Abstract: A cyber security system for providing security to a railway, the system comprising: a data monitoring and processing hub; a network comprising a plurality of data collection agents synchronized to a same network clock and configured to monitor railway infrastructure devices and onboard devices of rolling stock having a train communication network (TCN), and forward monitored data to the hub for processing by the hub to detect anomalies in railway operation that are indicative of a cyber-attack; at least one anonymizer configured to scrub information items from data that the hub receives from a data collection agent of the plurality of data collection agents which may be used to identify the cyber security system or the railway for which the system provides security.

Abstract: A cyber security system for providing security to a railway system, the system comprising: a data monitoring and processing hub; a network of data collection agents configured to monitor communications transmitted between railway infrastructure and/or rolling stock entities and mirror the communications to the hub; wherein the processing hub comprises computer executable instructions executable to: process the mirrored communications to determine normative patterns of communications between the entities; use the normative patterns to determine sequences of related communications; determine characteristic features of the determined communications sequences; and use the determined characteristic features to determine whether a given communication mirrored to the hub by a data collection agent of the network of data collection agents is anomalous.

Abstract: A system for providing security to a railway system, the system comprising: a data monitoring and processing hub; a network comprising a plurality of data collection agents synchronized to a same network clock and configured to monitor railway infrastructure devices and onboard devices of rolling stock having a train communication network (TCN), train to wayside communications (such as GSM-R) and forward monitored data to the hub for processing by the hub to detect anomalies in railway operation that are indicative of a cyber-attack; wherein an agent of the plurality of data collection agents monitoring an onboard device connected to the TCN of a given rolling stock receives signals propagated to or from the device via the TCN and forwards to the hub data based on a given received signal together with a time stamp comprising a network clock time at which the given received signal is received by the agent.