Enhancing Anomaly Detection in Industrial Control Systems through Supervised Learning and Explainable Artificial Intelligence

aspg-2-3174-1791417271 20261007235431 American Scientific Publishing Group admin@americaspg.com American Scientific Publishing Group Journal of Cybersecurity and Information Management JCIM 2769-7851 2690-6775 2025 15 1 Enhancing Anomaly Detection in Industrial Control Systems through Supervised Learning and Explainable Artificial Intelligence Dhruv G. Bhatt Department of Computer Science and Engineering, School of Technology, Pandit Deendayal Energy University, Gandhinagar 382007, India Parshad U. Kyada Department of Computer Science and Engineering, School of Technology, Pandit Deendayal Energy University, Gandhinagar 382007, India Rajkumar Singh Rathore Department of Computer Science, Cardiff School of Technologies, Cardiff Metropolitan University, Llandaff Campus, CF5 2YB Cardiff, U.K M. K. Nallakaruppan Balaji Institute of Modern Management, Sri Balaji University, Pune, Pincode-411033, India Faisal Mohammed Alotaibi Department of Computer Science, Prince Sattam Bin Abdulaziz University, Al-Kharj, Riyadh 16278, Saudi Arabia Rutvij H. Jhaveri Department of Computer Science and Engineering, School of Technology, Pandit Deendayal Energy University, Gandhinagar 382007, India This paper addresses industrial control security (ICS) security, focusing on utilizing intrusion detection systems (IDS) to protect ICS networks. It suggests the use of a Measurement Intrusion Detection System (MIDS) over a Network Intrusion Detection System (NIDS), directly analyzing measurement data to detect unseen activities. Training MIDS requires a labeled dataset of various attacks, and a hardware-in-the-loop (HIL) system is used for safer attack simulations. The main aim is to assess MIDS performance through machine learning (ML) on this dataset. Explainable artificial intelligence (XAI) is integrated for transparency in decision-making. Various ML models, such as random forest, achieve high accuracy in detecting anomalies, notably stealthy attacks, with a receiver operating curve (ROC) of 0.9999 and an accuracy of 0.9795. This highlights the importance of machine learning in securing ICS, supported by XAI's explanatory power. 2025 314 331 3174 https://creativecommons.org/licenses/by/4.0/ 10.54216/JCIM.150125 https://www.americaspg.com/journal/2/article/3174 https://www.americaspg.com/storage/articles/manuscripts/01M2C5RBBEY03S7ZGMSCBZMRV1.pdf