Search

The industrial internet of things (IIoT) has undergone rapid growth in recent years, which has resulted in an increase in the number of threats targeting both IIoT devices and their connecting technologies. However, deploying tools to counter these threats involves tackling inherent limitations, such as limited processing power, memory, and network bandwidth. As a result, traditional solutions, such as the ones used for desktop computers or servers, cannot be applied directly in the IIoT, and the development of new technologies is essential to overcome this issue. One approach that has shown potential for this new paradigm is the implementation of intrusion detection system (IDS) that rely on machine learning (ML) techniques. These IDSs can be deployed in the industrial control system or even at the edge layer of the IIoT topology. However, one of their drawbacks is that, depending on the factory's specifications, it can be quite challenging to locate sufficient traffic data to train these models. In order to address this problem, this study introduces a novel IDS based on the TabPFN model, which can operate on small datasets of IIoT traffic and protocols, as not in general much traffic is generated in this environment. To assess its efficacy, it is compared against other ML algorithms, such as random forest, XGBoost, and LightGBM, by evaluating each method with different training set sizes and varying numbers of classes to classify. Overall, TabPFN produced the most promising outcomes, with a 10–20% differentiation in each metric. The best performance was observed when working with 1000 training set samples, obtaining an F1 score of 81% for 6-class classification and 72% for 10-class classification. [ABSTRACT FROM AUTHOR]

The openness and interconnectedness of industrial control systems (ICSs) is increasing, leading to a heightened risk of network-based attacks. Although research on industrial intrusion detection is ongoing, current methods often overlook the unique characteristics of industrial control flows. This study introduced an industrial network intrusion detection algorithm based on the improved gray wolf optimizer (IGWO) gated recurrent unit (GRU) model. Starting with the temporal aspects of industrial control network traffic, a simple GRU was chosen as the network model. By integrating the gray wolf optimizer (GWO) with autonomous learning methods, the algorithm could address the slow convergence caused by large volumes of industrial control network traffic. In response to the slow convergence of the GWO and its low optimization accuracy, this study developed the improved gray wolf optimizer (IGWO). By simulating an intrusion detection system (IDS) using datasets from the Natural Gas Pipeline Control System and Secure Water Treatment (SWaT) datasets, the experimental results demonstrated that the IGWO-GRU algorithm exhibited considerable advantages in terms of accuracy, false alarm rate, and false report rate, thereby enhancing the security capabilities of ICSs. [ABSTRACT FROM AUTHOR]

Summary: In industrial process control systems, parameter estimation is crucial for controller design and model analysis. This article examines the issue of identifying parameters in continuous‐time models. This article presents a stochastic gradient estimation algorithm and a recursive least squares estimation algorithm for identifying the parameters of continuous systems. It derives the parameter identification model of linear continuous‐time systems based on the Laplace transforms of the input and output of the systems. To prove that the techniques given here work, we have included a simulated example. [ABSTRACT FROM AUTHOR]

With the rapid development of industry, the risks factories face are increasing. Therefore, the anomaly detection algorithms deployed in factories need to have high accuracy, and they need to be able to promptly discover and locate the specific equipment causing the anomaly to restore the regular operation of the abnormal equipment. However, the neural network models currently deployed in factories cannot effectively capture both temporal features within dimensions and relationship features between dimensions; some algorithms that consider both types of features lack interpretability. Therefore, we propose a high-precision, interpretable anomaly detection algorithm based on variational autoencoder (VAE). We use a multi-scale local weight-sharing convolutional neural network structure to fully extract the temporal features within each dimension of the multi-dimensional time series. Then, we model the features from various aspects through multiple attention heads, extracting the relationship features between dimensions. We map the attention output results to the latent space distribution of the VAE and propose an optimization method to improve the reconstruction performance of the VAE, detecting anomalies through reconstruction errors. Regarding anomaly interpretability, we utilize the VAE probability distribution characteristics, decompose the obtained joint probability density into conditional probabilities on each dimension, and calculate the anomaly score, which provides helpful value for technicians. Experimental results show that our algorithm performed best in terms of F1 score and AUC value. The AUC value for anomaly detection is 0.982, and the F1 score is 0.905, which is 4% higher than the best-performing baseline algorithm, Transformer with a Discriminator for Anomaly Detection (TDAD). It also provides accurate anomaly interpretation capability. [ABSTRACT FROM AUTHOR]

The integration of advanced information and communication technology in smart grids has exposed them to increased cyber attacks. Traditional model-based fault detection systems rely on mathematical models to identify malicious activities but struggle with the complexity of modern systems. This paper explores the application of artificial intelligence, specifically machine learning, to develop fault detection mechanisms that do not depend on these models. We focus on operational technology for fault detection, isolation, and identification (FDII) within smart grids, specifically examining a load frequency control (LFC) system. Our proposed approach uses sensor data to accurately identify threats, demonstrating promising results in simulated environments. [ABSTRACT FROM AUTHOR]

Intrusion detection in industrial control systems (ICS) is crucial for maintaining the security of physical information systems. However, the existing models predominantly rely on black-box approaches, which exhibit limitations in result credibility and the ability to adapt to complex and dynamic environments. Consequently, this paper proposes an online updatable extended belief rule base model (O-EBRB) for intrusion detection in ICS. Firstly, an industrial intrusion detection model rooted in the extended belief rule base (EBRB) is established. This model excels in concurrently processing both quantitative and qualitative data, ensuring the reliability of its outcomes. Subsequently, a novel domain-based rule update methodology for integrating new observation data is proposed. By incorporating or merging fresh data into the original model, it enhances the model's adaptability in dynamic settings. Finally, employing the domain-based rule weight calculation approach, the model continues to effectively compute model parameters even with the continuous expansion of rules. Through extensive experimentation on two real-world industrial intrusion detection datasets, the results demonstrate the effectiveness of the proposed model in handling information and its robust performance in dynamic environments. [ABSTRACT FROM AUTHOR]

The convergence of information and communication technologies has introduced new and advanced capabilities to Industrial Control Systems. However, concurrently, it has heightened their vulnerability to cyber attacks. Consequently, the imperative for new security methods has emerged as a critical need for these organizations to effectively identify and mitigate potential threats. This paper introduces an innovative approach by proposing a dynamic vulnerability severity calculator. Our methodology encompasses the analysis of environmental topology and the effectiveness of deployed security mechanisms, coupled with the utilization of the Common Vulnerability Scoring System framework to adjust detected vulnerabilities based on the specific environment. Moreover, it evaluates the quantity of vulnerabilities and their interdependencies within each asset. Additionally, our approach integrates these factors into a comprehensive Fuzzy Cognitive Map model, incorporating attack paths to holistically assess the overall vulnerability score. To validate the efficacy of our proposed method, we present a relative case study alongside several modified scenarios, demonstrating its effectiveness in practical applications. [ABSTRACT FROM AUTHOR]

Advanced Persistent Threats (APTs) are stealthy, multi-step attacks tailored to a specific target. Often described as 'low and slow', APTs remain undetected until the consequences of the cyber-attack become evident, usually in the form of damage to the physical world, as seen with the Stuxnet attack, or manipulation of an industrial process, as was the case in the Ukraine Power Grid attacks. Given the increasing sophistication and targeted nature of cyber-attacks, especially APTs, this paper delves into the substantial threats APTs pose to critical infrastructures, focusing on power grid substations. Through a detailed case study, we present and explore a 2-stage APT attack on an IEC 61850 power grid substation, employing a Hardware-in-the-Loop (HIL) testbed to simulate real-world conditions. More specifically, this paper discusses two significant experiments conducted to assess vulnerabilities in the control protocols used in IEC 61850 substations: IEC 60870-5-104 and IEC 61850. The integration of findings from these experiments revealed a number of previously undiscussed potential threats to power grid infrastructure that could arise from attacking one or more substations. To better address these potential threats, the paper proposes an extension to the Industrial Control System (ICS) kill chain that explicitly accounts for the consequences of attacks on the physical aspects of Cyber-Physical Systems (CPSs). [ABSTRACT FROM AUTHOR]

Anomaly detection in industrial control and cyber-physical systems has gained much attention over the past years due to the increasing modernisation and exposure of industrial environments. Current dangers to the connected industry include the theft of industrial intellectual property, denial of service, or the compromise of cloud components; all of which might result in a cyber-attack across the operational network. However, most scientific work employs device logs, which necessitate substantial understanding and preprocessing before they can be used in anomaly detection. In this paper, we propose a network intrusion detection system (NIDS) architecture based on a deep autoencoder trained on network flow data, which has the advantage of not requiring prior knowledge of the network topology or its underlying architecture. Experimental results show that the proposed model can detect anomalies, caused by distributed denial of service attacks, providing a high detection rate and low false alarms, outperforming the state-of-the-art and a baseline model in an unsupervised learning environment. Furthermore, the deep autoencoder model can detect abnormal behaviour in legitimate devices after an attack. We also demonstrate the suitability of the proposed NIDS in a real industrial plant from the alimentary sector, analysing the false positive rate and the viability of the data generation, filtering and preprocessing procedure for a near real time scenario. The suggested NIDS architecture is a low-cost solution that uses only fifteen network-based features, requires minimal processing, operates in unsupervised mode, and is straightforward to deploy in real-world scenarios. [ABSTRACT FROM AUTHOR]

Industrial Control Systems are used in a wide variety of industrial facilities, including critical infrastructures, becoming the main target of multiple security attacks. A malicious and successful attack against these infrastructures could cause serious economic and environmental consequences, including the loss of human lives. Static networks configurations and topologies, which characterize Industrial Control Systems, represent an advantage for attackers, allowing them to scan for vulnerable devices or services before carrying out the attack. Identifying active devices and services is often the first step for many attacks. This paper presents a proactive network reconnaissance defense mechanism based on the temporal randomization of network IP addresses, MAC addresses and port numbers. The obtained information distortion minimizes the knowledge acquired by the attackers, hindering any attack that relies on network addressing. The temporal randomization of network attributes is performed in an adaptive way, minimizing the overhead introduced in the network and avoiding any error and latency in communications. The implementation as well as the tests have been carried out in a laboratory with real industrial equipment, demonstrating the effectiveness of the presented solution. [ABSTRACT FROM AUTHOR]

The closed architecture of modern control systems impedes them from further development in the environment of the industrial IoT. The open control system is proposed to tackle this issue. Numerous open control prototypes have been proposed, but they do not reach high openness. According to the definition and criteria of open control systems, this paper suggests that the independence between control tasks and the independence between control tasks and infrastructures are the keys to the open control system under the industrial IoT. Through the control domain's formal description and control task virtualization to deal with the keys, this paper proposes a new method to implement open control systems under the industrial IoT. Specifically, given the hybrid characteristic of the control domain, a hierarchical semantic formal based on an extended finite state machine and a dependency network model with the time property is designed to describe the control domain. Considering the infrastructure's heterogeneity in the industrial IoT, a hybrid virtualization approach based on containers and WebAssembly is designed to virtualize control tasks. The proposed open control system implementation method is illustrated by constructing an open computer numerical control demonstration and compared to current open control prototypes. [ABSTRACT FROM AUTHOR]

Summary: In order to improve the security and reliability of power industry control systems, research proposes the design of intelligent industrial control systems based on digital twins. This design combines the digital twin multilevel reconstruction method to construct an intelligent power control system structure, and proposes a system safety verification range design and evaluation indicators. The experimental data illustrates that the production time of the deep learning digital twin system reconstruction algorithm is 19.1% less than that of the reconstruction algorithm based on differential evolution; and when the number of nodes and the type and number of twins change, the algorithm proposed in the study takes less time and is more in line with the actual needs of the situation. The intelligent power industry control system based on digital twins has a score of no less than 9.5 in four aspects, indicating that the overall effectiveness of the system is good. The results indicate that this method can improve the safety and reliability of the system, ensure the stable operation of the power system, and provide technical support for the widespread application of intelligent power industry control systems. [ABSTRACT FROM AUTHOR]

This paper predicts the network security posture of an ICS, focusing on the reliability of Industrial Control Systems (ICSs). Evidence reasoning (ER) and belief rule base (BRB) techniques are employed to establish an ICS network security posture prediction model, ensuring the secure operation and prediction of the ICS. This model first integrates various information from the ICS to determine its network security posture value. Subsequently, through ER iteration, information fusion occurs and serves as an input for the BRB prediction model, which necessitates initial parameter setting by relevant experts. External factors may influence the experts' predictions; therefore, this paper proposes the Projection Equalization Optimization (P-EO) algorithm. This optimization algorithm updates the initial parameters to enhance the prediction of the ICS network security posture through the model. Finally, industrial datasets are used as experimental data to improve the credibility of the prediction experiments and validate the model's predictive performance in the ICS. Compared with other methods, this paper's prediction model demonstrates a superior prediction accuracy. By further comparing with other algorithms, this paper has a certain advantage when using less historical data to make predictions. [ABSTRACT FROM AUTHOR]

In Industrial Control Systems (ICS), where complex interdependencies abound, cyber incidents can have far-reaching consequences. Dependency modelling, a valuable technique for assessing cyber risks, aims to decipher relationships among variables. However, its effectiveness is often hampered by limited data exposure, hindering the analysis of direct and indirect impacts. We present a unique method that transforms dependency modelling data into a Bayesian Network (BN) structure and leverages causality and reasoning to extract inferences from seemingly unrelated events. Using operational ICS data, we confirm our method enables stakeholders to make better decisions about system security, stability, and reliability. [ABSTRACT FROM AUTHOR]

With the rapid development of Industry 4.0, the importance of cyber security for industrial control systems has become increasingly prominent. The complexity and diversity of industrial control systems result in data with high dimensionality and strong correlation, posing significant challenges in obtaining labeled data. However, current intrusion detection methods often demand large amounts of labeled data for effective training. To address this limitation, this paper proposes a semi-supervised anomaly detection framework, called SFSD, which leverages feature selection and deviation networks to detect anomalies in industrial control systems. Specifically, we introduce a feature selection algorithm (IG-PCA) that utilizes information gain and principal component analysis to reduce the dimensionality of features in industrial control data by eliminating redundant features. Then, we propose a semi-supervised learning method based on an improved deviation network, which utilizes an anomaly scoring network to learn end-to-end anomaly scores for the training data, thus assigning anomaly scores to each training data. Finally, using a limited amount of anomaly-labeled data, we design a specific deviation loss function to optimize the anomaly scoring network, enabling a significant score bias between positive and negative samples. Experimental results demonstrate that the proposed SFSD outperforms existing semi-supervised anomaly detection frameworks by improving the accuracy and detection rate by an average of 1–2%. Moreover, SFSD requires less training time compared to existing frameworks, resulting in a training time reduction of approximately 10% or more. [ABSTRACT FROM AUTHOR]

This research aims to apply Artificial Intelligence (AI) methods, specifically Artificial Immune Systems (AIS), to design an optimal control strategy for a multivariable control plant. Two specific industrial control approaches are investigated: I-PD (Integral-Proportional Derivative) and PI-D (Proportional-Integral Derivative) control. The motivation for using these variations of PID controllers is that they are functionally implemented in modern industrial controllers, where they provide precise process control. The research results in a novel solution to the control synthesis problem for the industrial system. In particular, the research deals with the synthesis of I-P control for a two-loop system in the technological process of a distillation column. This synthesis is carried out using the AIS algorithm, which is the first application of this technique in this specific context. Methodological approaches are proposed to improve the performance of industrial multivariable control systems by effectively using optimization algorithms and establishing modified quality criteria. The numerical performance index ISE justifies the effectiveness of the AIS-based controllers in comparison with conventional PID controllers (ISE1 = 1.865, ISE2 = 1.56). The problem of synthesis of the multi-input multi-output (MIMO) control system is solved, considering the interconnections due to the decoupling procedure. [ABSTRACT FROM AUTHOR]

The digital evolution of Industry 4.0 enabled Operational Technology infrastructures to operate and remotely maintain cyber-physical systems bridging over IP communications. It has also expanded new attack surfaces and steadily increased the number of malicious cyber incidents for the interconnected smart critical systems. Within Industrial Control System (ICS), Programmable Logic Controller plays a crucial function to bridge between cyber and physical environments which made them the victim of sophisticated cyber-attacks that are designed to interrupt and damage their operations. Honeypots have been used as a key tool for aggregating real threat data e.g., malicious activities and payloads, to observe and determine different attack methods and strategies that can easily affect poorly secured cyber-physical systems. In this study, we deployed scalable low-interaction honeypot in Amazon Elastic Compute Cloud (AWS EC2) instance across six different regions to determine the current threat landscape as well as how knowledgeable and ingenious threat actors could be in compromising internet-facing ICS. This work is an extended version of our work published in 14th EAI International Wireless Internet Conference. [ABSTRACT FROM AUTHOR]

With the increasing complexity and cost of industrial control systems and the rapid development of information technology, the tolerance of industrial control equipment to performance degradation, productivity decline, and hidden safety hazards is getting lower and lower. Immediate detection of failures of industrial control equipment is of great significance for the safety of industrial control systems and reducing maintenance costs. Faced with these challenges, the traditional fault diagnosis technology based on expert knowledge has been insufficient to meet the requirements of accuracy and real-time fault diagnosis of industrial control systems due to its high cost and low efficiency. Aiming at the problem that the fault diagnosis method in the current industrial control environment is not systematic, this paper proposes a Safety Fault diagnosis system for industrial intelligent control equipment based on DevOps concept and deep CNN. Based on the in-depth analysis of the principles of CNN, this paper improves the model's robustness from the perspective of data set enhancement, fault diagnosis performance, and noise immunity analysis. Finally, it is proved through experiments that the fault diagnosis model can effectively deal with the lack of fault samples by adopting the fault data set enhancement method based on periodic overlapping sampling. Our fault diagnosis system based on DevOps and CNN proposed in this paper has high scalability and can accurately predict fault input. [ABSTRACT FROM AUTHOR]

Connecting the chemical industry with the academic environment has created a unique opportunity to apply experiential learning in many areas of teaching. A new approach of using the existing operator training simulator, which is basically a digital twin of a new dicyclopentadiene plant, was used to educate and train students from technical universities. Using this simulator, students can gain adequate knowledge for control, process optimization, and problem solving under nonstandard operating conditions. Simulating a dynamic process in the Aspen HYSYS interface along with elements of a real industrial control system and control interface, and especially the online visualization of the results, helps students understand the physicochemical principles through their own intervention and experience of the consequences. The training simulator's ability to accurately reflect ongoing processes can be verified by students during a guided tour of a production plant. The experience with student learning so far shows that this is a very attractive and, above all, effective tool for extending the teaching of chemical engineering, control, and automation of chemical processes. [ABSTRACT FROM AUTHOR]

Recently, advancements in digital twin and extended reality (XR) technologies, along with industrial control systems (ICSs), have driven the transition to Industry 5.0. Digital twins mimic and simulate real-world systems and play a crucial role in various industries. XR provides innovative user experiences through virtual reality (VR), augmented reality (AR), and mixed reality (MR). By integrating digital twin simulations into XR devices, these technologies are utilized in various industrial fields. However, the prevalence of XR devices has increased the exposure to cybersecurity threats in ICS and digital twin environments. Because XR devices are connected to networks, the control and production data they process are at risk of being exposed to cyberattackers. Attackers can infiltrate XR devices through malicious code or hacking attacks to take control of the ICS or digital twin or paralyze the system. Therefore, this study emphasizes the cybersecurity threats in the ecosystem of XR devices used in ICSs and conducts research based on digital forensics. It identifies potentially sensitive data and artifacts in XR devices and proposes secure and reliable security response measures in the Industry 5.0 environment. [ABSTRACT FROM AUTHOR]

Critical infrastructure mainly performs its role through an industrial control system (ICS). Organizations conduct cyber exercises between red and blue teams, focusing on offense and defense. Practical exercises require explicit attack scenarios and corresponding defense strategies. However, systematic guides for deriving cyberattack scenarios or defense strategies still need to be improved. This paper proposes a guide for establishing realistic attack scenarios and defense strategies for cybersecurity exercises in ICS environments. Attack scenario generation is divided into four steps: generating attack references, deriving attack sequences, mapping threat information, and mapping vulnerable implementation patterns. Deriving a defensive strategy consists of two steps parallel to developing an attack scenario: deriving containment and eradication. The methodology we propose guides exercise planning based on a knowledge base, thereby assisting exercise planners in generating various scenarios and deriving clear defense strategies. We showed that a clear exercise plan could be established through a case study. [ABSTRACT FROM AUTHOR]

Cyber-physical systems (CPS) are vital in automating complex tasks across various sectors, yet they face significant vulnerabilities due to the rising threats of cybersecurity attacks. The recent surge in cyber-attacks on critical infrastructure (CI) and industrial control systems (ICSs), with a 150% increase in 2022 affecting over 150 industrial operations, underscores the urgent need for advanced cybersecurity strategies and education. To meet this requirement, we develop a specialised cyber-physical testbed (CPT) tailored for transportation CI, featuring a simplified yet effective automated level-crossing system. This hybrid CPT serves as a cost-effective, high-fidelity, and safe platform to facilitate cybersecurity education and research. High-fidelity networking and low-cost development are achieved by emulating the essential ICS components using single-board computers (SBC) and open-source solutions. The physical implementation of an automated level-crossing visualised the tangible consequences on real-world systems while emphasising their potential impact. The meticulous selection of sensors enhances the CPT, allowing for the demonstration of analogue transduction attacks on this physical implementation. Incorporating wireless access points into the CPT facilitates multi-user engagement and an infrared remote control streamlines the reinitialization effort and time after an attack. The SBCs overwhelm as traffic surges to 12 Mbps, demonstrating the consequences of denial-of-service attacks. Overall, the design offers a cost-effective, open-source, and modular solution that is simple to maintain, provides ample challenges for users, and supports future expansion. [ABSTRACT FROM AUTHOR]

The article deals with the issue of detecting cyberattacks on control algorithms running in a real Programmable Logic Controller (PLC) and controlling a real laboratory control plant. The vulnerability of the widely used Proportional–Integral–Derivative (PID) controller is investigated. Four effective, easy-to-implement, and relatively robust methods for detecting attacks on the control signal, output variable, and parameters of the PID controller are researched. The first method verifies whether the value of the control signal sent to the control plant in the previous step is the actual value generated by the controller. The second method relies on detecting sudden, unusual changes in output variables, taking into account the inertial nature of dynamic plants. In the third method, a copy of the controller parameters is used to detect an attack on the controller's parameters implemented in the PLC. The fourth method uses the golden run in attack detection. [ABSTRACT FROM AUTHOR]

One key role in industrial control systems (ICSs) is known as Programmable Logic Controller (PLC). However, with the development of the Internet of Things (IoT), PLCs have become exposed to an increasing number of attacks, which may cause malfunctions of the whole ICS. Thus, it is necessary to identify potential attacks on PLCs and propose effective solutions to mitigate them. Unfortunately, to date, there have not been significant efforts made to provide a detailed overview of existing works on PLC security. With such a concern in mind, in this paper, we focus on summarising PLC security from different components running at different layers of a PLC architecture. We first review the framework of PLCs; then, we discuss several models when considering PLC security. After that, we provide an overview of existing attacks on PLCs and general solutions to those issues from different perspectives. Lastly, we conclude this paper with an overview of future research areas in PLC security. [ABSTRACT FROM AUTHOR]

With the formation and popularization of the 5G-enabled industrial internet, cybersecurity risks are increasing, and the limited number of attack samples, such as zero-day, leaves a short response time for security protectors, making it substantially more difficult to protect industrial control systems from new types of malicious attacks. Traditional supervised intrusion detection models rely on a large number of samples for training and their performance needs to be improved. Therefore, there is an urgent need for few-shot intrusion detection. Aiming at the above problems, this paper proposes a detection model based on a meta-learning framework, which aims to effectively improve the accuracy and real-time performance of intrusion detection, and designs a meta-learning intrusion detection model containing a sample generation module, a feature mapping module and a feature metric module. Among them, the sample generation module introduces the residual block into the Natural GAN and proposes a new method to generate high-quality antagonistic samples—Res-Natural GAN, which is used to enhance the antagonism of the generated samples and the feature mining degree, to improve the accuracy of malicious traffic detection; the feature mapping module proposes a new attention mechanism, the multi-head fast attention mechanism, which is applied to the encoder structure of the transformer and combined with a parameter optimization algorithm based on particle swarm mutation to shorten the mapping time and improve the real-time performance of the model while mapping the features effectively; the feature metric module proposes a prototype structure based on a prototype storage update algorithm and combines it with a prototype network to achieve correct classification by measuring the Euclidean distance between the detected samples and the class of prototypes, and to shorten the inference time while ensuring the detection accuracy; finally, the three modules are combined to form a real-time meta-learning intrusion detection model. To evaluate the proposed model, five different types of experiments are conducted on multiple public datasets. The experimental results show that the model has higher detection accuracy than the traditional model for both few-shot and zero-shot malicious attacks, and is not only applicable to 5G-enabled industrial internet, but also generalized to different network environments and attack types. [ABSTRACT FROM AUTHOR]

This paper presents a modular hardware control system tailored for industrial applications. The system presented is designed with electrical protection, guaranteeing the reliable operation of its modules in the presence of various field noises and external disturbances. The modular architecture comprises a principal module (mP) and dedicated expansion modules (mEXs). The principal module serves as the network administrator and facilitates interaction with production and control processes. The mEXs are equipped with sensors, conditioning circuits, analog-to-digital converters, and digital signal processing capabilities. The mEX's primary function is to acquire local processing field signals and ensure their reliable transmission to the mP. Two specific mEXs were developed for industrial environments: an electrical signal expansion module (mSE) and the vibration signals expansion module (mSV). The EtherCAT protocol serves as a means of communication between the modules, fostering deterministic and real-time interactions while also simplifying the integration and replacement of modules within the modular architecture. The proposed system incorporates local and distributed processing in which data acquisition, processing, and data analysis are carried out closer to where data are generated. Locally processing the acquired data close to the production in the mEX increases the mP availability and network reliability. For the local processing, feature extraction algorithms were developed on the mEX based on a Fast Fourier Transform (FFT) algorithm and a curve-fitting algorithm that accurately represents a given FFT curve by significantly reducing the amount of data that needs to be transmitted over the mP. The proposed system offers a promising solution to use computational intelligence methodologies and meet the growing need for a modular industrial control system with reliable local data processing to reach a smart industry. The case study of acquiring and processing vibration signals from a real cement ball mill showed a good capacity for processing data and reducing the amount of data. [ABSTRACT FROM AUTHOR]

Nowadays, with the rapid development of industrial Internet technology, on the one hand, advanced industrial control systems (ICS) have improved industrial production efficiency. However, there are more and more cyberattacks targeting industrial control systems. To ensure the security of industrial networks, intrusion detection systems have been widely used in industrial control systems, and deep neural networks have always been an effective method for identifying cyber attacks. Current intrusion detection methods still suffer from low accuracy and a high false alarm rate. Therefore, it is important to build a more efficient intrusion detection model. This paper proposes a hybrid deep learning intrusion detection method based on convolutional neural networks and bidirectional long short-term memory neural networks (CNN-BiLSTM). To address the issue of imbalanced data within the dataset and improve the model's detection capabilities, the Synthetic Minority Over-sampling Technique-Edited Nearest Neighbors (SMOTE-ENN) algorithm is applied in the preprocessing phase. This algorithm is employed to generate synthetic instances for the minority class, simultaneously mitigating the impact of noise in the majority class. This approach aims to create a more equitable distribution of classes, thereby enhancing the model's ability to effectively identify patterns in both minority and majority classes. In the experimental phase, the detection performance of the method is verified using two data sets. Experimental results show that the accuracy rate on the CICIDS-2017 data set reaches 97.7%. On the natural gas pipeline dataset collected by Lan Turnipseed from Mississippi State University in the United States, the accuracy rate also reaches 85.5%. [ABSTRACT FROM AUTHOR]

Industrial control systems (ICSs) are integral to managing and optimizing processes in various industries, including manufacturing, power generation, and more. However, the scarcity of widely adopted ICS datasets hampers research efforts in areas like optimization and security. This scarcity arises due to the substantial cost and technical expertise required to create physical ICS environments. In response to these challenges, this paper presents a groundbreaking approach to generating synthetic ICS data through a data-driven ICS network simulation. We circumvent the need for expensive hardware by recreating the entire ICS environment in software. Moreover, rather than manually replicating the control logic of ICS components, we leverage existing data to autonomously generate control logic. The core of our method involves the stochastic setting of setpoints, which introduces randomness into the generated data. Setpoints serve as target values for controlling the operation of the ICS process. This approach enables us to augment existing ICS datasets and cater to the data requirements of machine learning-based ICS intrusion detection systems and other data-driven applications. Our simulated ICS environment employs virtualized containers to mimic the behavior of real-world PLCs and SCADA systems, while control logic is deduced from publicly available ICS datasets. Setpoints are generated probabilistically to ensure data diversity. Experimental results validate the fidelity of our synthetic data, emphasizing their ability to closely replicate temporal and statistical characteristics of real-world ICS networks. In conclusion, this innovative data-driven ICS network simulation offers a cost-effective and scalable solution for generating synthetic ICS data. It empowers researchers in the field of ICS optimization and security with diverse, realistic datasets, furthering advancements in this critical domain. Future work may involve refining the simulation model and exploring additional applications for synthetic ICS data. [ABSTRACT FROM AUTHOR]

In the Industry 4.0 era of smart grids, the real-world problem of blackouts and cascading failures due to cyberattacks is a significant concern and highly challenging because the existing Intrusion Detection System (IDS) falls behind in handling missing rates, response times, and detection accuracy. Addressing this problem with an early attack detection mechanism with a reduced missing rate and decreased response time is critical. The development of an Intelligent IDS is vital to the mission-critical infrastructure of a smart grid to prevent physical sabotage and processing downtime. This paper aims to develop a robust Anomaly-based IDS using a statistical approach with a machine learning classifier to discriminate cyberattacks from natural faults and man-made events to avoid blackouts and cascading failures. The novel mechanism of a statistical approach with a machine learning (SAML) classifier based on Neighborhood Component Analysis, ExtraTrees, and AdaBoost for feature extraction, bagging, and boosting, respectively, is proposed with optimal hyperparameter tuning for the early discrimination of cyberattacks from natural faults and man-made events. The proposed model is tested using the publicly available Industrial Control Systems Cyber Attack Power System (Triple Class) dataset with a three-bus/two-line transmission system from Mississippi State University and Oak Ridge National Laboratory. Furthermore, the proposed model is evaluated for scalability and generalization using the publicly accessible IEEE 14-bus and 57-bus system datasets of False Data Injection (FDI) attacks. The test results achieved higher detection accuracy, lower missing rates, decreased false alarm rates, and reduced response time compared to the existing approaches. [ABSTRACT FROM AUTHOR]

Several cases of Industrial Internet of Things (IIoT) attacks with zero-day vulnerabilities have been reported. To prevent these attacks, it is necessary to apply an abnormal behavior detection method; however, there are three main problems that make it hard. First, there are various industrial communication protocols. Instead of IT environments, many unstandardized protocols, which are usually defined by vendors, are used. Second, legacy devices are commonly used, not only EOS (End-of-service), but also EoL (End-of-Life). And last, the analysis of collected data is necessary for defining normal behavior. This behavior should be separately defined in each IIoT. Therefore, it is difficult to apply abnormal behavior detection in environments where economic and human investment is difficult. To solve these problems, we propose a deep learning based abnormal behavior detection technique that utilizes IIoT communication patterns. The proposed method uses a deep learning technique to train periodic data acquisition sequences, which is one of the common characteristics of IIoT. The trained model determined the sequence of packet is normal. The proposed technique can be applied without an additional analysis. The proposed method is expected to prevent security threats by proactively detecting cyberattacks. To verify the proposed method, a dataset was collected from the Korea Electric Power Control System. The model that defines normal behavior based on the application layer exhibits an accuracy of 79.6%. The other model, defining normal behavior based on the transport layer, has an accuracy of 80.9%. In these two models, most false positives and false negatives only occur when the abnormal packet is in a sequence. [ABSTRACT FROM AUTHOR]

The growing volume of data, especially in cases of imbalanced datasets, has posed significant challenges in the classification process, particularly when it comes to identifying cyberattacks on industrial control systems (ICS) networks, which have been a source of concern due to the significant destructive impact of viruses such as Slammer, worms, Stuxnet, Duqu, Seismic Net, and Flame on critical infrastructures in various countries. The key challenge is constructing the intrusion detection system (IDS) framework to deal with imbalanced datasets. Many researchers work especially on binary classification, but multi-classification is a more challenging and still active research area. To deal with the multi-class imbalanced classification problem, we outline an instance-based intrusion detection technique named ICS-IDS, for intrusion detection in ICS systems specific to SCADA networks. The developed technique consists of two core components, the data preparation component, and the detection component. The data preparation component uses the normalization, Fisher Discriminant Analysis, and k-neighbor's method to scale the data, reduce the dimensionality, and resample the dataset, respectively. To learn the latent representations and discern harmful vectors from attacked data, the detection/recognition component leverages an efficient instance-based learner. The proposed ICS-IDS model outperforms existing attractive methods in detecting sophisticated attack vectors in ICS data, achieving 99% accuracy and 99% detection rates (DR) on an industrial network dataset. This proves the methodology's practicality for implementing security in real-world ICS networks. [ABSTRACT FROM AUTHOR]

Close Access Cyberspace Operations pose a significant threat to targets that cannot be easily compromised through remote access mechanisms, such as isolated Industrial Control Systems or air gapped classified networks. Despite their importance, close access operations are less common and receive less analysis compared to remote access ones. As a result, most organizations do not adequately consider countermeasures to address these threats. This lack of evaluation and mitigation introduces an underestimated risk. The main contribution of this paper is to provide a comprehensive survey of Close Access Cyberspace Operations and propose a classification approach for them. This survey analyzes close access studies, capabilities and operations, which are associated with classical SIGINT acquisition. Upon examining these elements, our work identifies the relevant entities and features crucial to Close Access Cyberspace Operations. These key entities and features form a comprehensive taxonomy for such operations, enabling organizations to enhance controls and better prevent, detect, and neutralize close access actions. [ABSTRACT FROM AUTHOR]

Organizations face attacks on industrial control systems (ICS) as vulnerabilities are pervasive. However, patching vulnerable systems by simply updating to the newest version is often not an option and shifts focus to workarounds. Beyond pure patching, workarounds specify other remediation measures (e.g., firewall or VPN configuration) that must be taken due to system availability requirements, complexity, or heterogeneous devices. In this paper, we introduce vulnerability playbooks based on open standards. Pushing the envelope of cybersecurity playbooks—steps organizations should follow when responding to cybersecurity incidents reactively—for ICS vulnerability management offers organizations a more transparent, repeatable process and faster, possibly automated actions. We have designed a process model to collect and transform security advisories in Common Security Advisory Framework (CSAF) format and generate Collaborative Automated Course of Action Operations (CACAO) playbooks based on listed remediation advice. With a proof of concept, we demonstrate that structured CSAF documents can be seamlessly transformed into CACAO playbooks. For our industrial use case, we must also use unstructured security advice highlighting quality differences (compared to CSAF). Our generated 79 standard conformant CACAO playbooks with 485 identified actions hint at imbalanced advice toward patching. Preferably, vendors should include detailed technical remediation advice, provide APIs, and go beyond patching recommendations in their security advisories. Subscribers should structure their assets and use machine learning to normalize, generate, and prioritize CACAO playbooks. With CSAF and CACAO, we see two open standards for handling vulnerabilities. [ABSTRACT FROM AUTHOR]

The chopper control system which is synchronized by the White Rabbit timing network is designed and implemented to meet the requirements of the chopper of ion source for the High-Intensity Heavy Ion Accelerator Facility (HIAF). The hardware system consists of timing modulation controller, waveform acquisition, parameter setting, and remote control of the chopper power supply. The software includes low-level drivers and top-level applications which are based on Experimental Physics and Industrial Control System (EPICS). The combination of hardware and software completes the interaction of timing messages with the White Rabbit network, waveform acquisition, the setting of timing modulation parameters in several running modes, and remote control of the chopper power supply, etc. The test results show that the system can achieve timing modulation with a resolution of 8 ns and waveform acquisition of embedded EPICS IOC (input/output controller) at a 125 MHz sample rate. The design, implementation, and test of the chopper control system are described in this paper. [ABSTRACT FROM AUTHOR]

Intrusion detection in industrial control systems (ICS) is crucial for maintaining secu rity in modern industries. However, the rapid growth of data generated from various sources presents significant challenges, as complex and diverse attacks continue to threaten the integrity of these systems. Traditional intrusion detection systems face limitations in effectively detecting intrusions and suffer from processing delays. To address these issues, there is an urgent need for a real-time and efficient IDS. This study introduces a novel approach to real-time intrusion detection in ICS by leveraging Cloud Computing and Big Data techniques for data fusion. By fusing mul tiple streams of data, our approach enhances intrusion detection performance, reduces false alarm rates, and produces more consistent and accurate results. The contributions of this work are two-fold. Firstly, we propose a real-time IDS that overcomes the limitations of traditional systems through the efficient processing capabilities of Cloud Computing and Big Data techniques. Secondly, we employ data fusion to integrate diverse data sources, resulting in improved intrusion detection accuracy and efficiency. Our proposed IDS achieves higher accuracy rates and demonstrates superior efficiency in detecting intrusions compared to existing solutions. These findings underscore the potential of our approach in enhancing ICS security and mitigating risks posed by evolving attacks. [ABSTRACT FROM AUTHOR]

Securing Internet of Things (IoT)-enabled Cyber-Physical Systems (CPSs) can be challenging because security solutions intended for typical IT/OT systems may not be as effective in a CPS setting. The goal of this study is to create a mechanism for identifying and attributing two-level ensemble attacks that are specifically designed for use against Industrial Control Systems (ICSs). An original ensemble deep representation learning model is combined with decision tree algorithm to identify assaults on unbalanced ICS environments at the first level. An attack attribution network, which constitutes a collection of deep neural networks, is formed at the second level. The proposed model is tested using real-world datasets, notably those pertaining to water purification and gas pipelines. The results demonstrate that the proposed strategy outperforms other strategies with comparable computing complexity and that the recommended model outperforms the existing mechanisms. [ABSTRACT FROM AUTHOR]

This study examines the design and long-term implementation of a feedforward and feedback (FF–FB) mechanism in a control system for cement sulfates applied to all types of cement produced in two mills at a production facility. We compared the results with those of a previous controller (SC) that operated in the same unit. The Shewhart charts of the annual SO3 mean values and the nonparametric Mann–Whitney test demonstrate that, for the FF–FB controller, the mean values more effectively approach the SO3 target than the older controller in two out of the three cement types. The s-charts for the annual standard deviation of all cement types and mills indicate that the ratio of the central lines of FF–FB to SC ranges from 0.39 to 0.59, representing a significant improvement. The application of the error propagation technique validates and explains these improvements. The effectiveness of the installed system is due to two main factors. The feedforward (FF) component tracks the set point of SO3 when the mill begins grinding a different type of cement, while the feedback (FB) component effectively attenuates the fluctuations in the sulfates of the raw materials. [ABSTRACT FROM AUTHOR]

Industrial control systems are often used to assist and manage an industrial operation. These systems' weaknesses in the various hierarchical structures of the system components and communication backbones make them vulnerable to cyberattacks that jeopardize their security. In this paper, the security of these systems is studied by employing a reinforcement learning extended attack graph to efficiently reveal the subsystems' flaws. Specifically, an attack graph that mimics the environment is constructed for the system using the state–action–reward–state–action technique, in which the agent is regarded as the attacker. Attackers may cause the greatest amount of system damage with the fewest possible actions if they have the highest cumulative reward. The worst-case assault scheme with a total reward of 42.9 was successfully shown in the results, and the most badly affected subsystems were recognized. [ABSTRACT FROM AUTHOR]

As industrialization and informatization becomemore deeply intertwined, industrial control networks have entered an era of intelligence. The connection between industrial control networks and the external internet is becoming increasingly close, which leads to frequent security accidents. This paper proposes a model for the industrial control network. It includes a malware containment strategy that integrates intrusion detection, quarantine, and monitoring. Basedonthismodel, the role of keynodes in the spreadofmalware is studied, a comparisonexperiment is conducted to validate the impact of the containment strategy. In addition, the dynamic behavior of the model is analyzed, the basic reproduction number is computed, and the disease-free and endemic equilibrium of the model is also obtained by the basic reproduction number. Moreover, through simulation experiments, the effectiveness of the containment strategy is validated, the influence of the relevant parameters is analyzed, and the containment strategy is optimized. In otherwords, selective immunity to key nodes can effectively suppress the spread of malware andmaintain the stability of industrial control systems. The earlier the immunization of key nodes, the better. Once the time exceeds the threshold, immunizing key nodes is almost ineffective. The analysis provides a better way to contain the malware in the industrial control network. [ABSTRACT FROM AUTHOR]

The advent of the Internet of Things brought a new age of interconnected device functionality, ranging from personal devices and smart houses to industrial control systems. However, increased security risks have emerged in its wake, in particular self-replicating malware that exploits weak device security. Studies modeling malware epidemics aim to predict malware behavior in essential ways, usually assuming a number of simplifications, but they invariably simplify the single most important subdynamics of malware: random propagation. In our previous work, we derived and presented the first exact mathematical model of random propagation, defined as the subdynamics of propagation of a malware model. The propagation dynamics were derived for the SIS model in discrete form. In this work, we generalize the methodology of derivation and extend it to any Markov chain model of malware based on random propagation. We also propose a second method of derivation based on modifying the simplest form of the model and adjusting it for more complex models. We validated the two methodologies on three malware models, using simulations to confirm the exactness of the propagation dynamics. Stochastic errors of less than 0.2% were found in all simulations. In comparison, the standard nonlinear model of propagation (present in ∼95% of studies) has an average error of 5% and a maximum of 9.88% against simulations. Moreover, our model has a low mathematical trade-off of only two additional operations, being a proper substitute to the standard literature model whenever the dynamical equations are solved numerically. [ABSTRACT FROM AUTHOR]

Once industrial control systems are targeted by cyber-attacks, the consequences can be severe, including asset loss, environmental pollution, and public security risks. Risk assessment is an important way to ensure that industrial control systems operate efficiently, steadily and safely. The purpose of this paper is to develop a risk assessment model for industrial control systems based on asymmetric connection cloud and Choquet integral, which fully takes into account the fact that values of risk indicators are often fuzzy, random, asymmetrically distributed in finite intervals, and there are interactions among different indicators. To do so, we first establish a risk assessment index system to ensure the full reflection of availability, integrity, and confidentiality in the results of risk assessment for industrial control systems. Then we establish classification standards for each evaluation indicator based on the importance of assets, vulnerabilities, and threats in evaluating the risk of industrial control systems. Next we develop a risk assessment model based on asymmetric connection cloud and Choquet integral to determine the risk level of industrial control systems. In the following, an example is provided to demonstrate the feasibility and reliability of this proposed model. The experimental results have demonstrated a high level of credibility in assessing cyber-attacks by the proposed model, indicating its potential for analyzing the current security and risk posture of industrial control systems. [ABSTRACT FROM AUTHOR]

Time series anomaly detection is very important to ensure the security of industrial control systems (ICSs). Many algorithms have performed well in anomaly detection. However, the performance of most of these algorithms decreases sharply with the increase in feature dimension. This paper proposes an anomaly detection scheme based on Graph Attention Network (GAT) and Informer. GAT learns sequential characteristics effectively, and Informer performs excellently in long time series prediction. In addition, long-time forecasting loss and short-time forecasting loss are used to detect multivariate time series anomalies. Short-time forecasting is used to predict the next time value, and long-time forecasting is employed to assist the short-time prediction. We conduct a large number of experiments on industrial control system datasets SWaT and WADI. Compared with most advanced methods, we achieve competitive results, especially on higher-dimensional datasets. Moreover, the proposed method can accurately locate anomalies and realize interpretability. [ABSTRACT FROM AUTHOR]

With the advent of Industry 4.0, industrial control systems (ICS) are more and more closely connected with the Internet, leading to a rapid increase in the types and quantities of security threats that arise from ICS. Anomaly detection is an effective defense measure against attacks. At present, it is the main trend to use hybrid deep learning methods to realize ICS anomaly detection. However, we found that many ICS anomaly detection methods based on hybrid deep learning adopt phased learning, in which each phase is optimized separately with optimization goals deviating from the overall goal. In view of this issue, we propose an end-to-end anomaly detection method SAKMR based on hybrid deep learning. Our method uses radial basis function network (RBFN) to realize K-means clustering, and combines it with stacked auto-encoder (SAE), which is conducive to defining reconstruction error and clustering error into an objective function to ensure joint optimization of feature extraction and classification. Experiments were conducted on the commonly used KDDCUP99 and SWAT datasets. The results show that SAKMR is effective in detecting abnormal industrial control data and outperforms the baseline methods on multiple performance indicators such as F1-Measure. [ABSTRACT FROM AUTHOR]

Mass customization, small batch sizes, high variability of product types and a changing product portfolio during the life cycle of an industrial plant are current trends in the industry. Due to an increasing decoupling of the development of software and hardware components in an industrial context, compatibility problems within industrial control systems arise more and more frequently. In this publication, a strategy concept for compatibility testing is derived and discussed by means of a literature review and applied research. This four-phase strategy concept identifies incompatibilities between software and hardware components in the industrial control environment and enables test engineers to detect problems at an early stage. By automating the compatibility test on an external I-PC, the test can be run both when new software is installed on the industrial controller and when the controller is restarted. Thus, changes to the components are constantly detected and incompatibilities are avoided. Furthermore, early incompatibility detection can ensure that a system remains permanently operational. Based on a discussion, additional strategies are identified to consolidate the robustness and applicability of the presented concept. [ABSTRACT FROM AUTHOR]

A fuzzy RBF-PID control strategy based on particle swarm optimization (PSO) algorithm is proposed to solve the problem of large inertia lag in temperature control system of industrial production refuse furnace. In this control system, an improved particle swarm optimization algorithm combined with inertia weight and genetic transformation was used to optimize the initial values of membership functions of fuzzy RBF (radial basis function). Then, BP (error backpropagation) algorithm is used for fine tuning, and fuzzy reasoning and RBF learning ability are combined to adjust the PID control parameters online to achieve the optimal PID control effect. The simulation results show that the algorithm has fast tracking, small overshoot, and is not easily trapped in local minima. At the same time, its robustness and anti-interference performance are better than traditional PID control. [ABSTRACT FROM AUTHOR]

With the wide use of Cyber-Physical Systems (CPS) in many applications, targets of advanced persistent threats (APTs) have been extended to the IoT and industrial control systems. Provenance graph analysis based on system audit logs has become a promising way for APT detection and investigation. However, we cannot afford to ignore that existing provenance-based APT detection systems lack the process–context information at system runtime, which seriously limits detection performance. In this paper, we proposed ConGraph, an approach for detecting APT attacks using provenance graphs combined with process context; we presented a module for collecting process context to detect APT attacks. This module collects file access behavior, network access behavior, and interactive relationship features of processes to enrich semantic information of the provenance graph. It was the first time that the provenance graph was combined with multiple process–context information to improve the detection performance of APT attacks. ConGraph extracts process activity features from the provenance graphs and submits the features to a CNN-BiLSTM model to detect underlying APT activities. Compared to some state-of-the-art models, our model raised the average precision rate, recall rate, and F-1 score by 13.12%, 25.61%, and 24.28%, respectively. [ABSTRACT FROM AUTHOR]

Industrial Control Systems (ICSs) have become the cornerstone of critical sectors like energy, transportation, and manufacturing. However, the burgeoning interconnectivity of ICSs has also introduced heightened risks from cyber threats. The urgency for robust ICS security validation has never been more pronounced. This paper provides an in-depth exploration of using the MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework to validate ICS security. Although originally conceived for enterprise Information Technology (IT), the MITRE ATT&CK framework's adaptability makes it uniquely suited to address ICS-specific security challenges, offering a methodological approach to identifying vulnerabilities and bolstering defence mechanisms. By zeroing in on two pivotal attack scenarios within ICSs and harnessing a suite of security tools, this research identifies potential weak points and proposes solutions to rectify them. Delving into Indicators of Compromise (IOCs), investigating suitable tools, and capturing indicators, this study serves as a critical resource for organisations aiming to fortify their ICS security. Through this lens, we offer tangible recommendations and insights, pushing the envelope in the domain of ICS security validation. [ABSTRACT FROM AUTHOR]

This research addresses the dearth of real-world data required for effective neural network model building, delving into the crucial field of industrial control and automation system (ICS) cybersecurity. Cyberattacks against ICS are first identified and then generated in an effort to raise awareness of vulnerabilities and improve security. This research aims to fill a need in the existing literature by examining the effectiveness of a novel approach to ICS cybersecurity that draws on data from real industrial settings. Real-world data from a variety of commercial sectors is used in this study to produce a complete dataset. These sectors include power systems, freshwater tanks, and gas pipelines, which together provide a wide range of commercial scenarios where anomaly detection and attack classification approaches are critical. The generated data are shown to considerably improve the models' precision. An amazing 71% accuracy rate is achieved in power system models, and incorporating generated data reliably increases network speed. Using generated data, the machine learning system achieves an impressive 99% accuracy in a number of trials. In addition, the system shows about 90% accuracy in most studies when applied to the setting of gas pipelines. In conclusion, this article stresses the need to improve cybersecurity in vital industrial sectors by addressing the dearth of real-world ICS data. To better understand and defend against cyberattacks on industrial machinery and automation systems, it demonstrates how generative data can improve the precision and dependability of neural network models. [ABSTRACT FROM AUTHOR]