Papers for

industrial network security teams

Papers whose findings have a practical use for this group, as judged from the abstract. Open a paper to read what it means in practice.

AIRO improves industrial IoT security with fast streaming machine learning

AIRO: A Streaming-Based Machine Learning Framework for Threat Detection and Security in Industrial Internet of Things

Abstract: Modern Industrial Internet of Things (IIoT) im- plementations now connect edge gateways, cloud dashboards and business applications. This improves visibility and remote monitoring. However it simultaneously exposes industrial traffic to various cyber threats including scanning, web attacks and Structured Query Language (SQL) injection (SQLi), phishing- driven credential theft, and command-and-control (C2) activity. Although rule-based tools remain useful for detecting known signatures, their efficacy decreases with minimally altered attacks or when alerts require manual investigation. This paper presents AIRO (Autonomous Intelligence-Driven Cybersecurity Risk Re- duction System), an efficient framework for IIoT monitoring and response. AIRO combines Apache Kafka streaming, attack- specific feature extraction, machine learning (ML) inference, confidence-based decision logic and risk reduction measures such as Internet Protocol (IP) blocking, account suspension and traffic limiting. We developed four specialized datasets for C2 beaconing, reconnaissance, SQLi, and phishing to evaluate AIRO. These datasets include noisy and overlapping characteristic distribu- tions to minimize label leakage. The best-performing models, primarily Gradient Boosting and LightGBM, achieve F1-scores up to 0.9229 while ensuring low-latency from event input to mitigation

Thu 22 OctCryptography and SecurityMachine LearningNetworking and Internet Architecture
The gist
Industrial Internet of Things (IIoT) systems help monitor factories and plants remotely but can be vulnerable to cyberattacks like hacking and phishing. The authors developed AIRO, a new system that watches network traffic in real time using machine learning to spot dangerous activity automatically. It can then quickly take protective actions such as blocking suspicious IP addresses or limiting traffic. Their tests showed AIRO can detect threats accurately and respond fast, even with noisy data.
Open → 2610.30713v1

OT system attack framework enables reproducible multi-source data collection

ISIA-AF: Orchestrating Reproducible Attacks and Multi-Source Data Collection for OT Systems

Abstract: Operational Technology (OT) environments require realistic, reproducible security datasets, yet existing approaches often lack automation, multi-source data capture, and sufficient documentation for reuse. This paper presents ISIA-AF, a modular attack framework for orchestrating reproducible attack execution and automated dataset generation on industrial systems. The framework coordinates distributed attack clients, records network traffic and operational data, ultimately leading to a multi-source dataset. We derive functional and non-functional requirements from prior work and stakeholder discussions, and realise the framework following a design science research approach. A case study on the ISIA testbed, comprising a real industrial system and a simulated process, demonstrates how the framework supports centralised control, low communication overhead, and flexible deployment across network segments. The result is a practical basis for generating extensible, multi-source OT security datasets for intrusion detection research.

Wed 16 SeptCryptography and Security
The gist
It is hard to create repeatable and well-documented data about cyberattacks on industrial control systems, which are important for research and defense. The authors developed ISIA-AF, a tool that automates attacking industrial setups while collecting data from several sources. This helps create consistent datasets needed to test and improve security methods. They tested the tool on a combined real and simulated industrial system to show it works efficiently and flexibly.
Open → 2609.18196v1

Selecting suitable industrial security systems based on current threats

Poster: Towards Selecting Threat Appropriate Industrial Intrusion Detection Systems

Abstract: As the threat landscape against industrial control systems is dynamic, effective security requires detection strategies capable of timely reactions to these evolving threat situations. To address this problem, we propose the idea of a counter-threat intelligence sharing based mechanism to select appropriate detectors for current circumstances. To highlight the potential of this mechanism, we conduct attack-level performance evaluations of various intrusion detection systems. Results show the variance of intrusion detection performance depending on the attack scenario, emphasizing the benefits of such a mechanism for industrial control system security

Fri 11 SeptCryptography and Security
The gist
Industrial control systems face many changing cyber threats that need quick and effective responses to keep operations safe. The authors propose a way to share threat information so that the best intrusion detector can be chosen for the specific situation. They tested different detectors on various attacks and found their effectiveness varies a lot depending on the attack type. This shows it could be helpful to pick detectors based on the current threat to improve industrial security.
Open → 2609.12646v1