The railway monitoring system is vulnerable to cyberattacks. Attackers manipulate the data collected from railway turnouts : either to conceal failures of to trigger unnecessary maintenance actions. To address this issue, a cyberattack investigation method is proposed based on predictions made from the temporal evolution of the turnout behavior. This method is illustrated on a collection of reallife data.