Dual-channel AI reads encrypted rail traffic to keep safety-critical services in view

Urban rail networks now carry a crowded mix of digital conversations at once: train control signals, emergency radio dispatches, passenger information feeds, surveillance video, and maintenance data from connected sensors. Sorting those flows correctly is not an academic exercise. If a safety-critical stream is misclassified, the network may fail to reserve the bandwidth or latency guarantees that service depends on, so researchers have been searching for ways to classify traffic that survives encryption, proprietary protocols, and the messy realities of an operating railway.

A study published in Applied Intelligence by Xinpeng Liu, Junhui Zhao, Zhengyuan Wu, and Huaicheng Li proposes one answer: a priority-aware, dual-channel feature fusion framework designed specifically for urban rail service traffic. The method converts each traffic flow into two kinds of images—one from the raw bytes themselves, another from statistical summaries of the flow—and processes both through parallel neural branches before fusing them with a channel attention module. A custom Priority-Sensitive Loss steers training so that the model pays disproportionate attention to the services whose failure would matter most.

Evaluated on a real-world urban rail dataset with a strict temporal split and five independent random seeds, the system reached 98.74 percent accuracy and 99.24 percent weighted recall. On the two safety-critical services—Communication-Based Train Control (CBTC) and Emergency Radio Dispatch (ERD)—recall hit 99.94 percent and 99.41 percent respectively. The model is also small: roughly 0.18 million parameters and 23.8 million FLOPs, with an end-to-end latency of 0.4 to 0.7 milliseconds, figures the authors argue make it feasible for edge hardware on trains or trackside equipment.

The motivation comes from a structural shift in railway communications. Modern networks must simultaneously support train operation control, dispatching and command, passenger information, high-definition video surveillance, and intelligent operation-and-maintenance IoT traffic. Each service has different demands for delay, bandwidth, and reliability, and the traffic volumes keep growing as 5G and IoT technologies penetrate deeper into rail operations. Legacy classification approaches struggle in this environment: port-based matching breaks down when dynamic ports and proprietary protocols are common, and Deep Packet Inspection (DPI) falters when payloads are encrypted or when expert-crafted rules cannot keep pace with evolving service patterns and fault-induced abnormal traffic.

The researchers’ design reflects a diagnosis of where single-modality models fall short. Raw byte sequences preserve fine-grained structural textures—transport-layer headers, port numbers, flag fields—that are useful for services with fixed packet structures. Statistical features such as packet length distributions, inter-arrival times, and burstiness capture the macroscopic rhythm of a flow, which matters for periodic control signaling or event-driven dispatch traffic. The team mapped both representations into 28-by-28 grayscale images. The raw channel feeds a modified ResNet initialized with weights pre-trained on the public ISCX VPN-nonVPN dataset, while the statistical channel runs through a lightweight convolutional network trained from scratch. After each branch produces a 64-channel feature map, the two are concatenated and recalibrated by a channel attention module that amplifies the most discriminative signals on a per-sample basis.

The transfer learning choice is deliberately asymmetric. The authors froze the shallow layers of the raw-channel ResNet to retain generic byte-texture representations while leaving deeper layers trainable for the rail domain, reasoning that transport-layer structural patterns are largely domain-invariant. The statistical branch, by contrast, was trained from scratch because its features encode application-layer behaviors—inter-arrival distributions, burstiness profiles—that differ fundamentally between the ISCX source domain and urban rail traffic. Had the statistical branch inherited priors from general internet flows, the authors argue, it might have learned patterns that simply do not exist in rail traffic, potentially degrading rather than improving identification of safety-critical services.

The Priority-Sensitive Loss addresses a different problem: standard cross-entropy training lets the most populous class dominate gradients, leaving minority safety-critical services under-penalized when misclassified. The proposed loss multiplies two independent weights per class. One encodes business priority, inversely proportional to each service’s QoS priority value, so that higher-priority services receive larger gradient penalties. The other is a smoothed inverse-frequency term that compensates for sample imbalance without triggering gradient explosion on extremely rare classes. In the five-class urban rail dataset—CBTC, ERD, Automatic Train Supervision (ATS), Passenger Information Service (PIS), and Closed-Circuit Television (CCTV)—the combined weights ranged from 0.230 to 1.538, with the maximum falling on ERD, the highest-priority and least-sampled service. The max-to-min weight ratio of 6.7-fold is deliberately gentler than the raw 11-fold sample imbalance.

The evaluation protocol is stricter than a random split. Within each service class, flows were sorted chronologically by capture timestamp and divided 6:2:2 into training, validation, and test sets, forcing the model to generalize from earlier traffic to later, unseen patterns and reducing the risk of temporal leakage. The authors note this replaced an earlier random flow-level split that could have produced overly optimistic estimates. All comparative and ablation experiments follow this unified temporal protocol, and every deep-learning result is reported as the mean and standard deviation across five seeds controlling weight initialization, shuffling order, and dropout masks.

Benchmark comparisons against traditional and deep learning baselines highlight why the dual-channel design matters. Port-rule matching achieved only 83.36 percent accuracy and DPI 91.06 percent, with DPI identifying just 89.12 percent of ERD flows and port rules dropping to 73.24 percent—far below what safety-critical detection requires. Among deep learning models, raw-byte methods such as MTT excelled on fixed-structure services, reaching 98.92 percent recall on CBTC, but degraded on variable-content services like CCTV, where 1D-CNN managed only 83.37 percent. Flow-feature methods such as CNN-LSTM and GNN captured statistical regularities but trailed on CBTC recall, landing between 97.39 and 97.45 percent. The proposed method, by contrast, maintained precision above 95.9 percent across all five categories while posting the smallest accuracy standard deviation of any trained model, at ±0.05 percent.

Ablation studies confirm that no single component carries the result alone. With the loss fixed, the dual-channel architecture improved accuracy by 4.23 percentage points over the best single-channel variant, from 94.51 to 98.74 percent. With the architecture fixed, replacing cross-entropy with the full PSL lifted accuracy by 5.13 percentage points, from 93.61 to 98.74 percent. Under matched cross-entropy training, the dual-channel architecture alone reached 93.61 percent—slightly below the strongest baseline, MTT at 95.16 percent—so neither component alone surpasses the best existing method; the gain comes from their combination. The authors also acknowledge limits: the ERD test set contains only 68 flows, so its recall is quantized in steps of roughly 1.47 percent, and by the rule of three the 95 percent confidence upper bound on missed detection is about 4 percent for ERD and 1 percent for CBTC. The dataset came from a single operational line over a limited period and remains proprietary, so generalization to other lines, vendors, or environments still requires validation. Even so, the combination of near-perfect recall on critical services, a 0.18-million-parameter footprint, and sub-millisecond latency positions the method as a practical candidate for priority-aware resource scheduling at the urban rail network edge.

Subject of Research: A priority-aware dual-channel deep learning framework for classifying encrypted urban rail service traffic on edge hardware

Article Title: A priority-aware dual-channel feature fusion method for urban rail service traffic classification

Article References: Liu, X., Zhao, J., Wu, Z., & Li, H. (2026). A priority-aware dual-channel feature fusion method for urban rail service traffic classification. Applied Intelligence, 56(16), Article 517. https://doi.org/10.1007/s10489-026-07560-z

Image Credits: AI Generated

DOI: 10.1007/s10489-026-07560-z

Keywords: urban rail transit, network traffic classification, encrypted traffic, dual-channel fusion, channel attention, Priority-Sensitive Loss, transfer learning, CBTC, emergency radio dispatch, edge deployment, temporal split, ResNet