A Hybrid Machine Learning Framework for Cyber Attack Detection and Attribution in IoT-Enabled Cyber-Physical Systems

Securing Internet-of-Things (IoT)-enabled Cyber-Physical Systems (CPS) is a challenging task due to increased connectivity and system complexity. Traditional security solutions designed for IT/OT environments are insufficient for CPS. This paper proposes a two-stage ensemble deep learning framework for cyber-attack detection and attribution in Industrial Control Systems (ICS). In the first stage, an ensemble representation learning model combined with a Decision Tree classifier detects cyber-attacks in imbalanced datasets. In the second stage, a Deep Neural Network (DNN) performs attack attribution using one-vs-all classifiers. The model is evaluated using the SWAT dataset and demonstrates improved accuracy, recall, and F-measure compared to existing techniques.