aiqbench analysis
This research applies Partially Observable Markov Decision Processes (POMDP) and Proximal Policy Optimization (PPO) to automate intrusion response strategies for Operational Technology systems. By leveraging traffic measurements to model partial observability, the study demonstrates effective learning-based defenses against various MITRE attacks in an emulated industrial environment. The work bridges critical infrastructure security with advanced reinforcement learning techniques, offering a tractable framework for real-time threat mitigation.
Learning Intrusion Response Strategies for OT Systems
arXiv:2609.10298v1 Announce Type: cross Abstract: Cyberattacks against Operational Technology (OT) systems, which monitor and control industrial processes, pose an increasing threat to essential societal services. For this reason, developing automated intrusion response strategies is highly important. In this paper, we present a formal model of an OT intrusion response use case using the POMDP framework. It includes a realistic model of partial observability that is based on traffic measurements. This approach allows us to develop tractable, learning-based solution methods for automated intrusion response, which are based on PPO. We evaluate the obtained response strategies on an emulated OT system and find that they are effective against several types of MITRE attacks for the studied use case.
Abstract:Cyberattacks against Operational Technology (OT) systems, which monitor and control industrial processes, pose an increasing threat to essential societal services. For this reason, developing automated intrusion response strategies is highly important. In this paper, we present a formal model of an OT intrusion response use case using the POMDP framework. It includes a realistic model of partial observability that is based on traffic measurements. This approach allows us to develop tractable, learning-based solution methods for automated intrusion response, which are based on PPO. We evaluate the obtained response strategies on an emulated OT system and find that they are effective against several types of MITRE attacks for the studied use case.
Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
arXiv:2609.10298 [cs.CR]
(or arXiv:2609.10298v1 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2609.10298 Focus to learn more arXiv-issued DOI via DataCite (pending registration)
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 209 words
Related coverage
Research Note: Filtering Subversion-Relevant Information From Pretraining Data Is Feasible
LessWrong · Oct 5, 2026
State of Pandemic Early Warning
LessWrong · Sep 24, 2026
How bad would it be if GPS satellites were shot down?
LessWrong · Jun 12, 2026
October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities
CrowdStrike Blog · Oct 13, 2026