KTH publishes OT defense study: software learns when to reboot hacked factory networks

KTH Royal Institute of Technology has published a new study on an autonomous operational technology (OT) intrusion-response agent. It nudges automated industrial cyber defense, even with limited traffic visibility, a little closer to something that could work in practice.

Wireshark Download

According to the KTH Royal Institute of Technology study, the autonomous OT intrusion-response agent was trained for 14 days on a containerized, segmented network under attack. It worked from about 40,000 observations, sampled every 30 seconds, using six traffic-count features to decide whether to leave things alone or reset three supervisory hosts, two water-tank processes, or the supervisory and control subnets. Those resets rebooted the targets, renewed credentials, and changed IP addresses. The best belief-state model tracked 500 hypotheses, outperformed raw-history agents, came close to a full-visibility baseline, and even turned up four cases where one history interval did worse than none.

If you follow OT security, this KTH Royal Institute of Technology paper is worth your time. Still, the study rests on assumptions about attacker behavior, simplifies an observation model that otherwise would have needed 100 million measurements, and was tested only on three supervisory hosts, two PLCs, and two tanks using weak-credential HTTP, SSH, Telnet, SMB, and CVE-2017-7494. So you still don’t know whether the KTH Royal Institute of Technology approach generalizes, even as 73% of OT organizations reported intrusions in 2024, up from 49% a year earlier, OT recovery costs run 4 to 6 times higher than IT, and the average industrial breach cost climbed by $830,000. You can read the study from KTH Royal Institute of Technology.