Cognitive Machine Learning for Operational Technology (OT) Security: A Kantian-Inspired Hybrid Framework for Industrial Anomaly Detection
Operational Technology (OT) networks present significant challenges for anomaly detection due to low data volume, heterogeneous traffic patterns, and nonstationary behaviour. Conventional deep learning approaches often struggle to generalise under such conditions, particularly when labelled data are scarce. This study proposes a lightweight hybrid framework integrating a Denoising Autoencoder (DAE) for unsupervised structural anomaly scoring with a Long Short-Term Memory (LSTM) network for temporal modelling. The DAE is trained exclusively on benign traffic, learning structural characteristics of normal behaviour without requiring attack labels. The LSTM operates on latent representations extracted from the DAE bottleneck rather than raw protocol features, enabling consistent application across OT scenarios without feature-level modification. The pipeline is organised around Sensibility, Imagination, Understanding, and Reason—inspired by Kant’s epistemological framework—as an organisational design principle. The framework is evaluated on industrial network traffic from Roketsan A.Ş. and the public CIC-IoMT2024 Message Queuing Telemetry Transport (MQTT) benchmark, with additional cross-dataset validation on the Edge-IIoTset benchmark. Fixed-seed robustness experiments report performance across MQTT, Transmission Control Protocol (TCP), and public MQTT scenarios using Macro- $F_{1}$ , Matthews Correlation Coefficient (MCC), and false-positive/false-negative rates. Comparisons against eight baselines—supervised (Random Forest, XGBoost, CNN-LSTM, Transformer-IDS), unsupervised (Isolation Forest, One-Class SVM, KitNET), and semi-supervised (LSTM-AE)—demonstrate competitive performance rather than uniform dominance over all supervised baselines. LSTM-AE degradation on TCP and public MQTT traffic highlights the limitation of reconstruction-based temporal baselines and motivates schema-based temporal modelling. With 29,133 parameters and CPU-only inference at 0.0379 ms per sample, the model is suitable for resource-constrained OT monitoring.