Building a System of Analytics of Information Security Events in the Automated Process Control System and Incident Analysis Based on Cluster Analysis

The paper discusses the development and application of an ensemble model combining cluster analysis methods and neural networks to improve the efficiency of anomaly detection in network traffic of industrial ACSs. The focus is on the integration of clustering methods such as DBSCAN and HDBSCAN, which demonstrate high accuracy in detecting anomalies characteristic of different types of cyber attacks. A PDPC algorithm is proposed that improved the density clustering of DPC by using a particle swarm optimization technique, showing significant superiority over existing methods. Clustering approaches under training data constraints and complexity in information security risk assessment are also investigated. A web interface is developed to provide administrators with the ability to monitor and promptly respond to threats, as well as to control model parameters in real time. The results show that the proposed approach significantly strengthens the cybersecurity of industrial networks by adapting to dynamically changing environmental conditions.