Design of an intelligent security system for cyber-attack detection in petrochemical SCADA networks based on a hybrid artificial neural network and Krill-Herd algorithm.

Abstract

In the past few years, with the increasing severity of cyber-attacks, network security has become a burning topic in safety-critical industries such as petrochemicals. SCADA systems, as the central hub of industrial process control, are under constant attack by reconnaissance and intrusion attempts. To secure these environments, this study proposes a comprehensive two-tier intelligent security system. Initially, industrial network traffic was captured using Wireshark to distinguish reconnaissance attack patterns from normal operations. For the first tier, a monitoring script was developed to extract behavior-based scores, which are then analyzed by an Artificial Neural Network (ANN) optimized via the Krill-Herd (KH) algorithm to effectively detect early-stage attacks (ARP, Port, and ICMP scans). Furthermore, to address sophisticated application-layer threats, the system incorporates a second tier: a Bottleneck Deep Neural Network (BDNN) optimized by the KH algorithm. This module analyzes advanced statistical features to successfully detect stealthy manipulations within the Modbus protocol. The results confirm that the proposed two-tier system detects reconnaissance and stealthy Modbus attacks with high accuracy and very low inference latency. The Krill-Herd (KH) algorithm contributes automated hyperparameter selection and faster convergence rather than a statistically significant accuracy gain over a well-tuned Adam baseline. Ultimately, this framework can serve as a highly effective, intelligent tool in cyber defense against evolving threats in petrochemical industries.