Abstract: With the continuous promotion of intelligent railway construction in China, the network architecture of railway information systems is becoming increasingly complex. Artificial intelligence, Internet of Things, cloud computing, 5G mobile communication and other technologies have been applied to various business fields of railways, and the security situation faced by railway enterprises is becoming increasingly severe. This paper analyzed the current situation and requirements of railway cyberspace security defense, proposed a new era railway cyberspace security defense technology framework, and put forward network security technology requirements based on a three-layer protection mechanism of "foundation + enhanced + collaboration", which provided reference for railway enterprise network security technology defense work.