mlsanityData to 14 Oct 2026

Learning Intrusion Response Strategies for OT Systems

arXiv 2609.10298 ↗First posted 9 Sep 2026cs.CR cs.AIcited by 0

Not on the map. Why?

Abstract (arXiv)

Cyberattacks against Operational Technology (OT) systems, which monitor and control industrial processes, pose an increasing threat to essential societal services. For this reason, developing automated intrusion response strategies is highly important. In this paper, we present a formal model of an OT intrusion response use case using the POMDP framework. It includes a realistic model of partial observability that is based on traffic measurements. This approach allows us to develop tractable, learning-based solution methods for automated intrusion response, which are based on PPO. We evaluate the obtained response strategies on an emulated OT system and find that they are effective against several types of MITRE attacks for the studied use case.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 11 of its 43 references that are in the map. First posted on arXiv 9 Sep 2026.

Builds on

11 of 43 references.

References · 11

  1. 2017Proximal Policy Optimization Algorithmscited by 15,215
  2. 2016Partially Observed Markov Decision Processes. Problem Sets and Internet Supplementcited by 34
  3. 2020Finding Effective Security Strategies through Reinforcement Learning and Self-Playcited by 32
  4. 2023MITRE ATT&CK: State of the Art and Way Forwardcited by 12
  5. 2024Optimal Defender Strategies for CAGE-2 using Causal Modeling and Tree Searchcited by 12
  6. 2025Incident Response Planning Using a Lightweight Large Language Model with Reduced Hallucinationcited by 10
  7. 2021Reinforcement Learning for Industrial Control Network Cyber Security Orchestrationcited by 3
  8. 2021Vulnerabilities and Attacks Against Industrial Control Systems and Critical Infrastructurescited by 3
  9. 2025Optimal Security Response to Network Intrusions in IT Systemscited by 3
  10. 2025Learning Optimal Defender Strategies for CAGE-2 using a POMDP Modelcited by 3
  11. 2025Analysis of Publicly Accessible Operational Technology and Associated Riskscited by 1

Built on by

Not cited yet.