Anomaly Detection in Air-Gapped Industrial Control Systems of Nuclear Power Plants

This paper proposes to combine two neural network models to detect anomalous behaviors resulting from cyber-threats in air-gapped industrial control systems (ICS) specific to nuclear power plant’s (NPP) safety shutdown systems. Initially, an ICS testbed that replicates essential components of NPP safety protocols is developed, providing a realistic environment for model validation. The proposed model uses the strengths of a native transformer and Long Short-Term Memory (LSTM) networks. This combination not only detects denial of service (DoS) attacks but sophisticated threats like man-in-the-middle (MITM) attacks. Experimental results show that the combined model has a detection accuracy of 99.8% using a dataset characterized by balanced classes across MITM and DoS scenarios. The model is presented as a white-box solution, facilitating straightforward implementation and adoption by NPP system owners who seek transparency and control over their security measures.