HYBRID NEURAL NETWORK MODEL FOR DETECTING AND QUANTIFYING THE TARGETED ATTACKS RISK ON SCADA/ICS SYSTEMS OF CRITICAL INFRASTRUCTURE FACILITIES

Abstract

Quantifying the targeted attacks risk on SCADA/ICS systems of critical infrastructure facilities is a key prerequisite for making informed decisions to increase cyber resilience, optimize protection mechanisms, and minimize potential manmade and socio-economic consequences. Objective. Development of the adaptive hybrid neural network model development for the detection and quantification of the targeted attacks risk on SCADA/ICS systems of critical infrastructure facilities. The proposed architecture combines multimodal integration of process and network signals through specialized encoders, cross-modal attentional fuse with prototypical regularization to increase local interpretability, and mechanisms for processing uneven and partially missing telemetry (variational auto-imputation, latent ordinary differential equations, or transformer approaches with masks). The proposed combined detection criterion combines reconstruction, prediction, and contrast components with adaptive predictive components to increase sensitivity to “low-to-slow” attack scenarios. For quantitative risk assessment, a calibrated probabilistic score and an expected loss function were introduced, which made it possible to formalize the threshold response policy (monitoring, isolation, and automatic countermeasures) as a multi-level strategy. Incremental learning with a limited buffer, MAML-like initialization, and domain-adversarial regularization were used to ensure adaptability to drift and new configurations. XAI mechanisms (internal attention, prototypes, integrated gradients, and SHAP-like approximations) provide logical tracing of cause-and-effect scenarios and support for forensic conclusions. Experimental validation was carried out on a multi-modal dataset formed by combining public SCADA/ICS sets with simulated trajectories and attacked scenarios. The evaluation included ROC-AUC and F1-metric for anomaly detection, RMSE for the predictive component, and economically oriented metrics of expected loss and calibrated risk. Scientific novelty. Development of an adaptive interpreted neural network model that, for the first time, combines multimodal integration of SCADA/ICS network and process signals, robust detection of “low-slow” targeted attacks under limited telemetry conditions, and formalized quantitative risk assessment with prediction of consequences for physical processes of critical infrastructure. Conclusion. The results demonstrate increased stability in detecting “low-slow” attacks and correlation of predictive deviations with increasing RMSE in attack phases for formalized selection of operational thresholds.