Artificial Intelligence and Electrical & Electronics Engineering: AIEEE Open Access
A Hybrid Machine Learning Approach for Cyberattack Detection in SCADA Systems
Abstract
Shandukani Tshilidzi Thenga
Critical infrastructure sectors, including energy, water treatment, and manufacturing, rely on supervisory con-trol and data acquisition (SCADA) systems. The increasing integration of SCADA systems with corporate in-formation technology networks and the Internet has expanded their attack surface and exposed them to ad-vanced cyberattacks. Conventional rule-based and signature-based intrusion detection systems (IDSs) are often unable to identify evolving and zero-day threats. This paper suggests a hybrid machine learning (ML) system that blends both supervised and unsupervised machine learning to enhance cyberattack detection in SCADA systems. The framework combines the support vector machine (SVM) and random forest (RF) classifiers with an autoencoder-based anomaly detector to recognize familiar and unfamiliar patterns of attacks. Benchmark SCADA datasets of simulated industrial control traffic and attacks are used to evaluate the proposed approach. Performance is based on accuracy, precision, recall, F1-score, false positive rate, and detection latency. The hybrid model achieves an accuracy of 98.4% and a false-positive rate of 1.8%, outperforming each standalone model. The framework also exhibits stable performance in the case of noisy and incomplete data. These results imply that hybrid ML systems can offer scalable and versatile foundations to real-time cyberattack identifica-tion in critical infrastructure.