Abstract: In response to the severe network security situation, CHINA RAILWAY has participated in the network security attack and defense actual combat drill activities led by relevant national departments for five consecutive years, and has made outstanding achievements. In order to better summarize and enrich the practical experience of railway network security attack and defense drill, this paper introduced the definition of attack and defense drill, summarized common network attack and defense methods as well as the experience of railway attack and defense drills in combination with the situation that the railway had participated in the attack and defense drill in recent years, so as to improve the ability of railway network security protection, monitoring and emergency response.