An Autonomous, Continuously-Learning Framework for Real-Time Cyber-Physical Threat Prevention in Legacy SCADA Systems

Abstract

Supervisory Control and Data Acquisition (SCADA) systems remain the operational backbone of critical infrastructure, yet a vast installed base of legacy deployments was engineered for availability and determinism rather than security. These systems typically lack transport encryption, device authentication, and message integrity, and their long service lives and safetycertified configurations make them difficult or impossible to retrofit with conventional cryptographic controls. Signature-based and statically configured intrusion detection cannot keep pace with the concept drift, process reconfiguration, and novel attack techniques that characterize modern industrial threats. This paper proposes an autonomous, continuously-learning anomalydetection framework that treats real-time threat prevention as an adaptive, resilience-oriented process rather than a fixed rule set. The framework is built on a Long Short-Term Memory (LSTM) Autoencoder that learns the temporal signature of normal process behavior and flags deviations through reconstruction error, and it is organized into three cooperating components: a dataacquisition and preprocessing pipeline that harmonizes heterogeneous logs and protocol exchanges; a detection engine that scores multivariate time series without exhaustive labels; and an alerting, interpretation, and semi-automated response layer that supports operators. A closed feedback loop incrementally updates the notion of “normal” to track sensor drift and control-loop tuning while remaining sensitive to low-and-slow intrusions. We validate the design on a simulated legacy water-treatment SCADA case derived from the SWaT testbed and augmented with synthetic Modbus/TCP anomalies, achieving an F1 score above 0.92 with sub-second detection latency. The contribution is a proactive, deployable defense for critical infrastructure that strengthens cyberphysical resilience without costly hardware replacement.