Alert-Driven Active Defense for IoT-Enabled CBTC Systems Using Bayesian Hypergame Modeling and Hierarchical Reinforcement Learning

Advanced Persistent Threats (APTs) pose a serious threat to Internet of Things (IoT) systems because of their stealthiness, persistence, and ability to adapt to defensive responses. Communication-Based Train Control (CBTC) systems, as IoT-enabled railway signaling infrastructures, have evolved from relatively closed operational environments into interconnected cyber-physical networks, exposing train control systems to coupled cyber intrusion and operational-safety risks. To address this challenge, this paper proposes an alert-driven active defense framework for CBTC systems that integrates Bayesian belief updating, hypergame-based cognitive-bias modeling, and Hierarchical Reinforcement Learning (HRL). The framework converts intrusion detection system (IDS) alerts, network traffic observations, and cyber-physical observations into belief-state, transition, and reward inputs. The Bayesian model estimates attacker type and attack stage, the hypergame model represents deception-induced asymmetric cognition between attackers and defenders, and the HRL decouples strategic defense posture selection from tactical defense execution. The scenario-driven simulations in a CBTC APT defense setting show that the proposed model strategy achieves an 87.1% defense success rate against APT attacks while consuming 62.7% of the normalized defense resources, outperforming DQN, PG, and PPO under the same test conditions. These results suggest that explicitly coupling cyber observations, CBTC operational constraints, and hierarchical deception-aware policies can improve cost-aware active defense for railway signaling infrastructures.