboard systems

School of Electronics and Information Engineering，Lanzhou Jiaotong University，Lanzhou 730070，China

Funds:

National Natural Science Foundation of China(61762058); Key Research and Development Program of Gansu Province(25YFFA089); Natural Science Foundation of Gansu Province (25JRRA190)

More Information

Corresponding author: E-mail：wangguohua@mail.lzjtu.cn

摘要

摘要:
为解决现有基于通信的列车控制(CBTC)系统入侵检测系统存在数据类别不平衡、检测准确率低和在线检测实时性不高的问题，提出一种基于朴素贝叶斯-极限梯度提升(NB-XGB)融合的轻量化CBTC车载端入侵检测方法，该方法分为离线检测阶段与在线检测阶段。离线检测阶段，对CICIDS2017数据集和CBTCset数据集进行预处理并利用基于相关性的特征选择方法进行特征提取，提取相关性最高且冗余度最低的最优特征子集；对最优特征子集进行基于编辑近邻欠采样(ENN)和合成少数类过采样(SMOTE)的混合采样数据平衡处理；通过静态加权融合的方法对朴素贝叶斯(NB)和极端梯度提升(XGBoost)模型进行集成，从而实现二分类；在线检测阶段，采用知识蒸馏技术将训练后的NB-XGB融合模型迁移至多层感知机(MLP)学生模型中实现轻量化实时样本检测。所提方法在CICIDS2017和CBTCset数据集上进行验证实验，与K近邻算法(KNN)、NB、孤立森林(IForest)等模型进行对比，NB-XGB融合模型的准确率分别为0.9961和0.9557，同时证明了所提方法的有效性；在轻量化实验中，推理时长降到了0.16 ms/样本，证明在线检测的实时性。
- CBTC /
- 入侵检测 /
- 机器学习 /
- 混合采样 /
- 知识蒸馏
Abstract:
Addressing the critical challenges of data class imbalance, low detection accuracy, and insufficient real-time performance in existing intrusion detection systems for communication-based train control (CBTC) systems, this study proposes a novel lightweight intrusion detection method for CBTC onboard equipment based on a fused Naive Bayes-extreme gradient boosting (NB-XGB) model. The proposed approach operates through two coordinated phases: an offline training phase and an online detection phase. In order to identify an ideal feature subset with greatest relevance and minimal redundancy, the CICIDS2017 and CBTCset datasets are preprocessed and then subjected to correlation-based feature selection during the offline phase. The extracted features are then balanced using a hybrid sampling approach that combines edited nearest neighbors (ENN) undersampling and synthetic minority over-sampling technique (SMOTE), after which the naive Bayes (NB) and XGBoost models are integrated through static weighted fusion to establish the classification foundation. To provide effective real-time detection for online deployment, knowledge distillation technology transfers the learned information from the trained NB-XGB fusion model to a lightweight multilayer perceptron (MLP) student model. The method’s efficacy is demonstrated by experimental evaluation on the CICIDS2017 and CBTCset datasets, where the NB-XGB fusion model outperforms comparative models such as K-nearest neighbors (KNN), NB, and isolation forest (IForest) with notable accuracies of 0.9961 and 0.9557. It simultaneously demonstrates the effectiveness of the proposed method. Additional lightweight validation confirms the distilled model’s inference speed of 0.16 ms per sample, sufficiently verifying the solution’s real-time capabilities for practical CBTC intrusion detection scenarios.
- CBTC /
- intrusion detection /
- machine learning /
- hybrid sampling /
- knowledge distillation

HTML全文

图 1 CBTC系统结构

Figure 1. Structure of CBTC system

下载: 全尺寸图片幻灯片

图 2 本文方法整体框架

Figure 2. Overall framework of the proposed method

下载: 全尺寸图片幻灯片

图 3 基于GS的NB模型超参数优化流程

Figure 3. Hyperparameter optimization flow of NB model based on GS

下载: 全尺寸图片幻灯片

图 4 基于BO优化XGBoost模型超参数优化流程

Figure 4. Hyperparameter optimization flow of XGBoost model based on BO optimization

下载: 全尺寸图片幻灯片

图 5 知识蒸馏结构

Figure 5. Structure of knowledge distillation

下载: 全尺寸图片幻灯片

图 6 MLP基本结构

Figure 6. Basic structure of MLP

下载: 全尺寸图片幻灯片

图 7 CICIDS2017数据集下XGBoost优化过程中损失与准确率曲线

Figure 7. Loss and accuracy curves of XGBoost in optimization process of CICIDS2017 dataset

下载: 全尺寸图片幻灯片

图 8 TSMset数据集下XGBoost优化过程中的损失与准确率曲线

Figure 8. Loss and accuracy curves of XGBoost in optimization process of TSMset dataset

下载: 全尺寸图片幻灯片

图 9 WOMset数据集下XGBoost的优化过程中的损失与准确率曲线

Figure 9. Loss and accuracy curves of XGBoost in optimization process of WOMset dataset

下载: 全尺寸图片幻灯片

图 10 不同数据集下模型尺寸压缩率和推理加速比的比较

Figure 10. Comparison of model size compression ratio and inference acceleration ratio under different datasets

下载: 全尺寸图片幻灯片

表 1 基于BO优化的XGBoost模型参数设置

Table 1. Parameter settings of XGBoost model based on BO optimization

参数	数值
最大深度	（3，10）
学习率	（0.01，0.3）
基学习器数量	（50，300）
子采样比例	（0.5，1.0）
特征采样比例	（0.5，1.0）
初始采样点数	5
迭代次数	100

下载: 导出CSV

表 2 基于MLP学生模型参数设置

Table 2. Parameter settings based on MLP student model

参数	数值
隐藏层大小	（64，32）
正则化系数	0.1
温度参数	3
最大迭代次数	300
随机种子	42

下载: 导出CSV

表 3 不同特征提取方法的性能对比结果

Table 3. Performance comparison results of different feature extraction methods

方法	准确率	精确率	召回率	F₁值
CFS^[14]	0.9960	0.9953	0.9985	0.9926
PCA^[15]	0.9957	0.9925	0.9937	0.9931
XGBoost^[20]	0.9953	0.9896	0.9900	0.9940

下载: 导出CSV

表 4 CICIDS2017数据集中数据平衡的性能对比结果

Table 4. CICIDS2017 performance comparison of data balance in dataset

方法	准确率	精确率	召回率	F₁值
ENN-SMOTE	0.9952	0.9903	0.9944	0.9923
SMOTE^[11]	0.9947	0.9912	0.9920	0.9916
KMeans-SMOTE	0.9947	0.9875	0.9956	0.9915

下载: 导出CSV

表 5 TSMset数据集中数据平衡的性能对比结果

Table 5. Performance comparison results of data balancing in TSMset dataset

方法	准确率	精确率	召回率	F₁值
ENN-SMOTE	0.9860	0.9521	0.9267	0.9394
SMOTE^[11]	0.9849	0.9769	0.8931	0.9331
KMeans-SMOTE	0.9856	0.9959	0.8812	0.9351

下载: 导出CSV

表 6 WOMset数据集中数据平衡的性能对比结果

Table 6. Performance comparison results of data balancing in WOMset dataset

方法	准确率	精确率	召回率	F₁值
ENN-SMOTE	0.9464	0.7658	0.8120	0.7901
SMOTE^[11]	0.9442	0.8718	0.7213	0.7894
KMeans-SMOTE	0.9459	0.9056	0.7001	0.7897

下载: 导出CSV

表 7 不同数据集上NB模型的性能评估结果

Table 7. Performance evaluation results of NB models on different datasets

数据集	参数	准确率	精确率	召回率	F₁值
CICIDS2017^[24]	1×10⁻⁵	0.8077	0.7410	0.5928	0.6586
TSMset^[25]	1×10⁻⁹	0.9857	1.0000	0.8790	0.9356
WOMset^[25]	1×10⁻⁹	0.9499	1.0000	0.6548	0.7914

下载: 导出CSV

表 8 CICIDS2017数据集下NB-XGB融合模型不同参数性能比较

Table 8. Comparison of different parameters for NB-XGB fusion model on CICIDS2017 dataset

W_xgb	W_nb	准确率	精确率	召回率	F₁值
0	1.0	0.8077	0.7410	0.5928	0.6586
0.1	0.9	0.8079	0.7416	0.5928	0.6589
0.2	0.8	0.8082	0.7423	0.5931	0.6594
0.3	0.7	0.8086	0.7434	0.5933	0.6599
0.4	0.6	0.8093	0.7453	0.5934	0.6607
0.5	0.5	0.8146	0.7612	0.5938	0.6672
0.6	0.4	0.9959	0.9932	0.9935	0.9934
0.7	0.3	0.9961	0.9924	0.9951	0.9938
0.8	0.2	0.9961	0.9918	0.9957	0.9938
0.9	0.1	0.9958	0.9909	0.9959	0.9934
1.0	0	0.9955	0.9893	0.9963	0.9928

下载: 导出CSV

表 9 TSMset数据集下NB-XGB融合模型不同参数性能比较

Table 9. Comparison of different parameters for NB-XGB fusion model on TSMset dataset

W_xgb	W_nb	准确率	精确率	召回率	F₁值
0	1.0	0.9857	0.9922	0.8788	0.9355
0.1	0.9	0.9857	0.9922	0.8789	0.9355
0.2	0.8	0.9857	0.9922	0.8789	0.9355
0.3	0.7	0.9857	0.9922	0.8789	0.9355
0.4	0.6	0.9857	0.9922	0.8789	0.9355
0.5	0.5	0.9857	0.9922	0.8789	0.9355
0.6	0.4	0.9807	0.9134	0.9237	0.9185
0.7	0.3	0.9771	0.8692	0.9480	0.9069
0.8	0.2	0.9749	0.8476	0.9597	0.9002
0.9	0.1	0.9734	0.8337	0.9674	0.8956
1.0	0	0.9726	0.8255	0.9729	0.8932

下载: 导出CSV

表 10 WOMset数据集下NB-XGB融合模型不同参数性能比较

Table 10. Comparison of different parameters for NB-XGB fusion model on WOMset dataset

W_xgb	W_nb	准确率	精确率	召回率	F₁值
0	1.0	0.9499	0.9928	0.6546	0.7913
0.1	0.9	0.9499	0.9928	0.6546	0.7913
0.2	0.8	0.9499	0.9928	0.6546	0.7913
0.3	0.7	0.9499	0.9928	0.6546	0.7913
0.4	0.6	0.9499	0.9928	0.6546	0.7913
0.5	0.5	0.9499	0.9928	0.6547	0.7913
0.6	0.4	0.9307	0.7273	0.8355	0.7776
0.7	0.3	0.9172	0.6551	0.9066	0.7606
0.8	0.2	0.9091	0.6241	0.9397	0.7501
0.9	0.1	0.9053	0.6107	0.9576	0.7458
1.0	0	0.9021	0.6009	0.9675	0.7414

下载: 导出CSV

表 11 CICIDS2017数据集不同模型的性能比较

Table 11. CICIDS2017 performance comparison of different models in dataset

模型	准确率	精确率	召回率	F₁值
XGBoost^[20]	0.9956	0.9899	0.9962	0.9931
RF	0.9945	0.9917	0.9908	0.9913
MLP^[23]	0.9513	0.8880	0.9663	0.9255
KNN	0.9953	0.9883	0.9969	0.9926
IForest	0.6829	0.4794	0.1532	0.2322
NB^[18]	0.8077	0.7410	0.5928	0.6586
CNN-LSTM^[9]	0.9496	0.8865	0.9620	0.9227
DAO-BPNN^[26]	0.9482	0.8913	0.9823	0.9345
NB-XGB	0.9961	0.9918	0.9957	0.9938

下载: 导出CSV

表 12 TSMset数据集不同模型的性能比较

Table 12. TSMset performance comparison of different models in dataset

模型	准确率	精确率	召回率	F₁值
XGBoost^[20]	0.9718	0.8191	0.9762	0.8907
RF	0.9857	0.9998	0.8791	0.9355
MLP^[23]	0.9476	0.6997	0.9722	0.8138
KNN	0.9653	0.8080	0.9254	0.8627
IForest	0.8489	0.3335	0.2830	0.3062
NB^[18]	0.9857	1.0000	0.8790	0.9356
CNN-LSTM^[9]	0.9664	0.7988	0.9553	0.8701
DAO-BPNN^[26]	0.9668	0.8138	0.9319	0.8688
NB-XGB	0.9807	0.9134	0.9237	0.9185

下载: 导出CSV

表 13 WOMset数据集不同模型的性能比较

Table 13. WOMset performance comparison of different models in dataset

模型	准确率	精确率	召回率	F₁值
XGBoost^[20]	0.9014	0.5989	0.9698	0.7405
RF	0.9020	0.6203	0.8366	0.7124
MLP^[23]	0.9095	0.6352	0.8845	0.7394
KNN	0.9050	0.6183	0.9018	0.7336
IForest	0.8212	0.3315	0.2282	0.2706
NB^[18]	0.9499	1.0000	0.6548	0.7914
CNN-LSTM^[9]	0.8831	0.5601	0.9060	0.6922
DAO-BPNN^[26]	0.8995	0.6094	0.8553	0.7117
NB-XGB	0.9307	0.7273	0.8355	0.7776

下载: 导出CSV

表 14 不同数据集上模型轻量化后的性能比较

Table 14. Comparison of lightweight performance of models on different datasets

数据集	学生模型	准确率	精确率	召回率	F₁值
CICIIDS2017^[24]	LR	0.8607	0.7411	0.8527	0.7930
CICIIDS2017^[24]	MLP^[23]	0.9559	0.9019	0.9640	0.9319
TSMset^[25]	LR	0.7529	0.2400	0.5066	0.3257
TSMset^[25]	MLP^[23]	0.9742	0.8423	0.9612	0.8978
WOMset^[25]	LR	0.7823	0.3308	0.4895	0.3948
WOMset^[25]	MLP^[23]	0.9256	0.7038	0.8408	0.7662

下载: 导出CSV

表 15 不同数据集上模型大小和推理时长比较

Table 15. Comparison of model size and inference duration on different datasets

数据集	原模型大小/MB	MLP模型大小/MB	原模型推理时长/（ms·样本⁻¹）	MLP推理时长/（ms·样本⁻¹）
CICIDS2017^[24]	0.50	0.08	7.20	0.16
TSMset^[25]	1.12	0.07	7.69	0.16
WOMset^[25]	1.30	0.08	7.24	0.16

下载: 导出CSV

参考文献(26)

[1]	Zhu L, Chen C, Wang H W, et al. Machine learning in urban rail transit systems: a survey[J]. IEEE Transactions on Intelligent Transportation Systems, 2024, 25(3): 2182-2207.
[2]	陈雪倩, 步兵. 基于网络流量和数据包的CBTC入侵检测系统[J]. 中国安全科学学报, 2019, 29(S2): 154-160. Chen X Q, Bu B. An intrusion detection system for CBTC based on network traffic and packets[J]. China Safety Science Journal, 2019, 29(S2): 154-160(in Chinese).
[3]	蹇诗婕, 卢志刚, 杜丹, 等. 网络入侵检测技术综述[J]. 信息安全学报, 2020, 5(4): 96-122. Jian S J, Lu Z G, Du D, et al. Overview of network intrusion detection technology[J]. Journal of Cyber Security, 2020, 5(4): 96-122 (in Chinese).
[4]	Abdulganiyu O H, Ait Tchakoucht T, Saheed Y K. A systematic literature review for network intrusion detection system (IDS)[J]. International Journal of Information Security, 2023, 22(5): 1125-1162.
[5]	Ozkan-okay M, Samet R, Aslan Ö, et al. A comprehensive systematic literature review on intrusion detection systems[J]. IEEE Access, 2021, 9: 157727-157760.
[6]	Song Y J, Bu B, Zhu L. A novel intrusion detection model using a fusion of network and device states for communication-based train control systems[J]. Electronics, 2020, 9(1): 181.
[7]	Gao B, Bu B, Zhang W, et al. An intrusion detection method based on machine learning and state observer for train-ground communication systems[J]. IEEE Transactions on Intelligent Transportation Systems, 2022, 23(7): 6608-6620.
[8]	Li Y, Zhu L, Wang H W, et al. A cross-layer defense scheme for edge intelligence-enabled CBTC systems against MitM attacks[J]. IEEE Transactions on Intelligent Transportation Systems, 2021, 22(4): 2286-2298.
[9]	Lu H, Zhao Y N, Song Y J, et al. A transfer learning-based intrusion detection system for zero-day attack in communication-based train control system[J]. Cluster Computing, 2024, 27(6): 8477-8492.
[10]	Gong T Y, Zhu L, Yu F R, et al. Edge intelligence in intelligent transportation systems: a survey[J]. IEEE Transactions on Intelligent Transportation Systems, 2023, 24(9): 8919-8944.
[11]	Chawla N V, Bowyer K W, Hall L O, et al. SMOTE: synthetic minority over-sampling technique[J]. Journal of Artificial Intelligence Research, 2002, 16(1): 321-357.
[12]	Muntasir Nishat M, Faisal F, Jahan Ratul I, et al. A comprehensive investigation of the performances of different machine learning classifiers with SMOTE-ENN oversampling technique and hyperparameter optimization for imbalanced heart failure dataset[J]. Scientific Programming, 2022, 2022(1): 3649406.
[13]	Li W, Yan Z W, He R W, et al. A novel machine learning based intrusion detection method for 5G empowered CBTC systems[C]//Proceedings of the International Wireless Communications and Mobile Computing. Piscataway: IEEE Press, 2022: 211-216.
[14]	Sumaiya Thaseen I, Saira Banu J, Lavanya K, et al. An integrated intrusion detection system using correlation-based attribute selection and artificial neural network[J]. Transactions on Emerging Telecommunications Technologies, 2021, 32(2): e4014.
[15]	Han Y, Joe I. Enhancing machine learning models through PCA, SMOTE-ENN, and stochastic weighted averaging[J]. Applied Sciences, 2024, 14(21): 9772.
[16]	Wang G H, Yan Q F. A method for improving the robustness of intrusion detection systems based on auxiliary adversarial training Wasserstein generative adversarial networks[J]. Electronics, 2025, 14(11): 2171.
[17]	Yan T, Shen S L, Zhou A N, et al. Prediction of geological characteristics from shield operational parameters by integrating grid search and K-fold cross validation into stacking classification algorithm[J]. Journal of Rock Mechanics and Geotechnical Engineering, 2022, 14(4): 1292-1303.
[18]	Ahakonye L A C, Nwakanma C I, Lee J M, et al. Efficient classification of enciphered SCADA network traffic in smart factory using decision tree algorithm[J]. IEEE Access, 2021, 9: 154892-154901.
[19]	Yang K X, Liu L, Wen Y L. The impact of Bayesian optimization on feature selection[J]. Scientific Reports, 2024, 14: 3948.
[20]	Hooshmand M K, Huchaiah M D, Alzighaibi A R, et al. Robust network anomaly detection using ensemble learning approach and explainable artificial intelligence (XAI)[J]. Alexandria Engineering Journal, 2024, 94: 120-130.
[21]	Chen G Z, Fan Z Y, Zhu Y X, et al. Multi-time knowledge distillation[J]. Neurocomputing, 2025, 623: 129377.
[22]	Zhang W W, Guo Y F, Wang J H, et al. Collaborative knowledge distillation[J]. IEEE Transactions on Circuits and Systems for Video Technology, 2024, 34(8): 7601-7613.
[23]	Jassam Mohammed A, Hameed Arif M, Adil Ali A. A multilayer perceptron artificial neural network approach for improving the accuracy of intrusion detection systems[J]. IAES International Journal of Artificial Intelligence (IJ-AI), 2020, 9(4): 609.
[24]	Panigrahi R, Borah S. A detailed analysis of CICIDS2017 dataset for designing intrusion detection systems[J]. International Journal of Engineering & Technology, 2018, 7(3.24): 479-482.
[25]	Fakhereldine A, Zulkernine M, Murdock D. CBTCset: a reference dataset for detecting misbehavior attacks in CBTC networks[C]//Proceedings of the IEEE 34th International Symposium on Software Reliability Engineering Workshops. Piscataway: IEEE Press, 2023: 57-62.
[26]	Sun C Y, Zhang W J, Sun P, et al. A hybrid security framework for train-to-ground (T2G) communication using DOA-optimized BPNN detection, Bayesian risk scoring, and RL-based response[J]. Sensors, 2025, 25(10): 3208.