ADAPTING PLC/SCADA SYSTEMS TO MITIGATE INDUSTRIAL IOT CYBERSECURITY RISKS IN GLOBAL MANUFACTURING

Over 60 percent of industrial cyber intrusions exploit insecure OT protocols and unauthorized remote access services.

“International cybersecurity incident reports indicate that over 60 percent of industrial cyber intrusions exploit insecure OT protocols and unauthorized remote access services (Jahid, 2022)”

• cites Jahid, 2022 sourceCould not verify

  The Data Synthesis and Analytical Approach section discusses cost, schedule, and financing risks in real estate projects, not industrial cyber intrusions. Searches for OT protocols, unauthorized remote access, and the claimed 60-percent figure found no passage addressing the claim; the cybersecurity-related reference entry does not establish it. (LLM, conf=0.76)

  Experimental — accuracy not yet measured

The proposed adaptive cybersecurity framework achieved an average MTTD of 2.8 seconds.

“Average MTTD was reduced to 2.8 seconds”

Suricata's deep packet inspection logs exhibited consistent detection of abnormal TCP flag patterns and retransmission anomalies.

“Suricata's deep packet inspection logs exhibited consistent detection of abnormal TCP flag patterns and retransmission anomalies, which MATLAB processed into normalized packet-rate variance plots.”

Once the SOAR playbook executed the isolation script, real-time network data confirmed that malicious traffic flow through the affected conduit dropped to zero within one second.

“Once the SOAR playbook executed the isolation script, real-time network data confirmed that malicious traffic flow through the affected conduit dropped to zero within one second.”

These attack-induced deviations were rapidly detected by the AI-based anomaly detection models through elevated reconstruction error thresholds and abnormal temporal correlation signals.

“These deviations were rapidly detected by the AIbased anomaly detection models through elevated reconstruction error thresholds and abnormal temporal correlation signals.”

During command injection and sensor spoofing simulations, Zeek and Suricata telemetry streams captured distinct anomalies in both packet rate and function code distribution.

“During the command injection and sensor spoofing simulations, Zeek and Suricata telemetry streams captured distinct anomalies in both packet rate and function code distribution.”

The proposed framework decreased PLOC by over 40% relative to baseline configurations.

“PLOC decreased by over 40% relative to baseline configurations”

In the sensor spoofing scenario, TTUS extended to 340 seconds, producing an RTTUS margin of 154 seconds due to the slower escalation of process instability.

“Here, TTUS extended to 340 seconds, producing a much larger RTTUS margin of 154 seconds due to the slower escalation of process instability.”

• AssumptionRests on an assumption: The simulated attack scenarios (command injection, sensor spoofing, MQTT broker flooding) are representative of real-world IIoT cyber threats to PLC/SCADA systems.

During command injection scenarios, reconstruction errors exceeded the adaptive threshold within 2.0 seconds, corresponding to a rapid process deviation in valve actuation and tank level response.

“During command injection scenarios, reconstruction errors exceeded the adaptive threshold within 2.0 seconds, corresponding to a rapid process deviation in valve actuation and tank level response.”

A sensor spoofing attack simulated by injecting false pressure readings caused the PLC to interpret normal operation as under-pressurized, leading to unnecessary actuator activation and flow adjustments that destabilized the system.

“In the second scenario, a sensor spoofing attack was simulated in MATLAB by injecting false pressure readings into the digital twin environment.This attack caused the PLC to interpret normal operation as under-pressurized conditions, leading to unnecessary actuator activation and flow adjustments that destabilized the system.”

• AssumptionRests on an assumption: The simulated attack scenarios (command injection, sensor spoofing, MQTT broker flooding) are representative of real-world IIoT cyber threats to PLC/SCADA systems.

The combined detection accuracy across all tested conditions improved from 94.2% (edge only) and 97.6% (plant only) to 99.1% under hybrid integration.

“The combined detection accuracy across all tested conditions improved from 94.2% (edge only) and 97.6% (plant only) to 99.1% under hybrid integration.”

Sensor spoofing attacks produced a slightly longer MTTD of approximately 5.2 seconds.

“The sensor spoofing attacks, characterized by gradual signal distortion, produced a slightly longer MTTD of approximately 5.2 seconds.”

The proposed framework achieved an average MTTR of 4.8 minutes.

“MTTR averaged 4.8 minutes”

In baseline simulation, the system demonstrates stable dynamics across flow rate, pressure, and tank level, indicative of proper PLC-to-actuator coordination without external disturbances.

“As shown in Figure 1, the system demonstrates stable dynamics across key operational parameters-flow rate, pressure, and tank level-which are indicative of proper PLCto-actuator coordination without any external disturbances.”

Under command injection, the tank level curve exhibited a sustained upward trajectory without convergence, indicating a direct compromise of control authority.

“Unlike the smooth stabilization observed in the baseline simulation, the tank level curve under attack exhibited a sustained upward trajectory without convergence, indicating a direct compromise of control authority.”

• AssumptionRests on an assumption: The simulated attack scenarios (command injection, sensor spoofing, MQTT broker flooding) are representative of real-world IIoT cyber threats to PLC/SCADA systems.

The hybrid AI model achieved a detection accuracy exceeding 99%.

“The hybrid AI model achieved a detection accuracy exceeding 99%”

Automated SOAR responses effectively restored process variables to nominal states within minutes.

“automated SOAR responses effectively restored process variables to nominal states within minutes”

During simulated attack conditions, the Autoencoder edge model's reconstruction error sharply increased, peaking at 0.48 within two seconds of anomaly onset, well above the adaptive threshold of 0.08.

“However, during simulated attack conditions-such as command injection and sensor spoofing-the reconstruction error sharply increased, peaking at 0.48 within two seconds of anomaly onset, well above the adaptive threshold (0.08) defined through MATLAB statistical modeling.”

The hybrid AI model achieved an ROC-AUC of 0.993.

“with an ROC-AUC of 0.993”

A command injection attack via malicious Modbus write altered the valve control setpoint, forcing it to remain open beyond safe operational thresholds.

“In the first scenario, a command injection attack was initiated through a malicious Modbus write operation that altered the valve control setpoint, forcing it to remain in the open position beyond safe operational thresholds.”

• AssumptionRests on an assumption: The simulated attack scenarios (command injection, sensor spoofing, MQTT broker flooding) are representative of real-world IIoT cyber threats to PLC/SCADA systems.

SOAR-triggered rollback halved recovery time relative to manual intervention models.

“MATLAB synchronization logs confirmed that SOAR-triggered rollback actions reinstated verified PLC configurations within minutes, halving recovery time relative to manual intervention models.”

MATLAB synchronization logs confirmed that SOAR-triggered rollback actions reinstated verified PLC configurations within minutes.

“MATLAB synchronization logs confirmed that SOAR-triggered rollback actions reinstated verified PLC configurations within minutes, halving recovery time relative to manual intervention models.”

During command injection attacks, the forced valve-open state increased process instability, producing a mean PLOC value of 0.37, as derived from a logistic probability curve applied to tank level variance and overflow threshold crossings.

“During command injection attacks, the forced valve-open state increased process instability, producing a mean PLOC value of 0.37, as derived from a logistic probability curve applied to tank level variance and overflow threshold crossings.”

• AssumptionRests on an assumption: The logistic probability curve and risk-based probability models used to compute PLOC are valid for translating control deviation, attack dwell time, and recovery latency into probability of loss of control.

ROC surface analysis from aggregated simulation runs showed consistent detection behavior across datasets with low variance (σ < 0.005).

“The ROC surface analysis, derived from aggregated simulation runs, revealed consistent detection behavior across datasets with low variance (σ < 0.005), validating model reliability and generalization.”

The LSTM-based plant model identified complex, gradual attacks in less than 6 seconds.

“The proposed edge Autoencoder detected command injection events within 2 seconds, while the LSTM-based plant model identified complex, gradual attacks in less than 6 seconds, achieving an average MTTD of 2.8 seconds in hybrid operation.”

MATLAB-based validation confirmed that detection precision remained stable across varying process loads.

“In this study, MATLAB-based validation confirmed that detection precision remained stable across varying process loads, demonstrating the robustness of the hybrid AI ensemble.”

For sensor spoofing scenarios, recovery averaged 3.9 minutes, owing to faster digital twin verification and reduced physical actuation delays.

“For sensor spoofing scenarios, recovery averaged 3.9 minutes, owing to faster digital twin verification and reduced physical actuation delays.”

The study's detection latencies are notably superior to the 30-45 seconds average reported by Tomar et al. (2023) for rule-based and static signature detection in legacy SCADA networks.

“These figures are notably superior to the detection latencies reported by Tomar et al. (2023), where rulebased and static signature detection in legacy SCADA networks averaged 30-45 seconds before anomaly recognition.”

• cites Tomar et al. (2023) sourceNot checked — no full text of the source

The LSTM model exhibited a lower FPR of 0.12 per hour, as it could distinguish temporary process noise from sustained anomalous trends.

“The LSTM model, trained to recognize sequential dependencies, exhibited a lower FPR of 0.12 per hour, as it could distinguish temporary process noise from sustained anomalous trends.”

The architecture achieved a 40% decrease in the Probability of Loss of Control (PLOC).

“Quantitative results demonstrate significant improvements in resilience metrics-achieving a 50% reduction in Mean Time to Detect (MTTD) and Mean Time to Recover (MTTR) compared to baseline OT configurations, a 40% decrease in the Probability of Loss of Control (PLOC), and a hybrid detection accuracy exceeding 99% with an AUC of 0.993.”

The sensor spoofing scenario yielded a lower PLOC of 0.21, owing to slower system drift and successful AI-based correction before critical thresholds were exceeded.

“The sensor spoofing scenario, characterized by gradual false data injection, yielded a lower PLOC of 0.21, owing to slower system drift and successful AI-based correction before critical thresholds were exceeded.”

• AssumptionRests on an assumption: The logistic probability curve and risk-based probability models used to compute PLOC are valid for translating control deviation, attack dwell time, and recovery latency into probability of loss of control.

The hybrid operation achieved an average MTTD of 2.8 seconds.

“The proposed edge Autoencoder detected command injection events within 2 seconds, while the LSTM-based plant model identified complex, gradual attacks in less than 6 seconds, achieving an average MTTD of 2.8 seconds in hybrid operation.”

The proposed model maintained PLOC below 0.5 across all attack types.

“By maintaining PLOC below 0.5 across all attack types, the proposed model meets industrial safety benchmarks defined under ISA/IEC 62443-3-3, underscoring that layered AI-augmented defense architectures can sustain deterministic process stability during hostile conditions.”

The detection error variability outperformed the variability ranges observed in hadi & Sallom (2019).

“MATLAB-derived time-series validation further verified that detection errors remained below 5%, with standard deviations under ±0.6 seconds, outperforming the variability ranges observed in (hadi & Sallom, 2019).”

• cites hadi & Sallom, 2019 sourceNot checked — no full text of the source

The hybrid model's ROC curve consistently dominates the upper-left region, indicating an optimal sensitivity-specificity trade-off.

“MATLAB's ROC visualizations display a consolidated comparison of model performance, where the hybrid curve consistently dominates the upper-left region of the plot-signifying optimal trade-off between sensitivity and specificity.”

• Also stated in: § DISCUSSION · plain

  “MATLAB's ROC surface plots exhibited dominant curves concentrated in the upper-left region, signifying minimal false alarms and near-perfect classification across all attack types.”

Hybrid detection accuracy exceeded 99%.

“Quantitative results demonstrate significant improvements in resilience metrics-achieving a 50% reduction in Mean Time to Detect (MTTD) and Mean Time to Recover (MTTR) compared to baseline OT configurations, a 40% decrease in the Probability of Loss of Control (PLOC), and a hybrid detection accuracy exceeding 99% with an AUC of 0.993.”

• Also stated in: § DISCUSSION · plain

  “The hybrid detection model recorded an average FPR of 0.009 with a detection accuracy of 99.1%, outperforming earlier studies such as Rashad et al. (2022), which reported FPR values near 0.04 in similar AI-based ICS detection frameworks.”

The architecture achieved a 50% reduction in Mean Time to Recover (MTTR) compared to baseline OT configurations.

“Quantitative results demonstrate significant improvements in resilience metrics-achieving a 50% reduction in Mean Time to Detect (MTTD) and Mean Time to Recover (MTTR) compared to baseline OT configurations, a 40% decrease in the Probability of Loss of Control (PLOC), and a hybrid detection accuracy exceeding 99% with an AUC of 0.993.”

• Also stated in: § DISCUSSION · boosted

  “The research findings validate that automation-driven containment can cut Mean Time to Recover (MTTR) by over 50%, underscoring the need for policy frameworks that institutionalize automated rollback, firmware integrity verification, and process correlation as part of incident response workflows.”

The architecture achieved a 50% reduction in Mean Time to Detect (MTTD) compared to baseline OT configurations.

“Quantitative results demonstrate significant improvements in resilience metrics-achieving a 50% reduction in Mean Time to Detect (MTTD) and Mean Time to Recover (MTTR) compared to baseline OT configurations, a 40% decrease in the Probability of Loss of Control (PLOC), and a hybrid detection accuracy exceeding 99% with an AUC of 0.993.”

• Also stated in: § DISCUSSION · boosted

  “Furthermore, the hybrid AI detection framework achieved a 50% reduction in Mean Time to Detect (MTTD) compared to baseline control systems, confirming that adaptive edge and plant-level analytics significantly enhance situational awareness.”

Threshold tuning within the hybrid system delivers balanced, repeatable detection accuracy, substantiated by Youden's J statistic and precision-recall balance.

“The integration of statistical confidence metrics, including Youden's J statistic and precision-recall balance, further substantiated that threshold tuning within the hybrid system delivers balanced, repeatable detection accuracy.”

The hybrid detection model recorded an average FPR of 0.009.

“The hybrid detection model recorded an average FPR of 0.009 with a detection accuracy of 99.1%, outperforming earlier studies such as Rashad et al. (2022), which reported FPR values near 0.04 in similar AI-based ICS detection frameworks.”

The LSTM plant model achieved an even higher AUC of 0.98, indicating superior long-term correlation accuracy and temporal awareness for identifying gradual process drifts and delayed attack manifestations.

“Conversely, the LSTM plant model achieved an even higher AUC of 0.98, indicating superior long-term correlation accuracy and temporal awareness for identifying gradual process drifts and delayed attack manifestations.”

The proposed edge Autoencoder detected command injection events within 2 seconds.

“The proposed edge Autoencoder detected command injection events within 2 seconds, while the LSTM-based plant model identified complex, gradual attacks in less than 6 seconds, achieving an average MTTD of 2.8 seconds in hybrid operation.”

The hybrid detection model outperformed earlier studies such as Rashad et al. (2022) that reported FPR near 0.04.

“The hybrid detection model recorded an average FPR of 0.009 with a detection accuracy of 99.1%, outperforming earlier studies such as Rashad et al. (2022), which reported FPR values near 0.04 in similar AI-based ICS detection frameworks.”

• cites Rashad et al. (2022) sourceNot checked — no full text of the source

The hybrid detection model achieved an AUC of 0.993.

“Quantitative results demonstrate significant improvements in resilience metrics-achieving a 50% reduction in Mean Time to Detect (MTTD) and Mean Time to Recover (MTTR) compared to baseline OT configurations, a 40% decrease in the Probability of Loss of Control (PLOC), and a hybrid detection accuracy exceeding 99% with an AUC of 0.993.”

• Also stated in: § DISCUSSION · plain

  “The ensemble achieved an AUC of 0.993, exceeding the benchmark values using deep learning on the SWaT dataset.”

The adaptive thresholding strategy applied in MATLAB through rolling standard deviation filters effectively balanced sensitivity against false alarm frequency.

“The adaptive thresholding strategy applied in MATLAB through rolling standard deviation filters effectively balanced sensitivity against false alarm frequency, consistent with recommendations from Abdallah and Nijmeh (2004).”

• cites Abdallah and Nijmeh (2004) sourceNot checked — no full text of the source

Localized, unsupervised learning-based detection mechanisms are capable of immediate identification of micro-anomalies that precede full-scale system disruptions.

“These findings confirm that localized, unsupervised learning-based detection mechanisms are capable of immediate identification of micro-anomalies that precede full-scale system disruptions.”

Over 50 percent of currently deployed PLC systems in industrial plants remain configured with default credentials or plaintext command channels.

“Studies indicate that over 50 percent of currently deployed PLC systems in industrial plants remain configured with default credentials or plaintext command channels, exposing them to cyberphysical threats that can disrupt physical processes or lead to catastrophic operational failures (Hasan et al., 2019;Sadia, 2023).”

• cites Hasan et al., 2019 sourceNot checked — no full text of the source
• cites Sadia, 2023Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

The integration of machine-speed detection, rapid automation, and constrained impact radius underscores the architectural efficiency of the proposed system, which transforms raw OT network telemetry into actionable cybersecurity intelligence for sustaining operational resilience.

“This integration of machine-speed detection, rapid automation, and constrained impact radius underscores the architectural efficiency of the proposed system, which transforms raw OT network telemetry into actionable cybersecurity intelligence for sustaining operational resilience.”

The rapid spike in reconstruction loss following process deviation validated the Autoencoder's high sensitivity to cyber-induced disturbances, particularly those that subtly alter flow or pressure dynamics without immediate mechanical irregularities.

“The rapid spike in reconstruction loss following process deviation validated the Autoencoder's high sensitivity to cyberinduced disturbances, particularly those that subtly alter flow or pressure dynamics without immediate mechanical irregularities.”

The Autoencoder model's precision was enhanced through autothresholding and rolling standard deviation filters, ensuring robustness against transient noise.

“The model's precision was further enhanced through autothresholding and rolling standard deviation filters, ensuring robustness against transient noise.”

The hybrid AI model demonstrated superior precision and reliability compared to conventional rule-based detection systems.

“indicating superior precision and reliability compared to conventional rule-based detection systems”

The framework aligns with industrial resilience targets defined in NIST SP 800-160 and IEC 62443-3-3.

“confirming practical alignment with industrial resilience targets defined in NIST SP 800-160 and IEC 62443-3-3”

The LSTM plant-level model captures sequential dependencies, allowing it to detect slow-developing, multi-stage attack patterns such as cumulative sensor spoofing or stealthy command drift.

“Unlike the Autoencoder, which focuses on instantaneous deviations, the LSTM model captures sequential dependencies, allowing it to detect slow-developing, multi-stage attack patterns such as cumulative sensor spoofing or stealthy command drift.”

The convergence of OT and IT in modern industrial infrastructures has expanded the cybersecurity threat surface of PLCs and SCADA systems.

“The convergence of Operational Technology (OT) and Information Technology (IT) in modern industrial infrastructures has revolutionized automation and real-time control, yet it has simultaneously expanded the cybersecurity threat surface of Programmable Logic Controllers (PLCs) and Supervisory Control and Data Acquisition (SCADA) systems.”

• Also stated in: § Table 2: Cybersecurity Vulnerabilities and Attack Surfaces in Converged IT-OT Industrial Control Environments · plain

  “The rapid convergence of IT and OT has fundamentally restructured the cybersecurity landscape of industrial environments, creating attack surfaces that extend beyond traditional enterprise networks into operational domains that were never engineered for exposure to external traffic (Danish & Zafor, 2022).”

• cites Danish & Zafor, 2022Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• AssumptionRests on an assumption: PLCs and SCADA systems historically operated within isolated OT environments physically segregated from IT networks.

The findings provide empirical evidence that adaptive security architectures, supported by AI-driven analytics and digital twin validation, can safeguard industrial control systems against both known and emergent IIoT threats while maintaining deterministic process control.

“The findings provide empirical evidence that adaptive security architectures, supported by AI-driven analytics and digital twin validation, can safeguard industrial control systems against both known and emergent IIoT threats while maintaining deterministic process control.”

High MTTR is associated with increased Probability of Loss of Control (PLOC), especially in continuous-flow industries such as water treatment and oil refining where delayed recovery can lead to unsafe process states.

“Literature also documents that high MTTR is associated with increased Probability of Loss of Control (PLOC), especially in continuous-flow industries such as water treatment and oil refining where delayed recovery can lead to unsafe process states (Tomar et al., 2023).”

• cites Tomar et al., 2023 sourceNot checked — no full text of the source

The framework ensures rigorous, standards-aligned validation of the proposed architecture's defensive capabilities under cyber-physical stress conditions.

“Collectively, this framework ensures rigorous, standardsaligned validation of the proposed architecture's defensive capabilities under cyber-physical stress conditions.”

• AssumptionRests on an assumption: The threshold criteria derived from prior literature and industrial resilience standards are appropriate for this system.

Enhanced cybersecurity did not impede real-time control efficiency.

“validating that enhanced cybersecurity did not impede real-time control efficiency”

Intrusion into a PLC network can lead to direct manipulation of pumps, valves, or pressure systems without triggering alarms due to the absence of process-aware security mechanisms.

“Empirical findings from cyber-physical experiments demonstrate that intrusion into a PLC network can lead to direct manipulation of pumps, valves, or pressure systems without triggering alarms due to the absence of process-aware security mechanisms (Han et al., 2014;Zayadul, 2023).”

• cites Han et al., 2014 sourceNot checked — no full text of the source
• cites Zayadul, 2023Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Zeek and Suricata telemetry, when analyzed with MATLAB's time-series and statistical functions, can rapidly and accurately identify protocol-level irregularities that signify the onset of cyber manipulation.

“Together, these findings demonstrate that Zeek and Suricata telemetry-when analyzed with MATLAB's time-series and statistical functions-can rapidly and accurately identify protocol-level irregularities that signify the onset of cyber manipulation.”

The virtual environment was hardware-integrated with physical Rockwell Micro820 PLCs to ensure anomaly patterns detected in simulation corresponded accurately to real PLC behavior.

“This virtual environment was hardware-integrated with physical Rockwell Micro820 PLCs to ensure that anomaly patterns detected in simulation corresponded accurately to real PLC behavior.”

The composite dataset comprising normal and attack-state observations enabled development of accurate anomaly detection models capable of distinguishing legitimate process variations from cyber-induced deviations.

“This composite dataset, comprising both normal and attack-state observations, enabled the development of accurate anomaly detection models capable of distinguishing legitimate process variations from cyber-induced deviations.”

The integrated architecture maintains adequate temporal resilience, as the combined detection and recovery window (MTTD + MTTR) remains well below the time required for the process to transition into an unsafe state.

“These results demonstrate that even under accelerated attack conditions, the integrated architecture maintains adequate temporal resilience, as the combined detection and recovery window (MTTD + MTTR) remains well below the time required for the process to transition into an unsafe state.”

• AssumptionRests on an assumption: The simulated attack scenarios (command injection, sensor spoofing, MQTT broker flooding) are representative of real-world IIoT cyber threats to PLC/SCADA systems.

Threat modeling analysis using MITRE ATT&CK for ICS, STRIDE, and PASTA informed the attack scenarios tested, ensuring command injection, firmware tampering, MQTT broker denial-of-service, and lateral movement were systematically evaluated.

“A threat modeling analysis using the MITRE ATT&CK for ICS, STRIDE, and PASTA frameworks informs the attack scenarios tested in this study, ensuring that command injection, firmware tampering, MQTT broker denial-of-service, and lateral movement are systematically evaluated.”

Layered AI-augmented defense architectures can sustain deterministic process stability during hostile conditions.

“By maintaining PLOC below 0.5 across all attack types, the proposed model meets industrial safety benchmarks defined under ISA/IEC 62443-3-3, underscoring that layered AI-augmented defense architectures can sustain deterministic process stability during hostile conditions.”

The integrated architecture collectively minimizes system vulnerability and response latency.

“Key contributions confirmed through MATLAB-based analysis include the successful integration of ISA/IEC 62443 zone-conduit segmentation, AI-driven anomaly detection, and SOAR-enabled automated recovery, collectively minimizing system vulnerability and response latency.”

The work establishes a reproducible cybersecurity model adaptable to global manufacturing systems.

“By demonstrating compliance with U.S. critical infrastructure protection standards and achieving measurable resilience gains, this work establishes a reproducible cybersecurity model adaptable to global manufacturing systems, where safety, continuity, and real-time assurance remain paramount to sustaining industrial reliability in the era of digital transformation..”

• AssumptionRests on an assumption: The MATLAB/Simulink digital twin and hardware-in-the-loop setup faithfully represent real PLC/SCADA systems in global manufacturing IIoT environments.
• AssumptionRests on an assumption: The composite dataset (70% public ICS datasets and 30% laboratory data) is representative of diverse global manufacturing IIoT environments.
• AssumptionRests on an assumption: The attack scenarios tested are representative of the full range of IIoT cybersecurity threats in global manufacturing.

The low variance in ROC surface analysis validates model reliability and generalization.

“The ROC surface analysis, derived from aggregated simulation runs, revealed consistent detection behavior across datasets with low variance (σ < 0.005), validating model reliability and generalization.”

The proposed model meets industrial safety benchmarks defined under ISA/IEC 62443-3-3.

“By maintaining PLOC below 0.5 across all attack types, the proposed model meets industrial safety benchmarks defined under ISA/IEC 62443-3-3, underscoring that layered AI-augmented defense architectures can sustain deterministic process stability during hostile conditions.”

• cites ISA/IEC 62443-3-3Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Coordinated edge and plant-level intelligence can ensure operational stability under diverse attack conditions.

“These achievements, grounded in ISA/IEC 62443 zoning principles, NIST SP 800-82 controls, and Zero-Trust segmentation, confirm that coordinated edge and plant-level intelligence can ensure operational stability under diverse attack conditions.”

Early detection and rapid mitigation significantly reduce the likelihood of control loss.

“This demonstrates that early detection and rapid mitigation significantly reduce the likelihood of control loss.”

Integrating rapid detection and automated rollback substantially decreases the likelihood of total control loss by constraining attack impact duration and scope.

“These probabilistic results, validated across multiple simulations, confirm that integrating rapid detection and automated rollback substantially decreases the likelihood of total control loss by constraining attack impact duration and scope.”

• AssumptionRests on an assumption: The logistic probability curve and risk-based probability models used to compute PLOC are valid for translating control deviation, attack dwell time, and recovery latency into probability of loss of control.

A digital twin of the industrial process was developed using MATLAB/Simulink and SimPy, allowing simulation of normal and adversarial scenarios.

“A digital twin of the industrial process is developed using MATLAB/Simulink and SimPy, allowing simulation of both normal process operations and adversarial attack scenarios in a controlled environment.”

The hybrid AI ensemble is robust.

“In this study, MATLAB-based validation confirmed that detection precision remained stable across varying process loads, demonstrating the robustness of the hybrid AI ensemble.”

The simulation was integrated with real PLC hardware to enable hardware-in-the-loop validation, ensuring fidelity between virtual and physical responses.

“This simulation is integrated with real PLC hardware to enable hardware-in-the-loop validation, ensuring fidelity between virtual and physical responses.”

• AssumptionRests on an assumption: The MATLAB/Simulink digital twin and hardware-in-the-loop setup faithfully represent real PLC/SCADA systems in global manufacturing IIoT environments.

Model training and testing used a composite dataset comprising 70% publicly available ICS datasets (SWaT, WADI, Tennessee Eastman Process) and 30% laboratory-collected data from the Micro820 PLC.

“Model training and testing are performed using a composite dataset comprising 70% publicly available ICS datasets (SWaT, WADI, and Tennessee Eastman Process) and 30% laboratory-collected data from the Micro820 PLC.”

• AssumptionRests on an assumption: The composite dataset (70% public ICS datasets and 30% laboratory data) is representative of diverse global manufacturing IIoT environments.

Hardware-based isolation was verified through MATLAB's digital twin simulations.

“The integration of hardware-based isolation, verified through MATLAB's digital twin simulations, supports the resilience-focused design principles proposed by NIST SP 800-160 and IEC 62443-3-3, reinforcing that predictive, automated control recovery mechanisms can sustain safety and production continuity even during persistent cyber events.”

The proposed multilayer cybersecurity architecture enhances resilience and operational safety of PLC/SCADA systems within IIoT environments.

“The findings of this study validate the effectiveness of the proposed multilayer cybersecurity architecture in enhancing the resilience and operational safety of PLC/SCADA systems within Industrial Internet of Things (IIoT) environments.”

Predictive, automated control recovery mechanisms can sustain safety and production continuity even during persistent cyber events.

“The integration of hardware-based isolation, verified through MATLAB's digital twin simulations, supports the resilience-focused design principles proposed by NIST SP 800-160 and IEC 62443-3-3, reinforcing that predictive, automated control recovery mechanisms can sustain safety and production continuity even during persistent cyber events.”

Adaptive edge and plant-level analytics significantly enhance situational awareness.

“Furthermore, the hybrid AI detection framework achieved a 50% reduction in Mean Time to Detect (MTTD) compared to baseline control systems, confirming that adaptive edge and plant-level analytics significantly enhance situational awareness.”

The system has capacity for swift restoration following cyber-physical disruptions.

“The observed Mean Time to Recover (MTTR) values, averaging 4.8 minutes for command injection and 3.9 minutes for sensor spoofing, highlight the system's capacity for swift restoration following cyber-physical disruptions.”

The integration of standards-aligned architectural controls, AI-driven anomaly detection, and automated incident response forms an effective and quantifiable defense strategy for securing PLC/SCADA systems within IIoT environments.

“This study concludes that the integration of standards-aligned architectural controls, artificial intelligence-driven anomaly detection, and automated incident response mechanisms forms an effective and quantifiable defense strategy for securing PLC/SCADA systems within Industrial Internet of Things (IIoT) environments.”