Optimal Machine Learning Enabled Intrusion Detection in Cyber-Physical System Environment

Cyber physical system (CPS) is a network of cyber and physical elements, which interact with one another in a feedback form. CPS approves critical infrastructure and is treated as essential in day to day since it forms the basis of futuristic smart devices. An increased usage of CPSs poses security as a challenging issue and intrusion detection systems (IDS) can be applied for the identification of network intrusions. The latest advancements in the field of artificial intelligence (AI) and deep learning (DL) enables to design effective IDS models for the CPS environment. At the same time, metaheuristic algorithms can be employed as a feature selection approach in order to reduce the curse of dimensionality. With this motivation, this study develops a novel Poor and Rich Optimization with Deep Learning Model for Blockchain Enabled Intrusion Detection in CPS Environment, called PRO-DLBIDCPS technique. The proposed PRO-DLBIDCPS technique initially introduces an Adaptive Harmony Search Algorithm (AHSA) based feature selection technique for proper selection of feature subsets. For intrusion detection and classification, and attention based bi-directional gated recurrent neural network (ABi-GRNN) model is applied. In addition, the detection efficiency of the ABi-GRNN technique has been enhanced by the use of Poor and rich optimization (PRO) algorithm based hyperparameter optimizer, which resulted in enhanced intrusion detection results. Furthermore, blockchain technology is applied for enhancing security in the CPS environment. In order to demonstrate the enhanced outcomes of the PRO-DLBIDCPS technique, a wide range of simulations was carried out on benchmark dataset and the results reported the better outcomes of the PRO-DLBIDCPS technique in terms of several measures.

Cyber-physical systems (CPSs) unite the computation with physical methods. Embedded networks and computers observe and handle the physical procedures, generally with feedback encircles whereas physical procedures affect computation and conversely. In the last decade, the prompt growth of network-associated services has formed confidential information on the Internet. However, networks are much inclined to intrusions wherever unapproved consumers try to retrieve confidential data and even disturb the systems. Constructing a proficient network intrusion detection system (IDS) can be essential to avert these attacks. Utilizing digital twin technology enhances the IDS of physical devices in CPSs. IDSs normally utilize machine learning (ML) techniques for categorizing the attacks. However, the features employed for classifications are not appropriate or adequate all the time. Moreover, the amount of intrusions can be significantly lower than the amount of non-intrusions. Therefore, simple techniques may fail to deliver satisfactory performances owing to this class imbalance. In this study, we offer a Metaheuristic-Driven Hybrid Deep Learning Model for Robust Intrusion Detection in Secure Cyber-Physical Systems (MHDLM-RIDCPS) model in Smart City Environment. The proposed MHDLM-RIDCPS technique primarily targets the classification and recognition of intrusions using digital twin technology to enhance security within the CPS. Primarily, the proposed MHDLM-RIDCPS approach utilizes min-max normalization for transforming an input data into a standardized format. To alleviate dimensionality issues, the coyote optimization algorithm (COA) can be executed to select a subset of features. In addition, the modified prairie dog optimizer (mPDO) combined with a convolutional neural network and bi-directional long short-term memory with attention mechanism (AM-CNN+BiLSTM) classifier is exploited for the identification of intrusions. The design of the mPDO system primarily concentrates on the parameter optimizer of the AM-CNN+BiLSTM algorithm and so improves the classifier performances. To determine the greater efficiency of the MHDLM-RIDCPS system, a comprehensive set of simulations can be applied and the performances are tested over distinct aspects. The experimental analysis guaranteed the superior results of the MHDLM-RIDCPS methodology with existing methods

The load model and its parameters have great effect on the accuracy of power system simulation. This paper proposed a method of real-timely collecting load data based on intelligent measuring equipment, charring out the bottom-up accurate modeling of power load under cyber physical system (CPS) environment. Using intelligent measuring equipment as online measurement and identification device, identified load model on different voltage levels based on online load data, and established the aggregated load model using the weighting-mean method based on the capacity. Finally, considering the distribution system parameter, established the integrated load model of 220/110kV bus by gradually converting. Proposed method can realize real-time dynamical update of power load model, and improve the accuracy of power system simulation. Simulation indicated that the load model obtained by proposed method can better reflect the load dynamic characteristics compared to the traditional overall identification method.

Recently, with the growth of cyber physical systems (CPS), several applications have begun to deploy in the CPS for connecting the cyber space with the physical scale effectively. Besides, the cloud computing (CC) enabled CPS offers huge processing and storage resources for CPS that finds helpful for a range of application areas. At the same time, with the massive development of applications that exist in the CPS environment, the energy utilization of the cloud enabled CPS has gained significant interest. For improving the energy effectiveness of the CC platform, virtualization technologies have been employed for resource management and the applications are executed via virtual machines (VMs). Since effective scheduling of resources acts as an important role in the design of cloud enabled CPS, this paper focuses on the design of chaotic sandpiper optimization based VM scheduling (CSPO-VMS) technique for energy efficient CPS. The CSPO-VMS technique is utilized for searching for the optimum VM migration solution and it helps to choose an effective scheduling strategy. The CSPO algorithm integrates the concepts of traditional SPO algorithm with the chaos theory, which substitutes the main parameter and combines it with the chaos. In order to improve the process of determining the global optimum solutions and convergence rate of the SPO algorithm, the chaotic concept is included in the SPO algorithm. The CSPO-VMS technique also derives a fitness function to choose optimal scheduling strategy in the CPS environment. In order to demonstrate the enhanced performance of the CSPO-VMS technique, a wide range of simulations were carried out and the results are examined under varying aspects. The simulation results ensured the improved performance of the CSPO-VMS technique over the recent methods interms of different measures.

Cyber-Physical Systems (CPS) are increasingly deployed across sectors such as energy, manufacturing, and healthcare, where real-time monitoring and secure operations are essential. As these systems become targets for sophisticated cyber threats, the need for accurate, low-latency intrusion detection has become critical. While many studies have proposed AI-based solutions for securing CPS, there remains a lack of systematic benchmarking across diverse datasets and attack scenarios.This paper presents a dataset-driven benchmarking study of machine learning and deep learning-based Intrusion Detection Systems (IDS) tailored for CPS environments. Using publicly available CPS-related datasets—including UNSW-NB15, CICIDS2017, BATADAL, and the ICS-Cyber Attack Dataset—we evaluate the performance of Support Vector Machines (SVM), Random Forest (RF), Long Short-Term Memory (LSTM) networks, and a proposed Hybrid AI model. Evaluation metrics include accuracy, precision, recall, F1-score, and false positive rate, providing a holistic view of each model's effectiveness. Results indicate that while traditional models like RF and SVM offer faster inference times, deep learning models such as LSTM consistently outperform in terms of detection accuracy and false positive reduction. The Hybrid AI model demonstrates a balanced trade-off between performance and efficiency, making it a promising approach for real-world CPS deployments. This benchmarking effort serves as a foundation for selecting and optimizing IDS solutions in CPS, highlighting the importance of aligning detection models with dataset characteristics and operational constraints.

Cyber Physical Systems (CPS) are redefining modern engineering practices by bringing the computational systems together with physical processes, boosting efficiency, security, and sustainability in different industries. This research highlights the influence of CPS in different sectors: its power to facilitate realtime decision making, predictive maintenance, and cybersecurity issues. The context in which this study occurs is to the application of digital twin technology in CPS — which is physical systems’ simulation for performance optimization and downtime reduction. The research includes the analysis of the efficiency of cybersecurity measures applied in CPS environment, the identification of vulnerabilities, and the suggestions of solutions for the mitigation of a cyber threat. Digital twins and predictive maintenance appears to improve the system performance by 30%, reduces the downtime by 25% due to application. Moreover, the research addresses upcoming concerns of sustainable practices in CPS and emerging technologies such as Industry 4.0 that promote resource optimization and waste reduction. The results show that CPS can improve both the operational efficiency and the environmental sustainability by enabling a smarter resource management. This work advances our understanding of trends, challenges and future directions in CPS as a means to inform engineering management practices, which are enabled by CPS.

Optimizing ICPS attack detection deep learning models is still a challenging undertaking that calls for precise a hyperparameter adjustment. The proliferation of cyber threats necessitates robust intrusion detection technologies to fortify industrial cyber-physical systems (ICPS). The XIDS structure, developed for use in ICPS, is an improved intrusion detection system that employs Bayesian optimization methods to fine-tune the deep-learning parameters, ensemble-based filter feature selection techniques (EFFS), and explainable artificial intelligence (XAI). Combining AI that is explicable with the XAI-EKHO-FS technique, the proposed model aims to discover which attributes are critical for intrusion detection. Shapley Additive Explanations (SHAP) could potentially utilize when investigating the ways in which different variables impact the outcomes and comprehension that are anticipated. Making intrusion detection more visible, comprehensible, and flexible is just one additional way this technology improves industrial IT safety. Also, this research recommends a hybrid deep learning technique called BO-GRULSTM for precise intrusion categorization as a way to improve the performance of intrusion detection systems (IDS). To fine-tune the GRU-LSTM networks’ extremes variables, the Bayesian optimising method was used. The proposed BO-GRU-LSTM method achieves an outstanding $99.42 \%$ accuracy, surpassing GRU, LSTM, and BILSTM. Comparing this to the more antiquated GRU, LSTM, and BI-LSTM algorithms is like looking at a mountain.

Chapter 5 - Intrusion Prevention and Detection Systems

A rapid increase in the instances of cyberattacks has been observed with the expanding digitization. This leads to an urgent and critical need for developing robust intrusion detection systems (IDS) which can identify the occurrences of malicious activities within the network traffic. The present work proposes a novel, explainable, multilayer, lightweight adaptive IDS based on a Recurrent Neural Network (RNN). The purpose of this proposed IDS is to improve threat detection capabilities, especially low frequency high severe attack. The performance of the proposed IDS is evaluated using the UNR-IDD dataset. The network traffic is classified into normal and attack categories to assess the effectiveness of the proposed IDS. Two separate IDS models are developed. Model A is used to detect attacks on the basis of the frequency of the attacks, and Model B detects threats based on the severity of the attacks. Through the layered approach, the overall detection accuracy of 95.7% is achieved in Model A, and 97.5% is obtained in Model B. The present work highlights that the proposed IDS shows a remarkable improvement in the detection of less frequent severe attacks in comparison to existing IDS. The comparative result analysis of RNN-based IDS with Machine Learning models such as LR, Naïve Bayes, Cat Boost, Random Forest and Multilayer Perceptron models shows RNN-based IDS has outperformed the Machine Learning models. Explainable AI (XAI), the SHAP method is used for better interpretation of the proposed decisions. XAI helps to identify the network traffic that can influence predictions and detect potential biases. It also helps researchers and practitioners to validate model behaviour and establish trust in the system’s outputs.

Cyber-Physical Systems (CPS) are increasingly deployed in critical infrastructure yet remain vulnerable to adversarial attacks that manipulate sensor data to mislead AI-based decision-making. These threats demand not only high-accuracy detection but also transparency in model reasoning. This study proposes a Hybrid Explainable AI (XAI) Framework that integrates Convolutional Neural Networks (CNN), SHAP-based feature interpretation, and rule-based reasoning to detect adversarial inputs in CPS environments. The framework is tested on two simulation scenarios: industrial sensor networks and autonomous traffic sign recognition. Using datasets of 10,000 samples (50% adversarial via FGSM and PGD), the model achieved an accuracy of 97.25%, precision of 96.80%, recall of 95.90%, and F1-score of 96.35%. SHAP visualizations effectively distinguished between normal and adversarial inputs, and the added explainability module increased inference time by only 8.5% over the baseline CNN (from 18.5 ms to 20.1 ms), making it suitable for real-time CPS deployment. Compared to prior methods (e.g., CNN + Grad-CAM, Random Forest + LIME), the proposed hybrid framework demonstrates superior performance and interpretability. The novelty of this work lies in its tri-level integration of predictive accuracy, explainability, and rule-based logic within a single real-time detection system—an approach not previously applied in CPS adversarial defense. This research contributes toward trustworthy AI systems that are robust, explainable, and secure by design.

Cyber-Physical System (CPS) involves the combination of physical processes with computation and communication systems. The recent advancements made in cloud computing, Wireless Sensor Network (WSN), healthcare sensors, etc. tend to develop CPS as a proficient model for healthcare applications especially, home patient care. Though several techniques have been proposed earlier related to CPS structures, only a handful of studies has focused on the design of CPS models for health care sector. So, the proposal for a dedicated CPS model for healthcare sector necessitates a significant interest to ensure data privacy. To overcome the challenges, the current research paper designs a Deep Learning-based Intrusion Detection and Image Classification for Secure CPS (DLIDIC-SCPS) model for healthcare sector. The aim of the proposed DLIDIC-SCPS model is to achieve secure image transmission and image classification process for CPS in healthcare sector. Primarily, data acquisition takes place with the help of sensors and detection of intrusions is performed using Fuzzy Deep Neural Network (FDNN) technique. Besides, Multiple Share Creation (MSC) approach is used to create several shares of medical image so as to accomplish security. Also, blockchain is employed as a distributed data storage entity to create a ledger that provides access to the client. For image classification, Inception v3 with Fuzzy Wavelet Neural Network (FWNN) is utilized that diagnose the disease from the applied medical image. Finally, Salp Swarm Algorithm (SSA) is utilized to fine tune the parameters involved in WNN model, thereby boosting its classification performance. A wide range of simulations was carried out to highlight the superiority of the proposed DLIDIC-SCPS technique. The simulation outcomes confirm that DLIDIC-SCPS approach demonstrates promising results in terms of security, privacy, and image classification outcomes over recent state-of-the-art techniques.

The novelty and growing sophistication of cyber threats mean that high accuracy and interpretable machine learning models are needed more than ever before for Intrusion Detection and Prevention Systems. This study aims to solve this challenge by applying Explainable AI techniques, including Shapley Additive explanations feature selection, to improve model performance, robustness, and transparency. The method systematically employs different classifiers and proposes a new hybrid method called Hybrid Bagging-Boosting and Boosting on Residuals. Then, performance is taken in four steps: the multistep evaluation of hybrid ensemble learning methods for binary classification and fine-tuning of performance; feature selection using Shapley Additive explanations values retraining the hybrid model for better performance and reducing overfitting; the generalization of the proposed model for multiclass classification; and the evaluation using standard information metrics such as accuracy, precision, recall, and F1-score. Key results indicate that the proposed methods outperform state-of-the-art algorithms, achieving a peak accuracy of 98.47% and an F1 score of 96.19%. These improvements stem from advanced feature selection and resampling techniques, enhancing model accuracy and balancing precision and recall. Integrating Shapley Additive explanations-based feature selection with hybrid ensemble methods significantly boosts the predictive and explanatory power of Intrusion Detection and Prevention Systems, addressing common pitfalls in traditional cybersecurity models. This study paves the way for further research on statistical innovations to enhance Intrusion Detection and Prevention Systems performance.

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

IntroductionThe increasing complexity of cyber-physical systems (CPS) demands robust and efficient action recognition frameworks capable of seamlessly integrating multi-modal data. Traditional methods often lack adaptability and perform poorly when integrating diverse information sources, such as spatial and temporal cues from diverse image sources.MethodsTo address these limitations, we propose a novel Multi-Scale Attention-Guided Fusion Network (MSAF-Net), which leverages advanced image fusion techniques to significantly enhance action recognition performance in CPS environments. Our approach capitalizes on multi-scale feature extraction and attention mechanisms to dynamically adjust the contributions from multiple modalities, ensuring optimal preservation of both structural and textural information. Unlike conventional spatial or transform-domain fusion methods, MSAF-Net integrates adaptive weighting schemes and perceptual consistency measures, effectively mitigating challenges such as over-smoothing, noise sensitivity, and poor generalization to unseen scenarios.ResultThe model is designed to handle the dynamic and evolving nature of CPS data, making it particularly suitable for applications such as surveillance, autonomous systems, and human-computer interaction. Extensive experimental evaluations demonstrate that our approach not only outperforms state-of-the-art benchmarks in terms of accuracy and robustness but also exhibits superior scalability across diverse CPS contexts.DiscussionThis work marks a significant advancement in multi-modal action recognition, paving the way for more intelligent, adaptable, and resilient CPS frameworks. MSAF-Net has strong potential for application in medical imaging, particularly in multi-modal diagnostic tasks such as combining MRI, CT, or PET scans to enhance lesion detection and image clarity, which is essential in clinical decision-making.

In today digital infrastructure, cloud computing now takes center stage and ensures strong security is a priority, especially against advanced cyberattacks that operate on dynamic and multi-tenant infrastructures. Established intrusion detection systems (IDS) cannot satisfy the needs of cloud ecosystems because of the scalability and lack of flexibility. The paper provides a high-level overview of AI and ML by conducting a thorough survey of their applications in enhancing IDS for cloud security. This paper discusses ways to extend intrusion detection capabilities through the integration of Artificial Intelligence (AI) and Machine Learning (ML), and presents research into a cloud-based IDS transformation. The ability to detect zero-day threats, adapt to trends in real-time data, and improve detection accuracy are three key features shared by supervised, unsupervised, and hybrid learning models, as validated by a comprehensive analysis. The research compares the results of the application of the demanding models of IDS XGBoost, MLP, LSTM, and CNN+LSTM applied to various datasets, demonstrating the highest rates of precision, recalls, and F1-score. Besides, emerging topics such as federated learning, explainable AI, and adversarial resilience are discussed in a literature review; the main gaps in research are found. The results support the necessity of scalable, explainable, and privacy-preserving frameworks of IDS in cloud and IoT systems. Smart, flexible, and reliable security solutions for today's cloud infrastructures are a hot topic, and this study adds to the existing literature on the subject.