Automated defense strategies improve industrial control system security
Learning Intrusion Response Strategies for OT Systems
Cryptography and SecurityArtificial Intelligence
Summary
Industrial control systems that operate critical infrastructure like power plants and factories are at risk from cyberattacks. The authors developed a way to automatically decide how to respond to intrusions, even though they only partially observe the network traffic. They used a type of machine learning called PPO to learn effective defense strategies. When tested on a simulated industrial system, these strategies successfully defended against various cyberattacks. This approach helps protect essential services by automating complex security decisions.
What this means in practice
- •For industrial cybersecurity teams: Deploy automated intrusion responses that learn from network traffic to better protect industrial control systems.
- •For network security engineers: Integrate learning-based response policies into security operations for critical infrastructure simulations to improve defense effectiveness.
Authors
Duc Huy Le, Rolf Stadler
Abstract
Cyberattacks against Operational Technology (OT) systems, which monitor and control industrial processes, pose an increasing threat to essential societal services. For this reason, developing automated intrusion response strategies is highly important. In this paper, we present a formal model of an OT intrusion response use case using the POMDP framework. It includes a realistic model of partial observability that is based on traffic measurements. This approach allows us to develop tractable, learning-based solution methods for automated intrusion response, which are based on PPO. We evaluate the obtained response strategies on an emulated OT system and find that they are effective against several types of MITRE attacks for the studied use case.