Multi-Step Attacks Reasoning Framework for Cyber-Physical Systems

A Cyber-Physical System (CPS) consists of interconnected sensors and actuators components, specifically designed for mission critical applications. However, the susceptibility of CPS components to cyber and physical attacks can be highly detrimental. Although anomaly detection mechanisms have been proposed to address cyberattacks, existing methods often fail to detect multi-step attacks. Cyberattacks can be stealthy, necessitating the correlation of different malicious actions to detect these multi-stage threats in a timely manner for prompt mitigation. This paper proposes a novel reasoning architecture that leverages a neuro-fuzzy learning mechanism with a transformer architecture to detect individual and multi-step attack scenarios. Validation results using critical networking infrastructure demonstrate the effectiveness of our approach compared to a prominent competing scheme.