Analysis of Practical Machine Learning Scenarios for Cybersecurity in

Industry 4.0

EVGENI SABEV, ROUMEN TRIFONOV, GALYA PAVLOVA, KAMELIA RAYNOVA

Computer Systems and Technology,

Technical University of Sofia,

8 St. Kl. Ohridski Bul. , Sofia, 1000,

certain nations and governments are prudently assessing the risks associated with widespread AI deployment,

threat actors are already exploiting these emerging opportunities. In this paper, we delve into an examination of

the utilization of artificial intelligence methods in the realm of cybersecurity within the context of Industry 4.0.

Additionally, we provide an in-depth exploration of the obstacles, motivations, and essential requirements that

warrant meticulous consideration when deploying these AI approaches to bolster the cybersecurity landscape in

Industry 4.0.

Key-Words: - Artificial Intelligence, Cybersecurity, Machine Learning, SCADA, ICS, Industry 4.0.

Received: January 29, 2023. Revised: October 9, 2023. Accepted: November 16, 2023. Published: December 13, 2023.

language. Around that time, the perceptron was also

introduced. Despite the intensive research and

efforts invested in Artificial Intelligence around the

’70s, AI was not considered interesting to

businesses anymore and no practical use was seen

then. This led to his drop in overall interest and

investments in AI.

During the ’90s, there was still no real AI usage

for businesses. Even though at that time the idea of

combining multiple layers, perception, and back-

(ML). ML is a variation of AI and makes it possible

that systems to self-learn from a dataset without

needing to be programmed by humans. ML has

different learning methods – supervised,

unsupervised, or semi-supervised.

achieved huge success in everyday applications like

Siri or Alexa. In the next Figure 2, using Venn

diagrams, it is shown that Deep learning is a subset

of Machine Learning.

occurring between the systems. In the past, many of

the now interconnected systems were isolated.

However, this is now changing, and the attack

surface of a typical ICS/SCADA is enlarged,

making it more vulnerable and more exposed to

different threat actors. Our previous paper discussed

various classifications of threat actors, [1].

As previously mentioned, Industry 4.0

architectures are complex and hard to understand,

which makes them difficult to protect. The

sociology. The researchers have developed a

framework that helps AI to be integrated with cyber

risk analytics for CPS. Getting all the necessary data

into account is key to success as described in the

researchers’ paper. Some of the key data required

for AI are proper asset management and access

control. The AI deep learning processes must be

secured from manipulation by insiders, disgruntled

employees, or state-sponsored actors. If an attacker

can manipulate the deep learning process by doing

centrally align the AI ecosystems of all EU member

states, [7].

On 14 December 2021, the ENISA published the

Securing Machine Learning Algorithms report. This

are identified but not limited to are data exfiltration

and poisoning, adversarial attacks, etc., [8].

Artificial intelligence, as defined by ISO2382,

pertains to a field within computer science that

focuses on constructing data processing systems

capable of performing tasks typically associated

with human intelligence. These tasks include logical

reasoning, learning, and self-enhancement.

Under the guidance of Fraunhofer IKS, an

international consortium is actively formulating

vehicles. Beyond solely providing specifications for

neural networks, the standard encompasses a

Unsupervised learning, sometimes referred to as

unsupervised machine learning, is employed for the

examination of untagged datasets. In unsupervised

learning, the primary emphasis is placed on

is provided with labeled examples to learn from,

unsupervised learning algorithms work with

unlabeled data, [13]. Unsupervised learning aims to

uncover valuable insights, unearth concealed

patterns, and unveil inherent structures in data. It

employs diverse techniques like clustering,

dimensionality reduction, and density estimation to

accomplish this.

Clustering algorithms gather data points that

exhibit proximity or likeness, facilitating the

unique scenarios wherein the training dataset

consists of a combination of labeled and unlabeled

A deep convolutional neural network is a class of

artificial neural networks that are used to identify

layers, and fully connected layers. Convolutional

layers apply filters to the input image to detect

features, such as edges, shapes, or patterns. Pooling

layers reduce the size of the image, keeping only the

most important information. Fully connected layers

connect the output of the previous layers to the final

output layer, which can be used for classification or

regression.

function for comparing data points is made by the

data analyst, often employing Euclidean distance.

3.2.4 Bidirectional Recurrent Neural Networks

(BRNNs)

input data into a lower-dimensional representation,

while the decoder reconstructs the original data

from the compressed representation. Deep AEs

utilize multiple hidden layers to learn increasingly

3.2.8 Generative Adversarial Networks (GANs)

neural network architectures comprising a generator

and a discriminator. The generator generates new

data samples, while the discriminator aims to

distinguish between real and generated samples. The

generator learns from the feedback of the

discriminator, and the discriminator learns from the

data itself. The goal of GANs is to reach a state

where the generator can fool the discriminator with

high probability, meaning that the fake data is

indistinguishable from the real data. GANs are

process to produce high-quality data samples, [19].

3.2.9 Long Short-Term Memory (LSTMs)

3.2.10 Gated Recurrent Units (GRUs)

Federated Learning (FL) is a machine learning

approach that allows a model to be trained across

multiple decentralized edge devices (such as

in recent years due to its potential to address data

privacy concerns, reduce communication costs, and

make machine learning more scalable. FL can be

used for fraud detection and risk assessment while

keeping sensitive customer data decentralized, [22].

Feedforward Deep Neural Networks (FFDNNs),

also known as a feedforward artificial neural

without cycles or feedback loops.

3.2.16 Probabilistic Suffix Trees (PSTs)

especially important in high-dimensional data

scenarios.

the potential threat vectors and threat attackers that

are attacking Industry 4.0 systems. Based on that

research and also the latest research, we have

provided a short visualization in Figure 4 below of

the potential threats and some of the vulnerabilities

in wind turbine systems that could have a serious

impact on wind farms.

After analyzing the DL methods that are

currently being widely developed and used, we took

the next step to research which of the DL methods

algorithm has shown the best performance for

false positive rates, [23].

potential.

fault detection of wind turbines, [25].

(ANN) machine learning model, is usually used

in forecasting. The algorithm has proved itself

faulty. The researchers are proposing an innovative

CNN method that is called “AOC–ResNet50”.

Machine Learning for anomaly detection of the

gearbox of a wind turbine, [28].

implementing a monitoring system that tracks and

identifies the state of IoT devices over time by

employing a synchronized series of performance

metrics, including processor usage, memory

Industrial control systems (ICSs) within wind

farms are essential for the efficient operation of

wind turbines (WTs). Nevertheless, in their pursuit

of higher profits, unscrupulous wind power

producers frequently employ false data injection

(FDI) attacks to undermine the ICSs of competing

wind farms. A group of researchers investigates a

novel type of profit-oriented FDI (POFDI) attack

attack strategy focused on maximizing financial

gain is discussed, which involves integrating attack

detection methods. To identify POFDI attacks,

countermeasures are developed based on

differentiating the compromised data from normal

data, leveraging the relationships between wind

turbines in wind farms, [31].

Another research aims to investigate the effects

of a stealthy false data injection attack on critical

sensor measurements in a wind farm. To achieve

To stay stealthy, the adversary strategically

manipulates the power equations and modifies the

sensor measurements. The research focuses on

quantifying the impact of this attack and proposes

countermeasures to mitigate its effects, [32].

During an extensive two-year study, a team of

researchers from the University of Tulsa conducted

rigorous penetration tests on five distinct wind

farms, excluding the one mentioned in this context.

This comprehensive investigation aimed to assess