Researchers Develop AI Agent to Defend Critical Infrastructure by Simulating Reboots
A new defense agent for industrial control systems uses machine learning to analyze network traffic and automatically trigger system resets to thwart cyberattacks.
Researchers at KTH Royal Institute of Technology have developed an innovative defense agent designed to protect critical infrastructure by analyzing network traffic and making automated intervention decisions. The agent was trained using data from a simulated, segmented industrial network that was subjected to repeated attacks over a two-week period. By observing packet counts between network segments and individual machines, the agent infers the progression of an intruder and can decide to initiate automated responses, such as a system reboot.
The agent's decision-making process is based on six key metrics per interval: packet counts crossing network segments and moving to and from individual machines. This data allows it to estimate the attacker's progress and determine the most appropriate action. The available interventions range from doing nothing, to resetting specific supervisory hosts or water tank processes, to a full reset of all hosts in the supervisory and control subnets. A reset operation involves rebooting the target system, renewing its credentials, and assigning it a new IP address, which can cause brief interruptions to industrial operations.
This approach addresses a common limitation in existing research, which often assumes direct visibility into the system state or the attacker's actions. The KTH researchers deem this assumption unrealistic for operational environments. Their work models partial observability by measuring traffic variations in relation to attacker actions, rather than requiring full system state awareness. The training process involved collecting data over 40,000 30-second intervals, acknowledging that a more comprehensive model would require significantly more data.
The best-performing agent among those trained by the researchers maintained approximately 500 running hypotheses about the network's state. It updated these hypotheses every interval and fed a compressed version to its decision-making policy. This agent outperformed others that were fed raw observation history and nearly matched a baseline agent that had full visibility into the system state. Interestingly, providing the policy with more historical data (four intervals instead of one) degraded its performance.
A critical aspect of the agent's operation involves its internal model of how the system evolves, which includes a representation of adversary behavior. The agent that achieved performance closest to the full-visibility baseline was operating with a model that described the specific adversary it was defending against. This highlights the importance of threat intelligence and adversary modeling in the effectiveness of such automated defense systems.
The test network used for the research comprised three supervisory hosts, two PLCs, and two tanks, with HMIs running HTTP and an engineering workstation exposed via SSH, Telnet, and SMB. The researchers noted that the model's generalizability to different network configurations or attack types was not studied. However, the core concept of belief tracking—maintaining a probability distribution over the intrusion's progression on each asset—is transferable. This probability distribution, weighted by potential costs, could be visualized on a console without requiring reinforcement learning.
The researchers have made their implementation publicly available and plan to test the approach on a real-world industrial testbed. They acknowledge that operational safety is a key consideration for future work, as it imposes constraints on the defender's allowed actions. This research represents a significant step towards more autonomous and adaptive cybersecurity defenses for critical infrastructure.