Cyber Security of Railway Automation and Telemechanics Systems. Artificial Intelligence for Detecting and Responding to Threats

The article is devoted to the study of critical cyber threats arising from the rapid digitization of railway automation and telemechanics systems, in particular microprocessor centralization and dispatching centralization. The authors justify the need to use advanced technologies, such as artificial intelligence (AI), to ensure the stability and security of critical railway infrastructure.The article analyzes critical vulnerabilities of RAAS and provides a detailed analysis of cyberattack vectors on key systems. The vulnerability of systems to attacks typical for COTS components and standard protocols (TCP/IP) is investigated, as well as the threat of introducing malicious software into the firmware to disrupt traffic safety logic, which can cause train collisions. It has been proven that AI provides the necessary level of monitoring and response that goes beyond traditional signature-based protection. Machine and deep learning mechanisms are considered, and the critical role of AI integration with SOAR (Security Orchestration, Automation, and Response) platforms is emphasized. It is concluded that artificial intelligence and automated SOAR response systems are key to transforming protection from reactive to proactive and preventive. It is proposed that the further development of cyber protection for railway transport systems should provide for the integration of SOAR with the concept of a digital twin of the railway network in order to achieve complete autonomous cybersecurity.