CyberShield: an adaptive protocol-aware denoising autoencoder framework for SCADA anomaly detection and attack typing

Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) networks play crucial roles in critical infrastructures in energy, water, and manufacturing industries. The convergence of Operational Technology with IoT has expanded the attack surface area, hence limiting the effectiveness of conventional intrusion detection approaches. Several machine learning-based SCADA intrusion detection systems rely on generic IT dataset inputs, protocol independent feature extraction methods, and inadequate adaptive alert-priority decisioning processes. This paper presents CyberShield, a three-layer adaptive SCADA intrusion detection approach. In the first layer, the paper employs an Adaptive Protocol-Aware Denoising Autoencoder (APDA) learns normal SCADA/ICS behaviour through group-wise parallel encoding based on dataset-specific semantic feature groups. APDA provides the latent embedding of the traffic z, per-group reconstruction errors, and global reconstruction error. In the second layer, a fusion of original features, APDA latent embedding z, and reconstruction error features results into a high-dimensional vector x′, which is then classified using APDA guided XGBoost and LightGBM ensemble classifier. In the final layer, the paper uses statistical threshold τ = µ + 3σ to determine Low, Medium, and High model-based alert-priority levels. CyberShield was tested on WUSTL-IIoT-2021 and HAI-21.03 datasets and obtained accuracy scores of 98.73% and 97.85%, Macro F1-scores of 98.70% and 97.76%, and AUC-ROC scores of 99.12% and 98.54%, respectively. It achieved higher measured performance than five reimplemented autoencoder and ensemble-based comparison methods. The results show that semantic-feature-group-aware representation learning, APDA-guided feature fusion, boosted ensemble classification, and adaptive alert-priority assignment improve SCADA anomaly detection and attack typing.