Capacity Aware Cyber Threat Detection and Safe Response for Critical Infrastructure
Article Sidebar
Main Article Content
Abstract
A cyber detector can classify industrial traffic accurately and still overwhelm the team responsible for investigating its alerts. An equally important failure occurs when a plausible detection triggers a response that interrupts a physical process. We develop an operational technology architecture that separates detection, incident review, and authorization to intervene. Sites score events locally, collaborate on model updates when privacy and availability requirements permit, and consult a read-only digital twin before proposing a control-sensitive response. An analytical stress test quantifies the interaction between incident prevalence, detector sensitivity, false-positive rate, and review capacity. At an assumed prevalence of 0.1%, sensitivity of 90%, and false-positive rate of 0.1%, a stream of 100,000 review units yields 190 expected alerts, including 90 true positives. A review budget of 100 units requires a false-positive rate near 0.010% to retain that sensitivity and accommodate all expected alerts. A second analysis shows that the usefulness of twin corroboration depends on its behavior specifically among detector-positive cases. The results are conditional planning estimates. A chronological, cross-site evaluation protocol specifies how to test whether the proposed operating points are attainable under incident clustering, telemetry loss, and changing plant conditions.
Article Details
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
References
[1] K. A. Stouffer et al., “Guide to Operational Technology (OT) Security,” 2023, Special Publication (NIST SP), National Institute of Standards and Technology, Gaithersburg, MD. doi: https://doi.org/10.6028/NIST.SP.800-82r3.
[2] N. Das et al., “AI-driven threat detection and response framework for protecting U.S. critical infrastructure from cyberattacks,” Int. Cybersecurity Law Rev., vol. 7, no. 2, pp. 147–163, 2026, doi: https://doi.org/10.1365/s43439-026-00169-5.
[3] R. Sommer and V. Paxson, “Outside the Closed World: On Using Machine Learning for Network Intrusion Detection,” in 2010 IEEE Symposium on Security and Privacy, 2010, pp. 305–316. doi: https://doi.org/10.1109/SP.2010.25.
[4] M. Shahiduzzaman et al., “Attention-guided quantum-inspired extreme learning machine with grey wolf optimization for rare-attack detection in IIoT networks,” Discov. Artif. Intell., vol. 6, no. 1, p. 1258, 2026, doi: https://doi.org/10.1007/s44163-026-01704-3.
[5] J. Kaur et al., “Comparative analysis of transformer and LSTM architectures for cybersecurity threat detection using machine learning,” EAI Endorsed Trans. AI Robot., vol. 4, pp. 1–12, 2025, doi: https://doi.org/10.4108/airo.9759.
[6] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial intelligence and statistics, Pmlr, 2017, pp. 1273–1282. [Online]. Available: https://proceedings.mlr.press/v54/mcmahan17a.html
[7] M. Bashir, K. Syed, S. A. Aetukuri, M. Shukla, V. P. K. Kaluvakuri, and K. S. Mudaliyar, “Real-Time Cloud-Native Processing Techniques for Enhancing Federated Learning in Distributed Applications,” in 2026 International Conference on Emerging in Computing Technologies (INCECT), 2026, pp. 1–7. doi: https://doi.org/10.1109/INCECT72370.2026.11742885.
[8] K. Bonawitz et al., “Practical secure aggregation for privacy-preserving machine learning,” in proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, 2017, pp. 1175–1191. doi: https://doi.org/10.1145/3133956.3133982.
[9] S. Axelsson, “The base-rate fallacy and the difficulty of intrusion detection,” ACM Trans. Inf. Syst. Secur., vol. 3, no. 3, pp. 186–205, 2000, doi: https://doi.org/10.1145/357830.357849.
[10] F. Karim et al., “Calibrated, cost-sensitive, explainable ensemble learning for customer churn prediction in retail banking: a leakage-safe pipeline and single-dataset case study,” Front. Artif. Intell., vol. 9, p. 1889639, 2026, doi: https://doi.org/10.3389/frai.2026.1889639.
[11] R. M. Ahsan, B. Uddin, T. Hossen, and S. Das, “Resilient Intelligence: AI and MIS in the Cyber-Economic Era,” Eastasouth J. Inf. Syst. Comput. Sci., vol. 3, no. 02, pp. 151–163, Oct. 2025, doi: https://doi.org/10.58812/esiscs.v3i02.758.
[12] M. A. Goffer et al., “Cybersecurity and supply chain integrity: Evaluating the economic consequences of vulnerabilities in US infrastructure,” J. Manag. World, vol. 2025, no. 2, pp. 233–243, 2025, doi: https://doi.org/10.53935/jomw.v2024i4.907.
[13] M. A. Goffer et al., “AI-Enhanced Cyber Threat Detection and Response Advancing National Security in Critical Infrastructure,” J. Posthumanism, vol. 5, no. 3, pp. 1667–1689, Apr. 2025, doi: https://doi.org/10.63332/joph.v5i3.965.
[14] S. N. Hasan, “Embedding cybersecurity risk management into information systems governance: A national-scale framework for organizational resilience, economic stability, and critical infrastructure protection,” Int. J. Appl. Math., vol. 39, no. 1s, pp. 237–254, 2026, doi: https://doi.org/10.12732/ijam.v39i1s.1623.
[15] S. N. Hasan et al., “Enhancing cybersecurity threat detection and response through big data analytics in management information systems,” Fuel Cells Bull, vol. 2023, no. 12, 2023, doi: https://doi.org/10.52710/fcb.137.
[16] S. N. Hasan et al., “The influence of artificial intelligence on data system security,” Int. J. Comput. Exp. Sci. Eng., vol. 11, no. 3, 2025, doi: https://doi.org/10.22399/ijcesen.3476.
[17] M. D. Hossain, M. S. Sikder, M. S. Uddin, R. M. Ahsan, B. Uddin, and T. Hossen, “Cognitive Cyber Defense: AI–MIS Integration through Big Data and Cloud Frameworks for Next-Generation Digital Resilience,” Eastasouth J. Inf. Syst. Comput. Sci., vol. 1, no. 02, pp. 140–152, Dec. 2023, doi: https://doi.org/10.58812/esiscs.v1i02.764.
[18] J. Kaur et al., “Advanced cyber threats and cybersecurity innovation—Strategic approaches and emerging solutions,” J. Comput. Sci. Technol. Stud., vol. 5, no. 3, pp. 112–121, 2024, doi: https://doi.org/10.32996/jcsts.2023.5.3.9.
[19] F. Mahmud et al., “AI-driven cybersecurity in IT project management: Enhancing threat detection and risk mitigation,” J. Posthumanism, vol. 5, no. 4, pp. 23–44, 2025, doi: https://doi.org/10.63332/joph.v5i4.974.
[20] S. M. Orthi et al., “AI-Driven Cyber Threat Intelligence as a Management Information System: Integrating Cybersecurity Governance and IT Project Management for Organizational Resilience,” Eastasouth J. Inf. Syst. Comput. Sci., vol. 1, no. 02, pp. 194–213, Dec. 2023, doi: https://doi.org/10.58812/esiscs.v1i02.873.
[21] A. Shan-A-Alahi, M. Mustafizur, K. M. R. Hossan, A. Al Zaiem, and M. M. Rahman, “Cybersecurity training and its influence on employee behavior in business environments,” Comput. Fraud Secur., vol. 2024, no. 12, pp. 506–515, 2024, doi: https://doi.org/10.52710/cfs.689.
[22] M. A. Siam et al., “AI-Driven Cyber Threat Intelligence Systems: A National Framework for Proactive Defense Against Evolving Digital Warfare,” Int. J. Comput. Exp. Sci. Eng, vol. 11, no. 3, 2025, doi: https://doi.org/10.22399/ijcesen.3793.
[23] M. S. Uddin, M. S. Sikder, M. M. Anwar, and F. Hossain, “AI-driven cybersecurity and big data-enabled MIS frameworks: Strengthening supply chain integrity, energy resilience, and critical infrastructure protection,” J. Comput. Sci. Technol. Stud., vol. 7, no. 9, pp. 223–232, 2025, doi: https://doi.org/10.32996/jcsts.2025.7.9.26.
[24] P. Chakraborty, “Cyber Threat Prediction Using Temporal Data Analysis Model,” in 2026 6th International Conference on Intelligent Technologies (CONIT), 2026, pp. 1–10. doi: https://doi.org/10.1109/CONIT69683.2026.11620680.
[25] N. Das et al., “AI-enhanced Cyber Threat Detection: Transforming Security Frameworks in Management Information Systems,” in 2025 5th International Conference on Electrical, Computer and Energy Technologies (ICECET), 2025, pp. 1–6. doi: https://doi.org/10.1109/ICECET63943.2025.11472511.
[26] S. N. Hasan et al., “Self-healing cybersecurity systems using RL agents,” in 2025 1st International Conference on Advancement in Futuristic Technologies (ICAFT), IEEE, 2025, pp. 1–8. doi: https://doi.org/10.1109/ICAFT66710.2025.11452866.
[27] H. Kaur, H. U. Himel, M. H. Rijvi, M. S. Sikder, M. Y. Biplob, and H. Imam, “Automated Vulnerability Assessment Using Machine Intelligence,” in 2026 6th International Conference on Intelligent Technologies (CONIT), 2026, pp. 1–7. doi: https://doi.org/10.1109/CONIT69683.2026.11620731.
[28] N. Nabi et al., “Continual Learning Pipelines for Detecting Insider Threats Across Corporate Cybersecurity Infrastructures,” in 2025 International Conference on Electrical Engineering and Informatics (ICEEI), 2025, pp. 1–8. doi: https://doi.org/10.1109/ICEEI68459.2025.11330487.
[29] M. Nazmussakib, M. S. Sikder, M. A. K. P. Hemal, A. Al Zaiem, H. U. Himel, and N. Das, “Adversarial Machine Learning for Robust Cyber Defense Systems,” in 2026 International Conference on Computing Theory and Wireless Communications (ICCTWC), 2026, pp. 1–9. doi: https://doi.org/10.1109/ICCTWC68241.2026.11583629.
[30] M. Raihan et al., “Adversarial robustness mechanism for safeguarding biometric verification across mobile financial applications,” in 2025 International Conference on Electrical Engineering and Informatics (ICEEI), IEEE, 2025, pp. 1–7. doi: https://doi.org/10.1109/ICEEI68459.2025.11330502.
[31] U. S. Saha, H. Imam, M. Mustafizur, A. Roy, A. Al Zaiem, and M. M. T. G. Manik, “Deep learning based malware image classification using binary image representation for secure management information systems,” in 2026 Technology and Innovation Conference (TIC), IEEE, 2026, pp. 1–6. doi: https://doi.org/10.1109/TIC68483.2026.11702958.
[32] M. A. Siam et al., “Cybersecure intelligent sensor framework for smart buildings: AI-based intrusion detection and resilience against IoT attacks,” Sensors, vol. 25, no. 24, p. 7680, 2025, doi: https://doi.org/10.3390/s25247680.
[33] S. Sultana et al., “AI-Augmented Big Data Analytics for Real-Time Cyber Attack Detection and Proactive Threat Mitigation,” Int. J. Comput. Exp. Sci. Eng., vol. 11, no. 3, Jul. 2025, doi: https://doi.org/10.22399/ijcesen.3564.
[34] M. K. Tuhin, H. Kaur, H. Imam, A. Hossain, A. Shan-A-Alahi, and P. Chakraborty, “AI-augmented security analytics for real-time threat identification,” in 2026 6th International Conference on Intelligent Technologies (CONIT), IEEE, 2026, pp. 1–9. doi: https://doi.org/10.1109/CONIT69683.2026.11621644.
[35] M. T. Bin Ansar, M. S. Sikder, M. K. Tuhin, N. Das, P. Chakraborty, and H. Rahman, “Resilient MIS Design Using Cryptographic and Cyber-Security Techniques,” in Innovative Computing and Communications, A. E. Hassanien, S. Anand, A. Jaiswal, and P. Kumar, Eds., Cham: Springer Nature Switzerland, 2026, pp. 317–331. doi: https://doi.org/10.1007/978-3-032-30008-9_24.
[36] P. Chakraborty et al., “An Intelligent Cybersecurity Framework for Data Protection in Cloud Computing Environments,” Spectr. Eng. Sci., vol. 2, no. 3, pp. 657–677, Oct. 2024, doi: https://doi.org/10.5281/zenodo.21538159.
[37] K. S. Mudaliyar and S. Satish Kumar, “Cloud Computing Data Security Through Policy Bound Encryption and Verifiable Access Provenance in Multi-Tenant Storage,” Eur. J. Appl. Sci. Eng. Technol., vol. 3, no. 6, pp. 284–296, Dec. 2025, doi: https://doi.org/10.59324/ejaset.2025.3(6).21.
[38] N. Das et al., “A Privacy-Preserving Federated Intrusion Detection System Leveraging Secure Multi-Party Computation Across Collaborative Cloud Tenants,” in Proceedings of Fifth International Conference on Computing and Communication Networks, G.-N. Nguyen, A. Swaroop, and P. Shukla, Eds., Cham: Springer Nature Switzerland, 2026, pp. 488–504. doi: https://doi.org/10.1007/978-3-032-14197-2_42.
[39] N. Das et al., “AI-enhanced privacy preservation using homomorphic federated models,” in 2025 1st International Conference on Advancement in Futuristic Technologies (ICAFT), IEEE, 2025, pp. 1–8. doi: https://doi.org/10.1109/ICAFT66710.2025.11453096.
[40] U. Haldar et al., “Blockchain-Driven Access Control and Compliance Auditing Framework for Federated Cloud Service Providers: Architecture, Prototype and Evaluation,” in Proceedings of Fifth International Conference on Computing and Communication Networks, G.-N. Nguyen, A. Swaroop, and P. Shukla, Eds., Cham: Springer Nature Switzerland, 2026, pp. 464–487. doi: https://doi.org/10.1007/978-3-032-14197-2_41.
[41] J. Hassan et al., “Blockchain Integration in Management Information Systems a Decentralized Approach to Strengthening Cybersecurity and Data Integrity,” in 2025 5th International Conference on Electrical, Computer and Energy Technologies (ICECET), 2025, pp. 1–7. doi: https://doi.org/10.1109/ICECET63943.2025.11472020.
[42] H. U. Himel, M. Mustafizur, T. Akter, R. Anzum, Z. A. Tanni, and A. Hossain, “Privacy-Aware Data Protection Models for Cloud Environments,” in 2026 6th International Conference on Intelligent Technologies (CONIT), 2026, pp. 1–10. doi: https://doi.org/10.1109/CONIT69683.2026.11621371.
[43] M. D. Hossain, M. S. Uddin, M. S. Sikder, T. Hossen, B. Uddin, and R. M. Ahsan, “Green and secure data centers: Balancing energy efficiency with advanced cybersecurity measures,” J. Comput. Sci. Technol. Stud., vol. 6, no. 5, pp. 300–315, 2024, doi: https://doi.org/10.32996/jcsts.2024.6.5.24.
[44] S. C. Mohonta et al., “Efficient Homomorphic Encryption Techniques for Confidential Big-Data Analytics over Public Cloud Infrastructures: Algorithms, Performance, and Trade-Offs,” in Proceedings of Fifth International Conference on Computing and Communication Networks, G.-N. Nguyen, A. Swaroop, and P. Shukla, Eds., Cham: Springer Nature Switzerland, 2026, pp. 507–528. doi: https://doi.org/10.1007/978-3-032-21499-7_41.
[45] K. S. Mudaliyar and S. S. Kumar, “Intelligent Cybersecurity Frameworks for Data Protection in Cloud-Integrated Management Information Systems,” Eastasouth J. Inf. Syst. Comput. Sci., vol. 2, no. 02, pp. 305–323, Dec. 2024, doi: https://doi.org/10.58812/esiscs.v2i02.1165.
[46] K. S. Mudaliyar and S. S. Kumar, “AEGIS-FL: Auditable Federated Threat Detection for Multi-Tenant Cloud-Edge Systems,” Eastasouth J. Inf. Syst. Comput. Sci., vol. 4, no. 01, pp. 101–121, Aug. 2026, doi: https://doi.org/10.58812/esiscs.v4i01.1217.
[47] K. S. Mudaliyar and S. Satish Kumar, “TrustCloud-FL: A Self-Healing and Privacy-Preserving Architecture for Secure Analytics Across Multi-Tenant Hybrid Clouds,” Eur. J. Appl. Sci. Eng. Technol., vol. 4, no. 5, pp. 151–171, Sep. 2026, doi: https://doi.org/10.59324/ejaset.2026.4(5).10.
[48] A. Roy, E. Hossain, H. U. Himel, H. Imam, R. A. Md Rashed, and H. Kaur, “Privacy-Preserving MIS Using Blockchain, Federated Learning and Zero-Trust Models,” in Innovative Computing and Communications, A. E. Hassanien, S. Anand, A. Jaiswal, and P. Kumar, Eds., Cham: Springer Nature Switzerland, 2026, pp. 210–223. doi: https://doi.org/10.1007/978-3-032-30008-9_16.
[49] A. Shan-A-Alahi et al., “Deep Learning-Based Threat Prediction and Autonomous Response Mechanisms for Containerized Microservices in Hybrid Cloud Deployments,” in Proceedings of Fifth International Conference on Computing and Communication Networks, G.-N. Nguyen, A. Swaroop, and P. Shukla, Eds., Cham: Springer Nature Switzerland, 2026, pp. 529–554. doi: https://doi.org/10.1007/978-3-032-21499-7_42.
[50] A. Shan-A-Alahi, M. S. Sikder, H. U. Himel, M. T. Bin Ansar, M. K. Tuhin, and H. Kaur, “Resilient Cybersecurity Architectures for Large-Scale Distributed Systems,” in 2026 IEEE International Conference for Convergence in Computing Technology (I3CTCON), IEEE, 2026, pp. 1–8. doi: https://doi.org/10.1109/I3CTCON68242.2026.11507768.
[51] M. K. Tuhin et al., “Federated Machine Learning for Privacy-Preserving Cyber Threat Intelligence in Global Cloud-Integrated MIS Platforms,” Eastasouth J. Inf. Syst. Comput. Sci., vol. 2, no. 02, pp. 284–293, Dec. 2024, doi: https://doi.org/10.58812/esiscs.v2i02.1123.
[52] U. K. R. Gangula, M. A. Miah, K. Mula, M. Dhakan, Q. T. Sadat, and S. Nayak, “A Lightweight and Secure Semantic Communication Architecture for Edge–IoT–6G Systems,” IEEE Commun. Stand. Mag., pp. 1–6, 2026, doi: https://doi.org/10.1109/MCOMSTD.2026.3677038.
[53] E. Hossain et al., “AI-Driven Trust and Bio-Inspired Optimization Integration in Standardized Digital Twin Frameworks for Next-Generation,” IEEE Commun. Stand. Mag., pp. 1–6, 2026, doi: https://doi.org/10.1109/MCOMSTD.2026.3688125.
[54] M. R. H. Mahin et al., “Secured and standardized intelligent zero-touch 6G framework for edge-AI applications,” IEEE Commun. Stand. Mag., 2026, doi: https://doi.org/10.1109/MCOMSTD.2026.3660159.
[55] K. B. Siddiqa et al., “Assessment of Survivability and Importance Analysis for Networks Managing Intricate Traffic Flows,” IEEE Commun. Stand. Mag., vol. 10, no. 3, pp. 101–106, 2026, doi: https://doi.org/10.1109/MCOMSTD.2025.3638981.
[56] S. R. Varanasi, S. S. S. Valiveti, M. Adnan, M. I. Faruk, M. J. Hossain, and M. M. T. G. Manik, “Cross-Domain standardization and secure edge intelligence for Real-Time digital twin deployments in Next-Generation communication systems,” IEEE Commun. Stand. Mag., vol. 10, no. 3, pp. 107–112, 2026, doi: https://doi.org/10.1109/MCOMSTD.2026.3662187.
[57] M. I. Faruk et al., “Sustainable Computing and Communication Technologies for Digital Twin–Based Energy Optimization in Smart Infrastructure Systems,” Internet Technol. Lett., vol. 9, no. 5, p. e70351, Sep. 2026, doi: https://doi.org/10.1002/itl2.70351.
[58] J. Goh, S. Adepu, K. N. Junejo, and A. Mathur, “A Dataset to Support Research in the Design of Secure Water Treatment Systems,” in Critical Information Infrastructures Security, G. Havarneanu, R. Setola, H. Nassopoulos, and S. Wolthusen, Eds., Cham: Springer International Publishing, 2017, pp. 88–99. doi: https://doi.org/10.1007/978-3-319-71368-7_8.
[59] K. S. Mudaliyar and S. S. Kumar, “Deadline Performance and Tenant Fairness Under Security Screening in Cloud Workload Scheduling,” Eastasouth J. Inf. Syst. Comput. Sci., vol. 3, no. 01, pp. 198–210, Aug. 2025, doi: https://doi.org/10.58812/esiscs.v3i01.1250.
[60] T. Saito and M. Rehmsmeier, “The Precision-Recall Plot Is More Informative than the ROC Plot When Evaluating Binary Classifiers on Imbalanced Datasets,” PLoS One, vol. 10, no. 3, p. e0118432, 2015, doi: https://doi.org/10.1371/journal.pone.0118432.