Mitigating Cyber Threats in Critical Infrastructure: A Machine Learning Approach

Abstract

Critical infrastructure (CI) sectors face escalating cyber threats targeting Industrial Control Systems (ICS), SCADA and IIoT devices  as demonstrated by Colonial Pipeline (2021) and Stuxnet (2010) attacks causing billions in damages. Traditional signature based defenses fail against zero day APTs and exhibit 90% false positive rates unacceptable for 24/7 OT operations. This research proposes a novel Federated Learning (FL) anomaly detection and Reinforcement Learning (RL) remediation framework achieving 97.4% F1 score and 68% MTTR reduction across SWaT, CIC-IDS2018, BATADAL, and MS-SCADA datasets. XGBoost ensembles detected 94% novel attacks with 0.8% FAR and 7.2ms TTD, while FedAvg+DP converged in 45 rounds reducing privacy leakage 71% under non IID conditions. SAC RL automation reduced response times from 284 to 91 minutes via intelligent network segmentation. Edge deployment on Jetson AGX achieved 4.1ms inference suitable for air gapped PLCs. Contributions include Dockerized air gapped toolkit, STRIDE to ATT&CK mapping, FL interoperability blueprint, and $47M annual utility cost savings projection, establishing industrial grade ML readiness for multi sector CI cybersecurity.