What question did this study set out to answer?

To develop a hybrid rule-based intrusion detection system utilizing deep learning for SCADA-driven cyber-physical systems.

April 16, 2026Open Access

ZuraNet: a hybrid rule-based intrusion detection system with deep learning for securing SCADA-driven cyber-physical systems

Key Points

To develop a hybrid rule-based intrusion detection system utilizing deep learning for SCADA-driven cyber-physical systems.
Developed ZuraNet and GRiQ-Net models for effective intrusion detection.
Utilized deep learning for advanced attack pattern detection.
Implemented residual learning and query-based operations for traffic dependency capture.
Verified models on multiple benchmark datasets including ToN-IoT and CICIDS2017.
Assessed performance based on precision, detection rate, and accuracy.
Achieved accuracy rates of up to 99.60% in detection.
Maintained precision exceeding 99% and detection rates above 99.35%.
Demonstrated significant superiority to existing security models with reduced false positives.
Ensured low processing times for real-time applicability.

Abstract

Cyber-Physical Systems (CPS) are the backbone of industrial and critical infrastructure applications in today’s world, especially in Supervisory Control and Data Acquisition (SCADA) systems. Security of the SCADA environment is important because any vulnerability can cause disastrous results, such as breakdowns in operations and loss of funds. Nonetheless, current Intrusion Detection Systems (IDS) are confronted with the effective detection of sophisticated cyberattacks. For this purpose, a hybrid rule-based IDS using deep learning methods, tailored for intrusion detection in SCADA-controlled CPS, is suggested in this paper. The key contribution of this research is the establishment of two novel models, which are ZuraNet and GRiQ-Net. The ZuraNet model utilizes deep learning methods for improving advanced attack pattern detection and keeping rule-based systems interpretable. The GRiQ-Net method uses residual learning as well as query-based operations to capture effectively both short-range and long-range SCADA network traffic dependencies. The suggested models were comprehensively verified on various benchmark datasets, i.e., ToN-IoT, RT-IoT 2022, CICIDS2017, CIRA-CIC-DoHBrw-2020, and ICS-SCADA. The experimental performance suggests that the hybrid IDS is considerably superior to current security models with respect to precision, detection rate, and accuracy. The ZuraNet and GRiQ-Net models attained accuracy rates of as high as 99.60%, with precision of more than 99% and detection rates of more than 99.35%, thus proving the superior capability for anomaly detection with reduced false positives. The models also entail low processing times, thus ensuring real-time applicability for SCADA systems. In general, the suggested hybrid IDS architecture is an important contribution to CPS security through its offering of an intelligent, adaptive, and high-performance real-time intrusion detection solution.

Perguntar à IA

Bookmark

View Full Paper