Delta
Intrusion detection processed at the edge, designed for rail on-board and wayside applications.
What it does
Delta shows you your network topology and what runs on it, then alerts when behaviour deviates from the baseline. It combines host and network monitoring in one system. Delta runs on more than 3,200 rail vehicles worldwide. A vehicle is an individual rail car; our wider deployment spans more than 1,000 trains across 23+ distinct fleets.
Because Delta detects anomalies against a learned baseline rather than relying on signatures alone, it can flag attacks that signature databases have never seen, including behaviour specific to rail protocols.
Key benefits
Detection designed for rail
Host and network monitoring combines rail-protocol awareness with behavioural baselines across modern on-board and wayside systems, typically with Ethernet networks.
Proven rail integration
Delta runs on 3,200+ rail vehicles, including software deployments on Westermo switches and existing on-board equipment. Behavioural changes can be detected within minutes; events reach shore when connected.
Evidence for customer acceptance
The Siemens Mobility customer statement below describes Delta’s contribution to train monitoring. Validate each integration against the operator’s acceptance requirements.
Reduce IDS implementation costs
Software deployment on compatible existing hardware can reduce additional equipment and integration costs.
Broad coverage with efficient edge processing
Combine host and network monitoring across on-board and wayside systems. TRDP runs over IP; MVB and CAN coverage requires hardware connected to those buses. Detection stays on the vehicle and events are forwarded to shore.
Key capabilities
Host and network detection
Monitor software, ports, logs and critical files alongside network behaviour. TRDP is analysed over IP; MVB and CAN coverage requires hardware connected to those buses.
SIEM integration
CEF feeds and REST APIs plug into your existing security operations.
Resilient to intermittent links
Continuous on-vehicle monitoring that tolerates rail's unreliable, intermittent links.
Low false-positive rate
Machine-learning models tuned on real rolling-stock traffic.
On-board and wayside
One product covers vehicles and trackside infrastructure.
Efficient edge processing
Process detection data on the vehicle and queue events for shore when a connection returns. Delta can support the full 30-year-plus life of the train. Reuse validated baselines across comparable vehicles to reduce rollout work.
Detect everywhere, passively
Delta is the detection layer of The Secure Train: it monitors hosts, network segments and deeper onboard feeds without sitting in the path of train control traffic.
See the full architecturePlan your integration
A Delta technical pack covering protocol support, the host support matrix and deployment reference architectures is available on request.
Request a technical workshop“Real-time monitoring and the earliest possible detection of irregularities in the IT and software structure of our trains are the only way to ensure 100 percent fleet availability while maintaining the highest level of cybersecurity. RazorSecure can help us achieve this goal with their expertise and proven solutions.”
