smart defenses for dumb controllers

Problem statement

Modern AI-based intrusion detection systems (IDS) for industrial control systems demonstrate high accuracy in laboratory benchmarks, but they cannot be deployed on the legacy programmable logic controllers (PLCs) and SCADA systems that actually operate critical infrastructure. Most PLCs run deterministic logic on hardware with minimal computational capacity — there is no room for real-time machine learning inference. Meanwhile, the attack surface is expanding as ICS devices are increasingly networked and internet-exposed and industrial software supply chains grow more complex. The result is a widening gap between the sophistication of available AI defenses and the ability of operational infrastructure to use them.

Why this matters

SCADA systems control water treatment, power grids, oil and gas pipelines, and manufacturing processes. A successful cyberattack on these systems can cause physical damage, environmental disasters, and loss of life — as demonstrated by the December 23, 2015 Ukraine power grid attack, in which intrusions at three distribution companies cut power to approximately 225,000 customers (E-ISAC/SANS, 2016), followed by a second grid attack on a Kyiv transmission substation in December 2016. (The widely cited 2021 Oldsmar, Florida water-treatment "hack" is no longer a clean example: the FBI could not confirm any outside intrusion, and the city's former manager attributes the incident to employee error.) A global cybersecurity workforce gap that ISC2 estimated at roughly 4.8 million people in 2024 compounds the problem: even when AI tools exist, there are too few trained operators to deploy and manage them. Critical infrastructure in water, energy, and transportation sectors relies on equipment with 20–40 year lifecycles, meaning the legacy hardware problem will persist for decades without a deployment strategy that works within existing constraints.

What’s been tried and why it hasn’t worked

Traditional signature-based IDS (like Snort or Suricata rules) can run on lightweight hardware but only detect known attack patterns and miss novel threats. Statistical anomaly detection approaches have lower computational requirements but produce high false positive rates that overwhelm operators. Deep learning approaches — CNNs, LSTMs, Transformers, autoencoders — achieve 90%+ accuracy on benchmark datasets (HAI, SWaT, BATADAL) but require GPU-class hardware for real-time inference, which is unavailable in most ICS environments. Network-based approaches that monitor traffic at a separate appliance avoid the PLC hardware constraint but cannot detect attacks that manipulate the physical process through legitimate-looking commands. The addition of encryption to SCADA protocols (DNP3 Secure Authentication, IEC 62351) can introduce real-time response delays that are difficult to accommodate in process control. A 2025 systematic review of 250 articles on AI for ICS security emphasizes anomaly detection and predictive analytics as the leading responses — yet the approaches it catalogues largely presuppose computational resources that legacy automation hardware lacks.

What would unlock progress

A hybrid architecture that places lightweight anomaly detection on or near the PLC (using federated inference or edge computing) while offloading computationally intensive deep analysis to a centralized system could bridge the gap. Model compression techniques (quantization, pruning, knowledge distillation) that reduce AI model size by 10–100x while maintaining detection accuracy would enable deployment on constrained hardware. Physics-informed AI models that encode knowledge of the industrial process could detect anomalies with fewer parameters than general-purpose neural networks. Standardized, anonymized industrial cybersecurity datasets — which currently do not exist due to data sensitivity — would enable the research community to develop and benchmark models appropriate for real-world ICS environments.

Entry points for student teams

A student team could prototype a lightweight anomaly detection model (e.g., autoencoder or isolation forest) that runs on resource-constrained hardware (Raspberry Pi or Arduino-class) monitoring simulated SCADA network traffic, benchmarking detection accuracy against inference latency and memory constraints. This is a well-scoped embedded systems and security project. Alternatively, a team could design a hybrid edge-cloud IDS architecture for a specific ICS protocol (Modbus, DNP3, or IEC 61850), demonstrating how computationally expensive deep learning analysis can be performed asynchronously without disrupting real-time control operations.