Federated Learning-Based Cyberthreat Detection and Mitigation for IT and OT Environments in National Critical Infrastructure Sectors

Abstract

: Critical infrastructure systems are based on the combination of Information Technology (IT) and Operational Technology (OT) platforms to provide heterogeneous services to various users. Nonetheless, the detection and mitigation of cyber threats in these environments is still difficult, as they have different service periods, operational needs, and decentralized computing. To improve the security of the IT and OT infrastructures, this paper proposes a federated learning-based cyber threat mitigation framework. Service failures and service-distribution timelines are examined in the proposed method to detect abnormal behavioural patterns linked with cyber threats. Temporal attributes of the service distributions are studied using iterative federated learning processes that enable the integration of security-related information from several platforms and timeframes of operation. Based on the analyzed timeline patterns, threats are identified, and security measures are dynamically adjusted through local data retention and authenticated client participation. The federated learning model continuously reviews instances of service distribution and computational processes to enhance the accuracy of threat detection. Data gathered on different platforms are aggregated to explore service failures and time fluctuations, enabling effective identification of attackers without breaching privacy and authentication requirements. The learning process is repeated until the maximum number of threats is detected and mitigated. The proposed framework achieves an F1-score of 93.64% in cyberthreat detection, demonstrating its effectiveness in distributed and heterogeneous service environments.