AI-Based Threat Detection in Industrial OT Networks

Industrial Operational Technology (OT) networks connect programmable logic controllers, supervisory control and dataacquisition (SCADA) systems, sensors, engineering workstations, and industrial control equipment. These systemssupport manufacturing, energy, water treatment, and other critical operations. Increasing connectivity between OT andinformation technology (IT) environments creates additional paths for cyber threats, while the operational consequencesof disruption can be significant. This paper proposes an AI-based threat-detection framework designed for industrial OTnetworks. The proposed design combines passive collection of authorised network metadata and device logs,protocol-aware feature extraction, supervised machine-learning classification, anomaly detection, risk scoring, andhuman-reviewed alerts. The methodology prioritises OT-specific constraints such as predictable communicationpatterns, legacy devices, limited computing resources, availability requirements, and the risk of disrupting physicalprocesses. The paper outlines a prototype architecture, candidate datasets and evaluation metrics, security andgovernance requirements, and possible extensions. No experimental results are claimed because the proposed systemhas not been implemented and benchmarked in a controlled industrial environment. The framework is intended as adefensive academic prototype and requires validation before operational deployment.