A lightweight closed-loop adaptive intrusion detection framework for cyber resilience in critical infrastructure

Abstract Most operators of energy, health, or transport facilities do not have at their disposal the kind of computational resources that large-scale deep-learning detectors require. Being energy and health care and transportation facility operators, they seek an intrusion detection approach that is responsive to environmental changes. We present one such lightweight alternative. At the core of such an approach is a regularized Logistic Regression-based detector, with the closed loop comprising context-aware thresholding, behavioral profiling, recent error-rate feedback, budget-limited incremental updates, and deception-derived observations from outside. None of these approaches is, in itself, novel. Our contribution lies in the coupling of these mechanisms to displace the decision threshold using contextual and behavioral signals and in detecting confirmed outcomes that are then fed back to update the classifier, the behavioral baseline, and future decisions. We conduct the model evaluation on two levels of abstraction. The confirmation dataset includes 39,919 SWaT instances segmented into 40 nonoverlapping time windows, validated over StratifiedGroupKFold with a per-instance allowance of no more than 256 analyst-validated instances. In an ablation study over 25 such splits comparing the full model to the Logistic Regression with the static threshold, the full model achieved an F1 of 0.7526 ± 0.1074 compared with only 0.5719 ± 0.1578 for the latter (Holm adjusted p < 0.001). Most of the contribution came from budgeted incremental learning; without it, F1 dropped by 0.1704. Feedback using error rates was less important but still significant, returning 0.0048 in F1 together with a lower false positive rate. Behavioral profiling did not affect the F1 and improved specificity. Context-aware thresholding increased the false positive rate while yielding no improvement in the F1; thus, this is reported as a trade-off rather than an improvement. There were no significant contrasts with respect to the Holm correction; hence, we do not claim any synergy. Batch Logistic Regression with matching scored 0.7065 ± 0.1254 in terms of F1 score compared with Decision Tree, Random Forest, Linear SVM, Extra Trees, and MLP, none being significantly different from batch Logistic Regression. Because the labels were equally split among 256, all feedback mechanisms outperformed the case with no feedback, going from an F1 of 0.5845 ± 0.1495 to between 0.7292 and 0.7676. The deception-prioritized proxy did not make it into the winners. It beat no feedback but lost to random sampling on all the metrics that we examined. We have, therefore, referenced the previously published simulation and emulation figures as exploratory studies illustrating the behavior of this architecture. In toto, the framework is efficient and competitive under the tested conditions, and nothing herein suggests classifier superiority or a deception-specific advantage or true zero-day detection or readiness for a live plant.