# Learning Intrusion Response Strategies for OT Systems

arXiv: https://arxiv.org/abs/2609.10298 · HTML: https://mlsanity.com/paper/2609.10298/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 11 of its 43 references that are in the map.
- First posted on arXiv 9 Sep 2026.

## Builds on (most cited first, 11 of 11)

- [Proximal Policy Optimization Algorithms](https://mlsanity.com/paper/1707.06347/) (2017)
- [Partially Observed Markov Decision Processes. Problem Sets and Internet Supplement](https://mlsanity.com/paper/1604.08127/) (2016)
- [Finding Effective Security Strategies through Reinforcement Learning and Self-Play](https://mlsanity.com/paper/2009.08120/) (2020)
- [MITRE ATT&CK: State of the Art and Way Forward](https://mlsanity.com/paper/2308.14016/) (2023)
- [Optimal Defender Strategies for CAGE-2 using Causal Modeling and Tree Search](https://mlsanity.com/paper/2407.11070/) (2024)
- [Incident Response Planning Using a Lightweight Large Language Model with Reduced Hallucination](https://mlsanity.com/paper/2508.05188/) (2025)
- [Reinforcement Learning for Industrial Control Network Cyber Security Orchestration](https://mlsanity.com/paper/2106.05332/) (2021)
- [Vulnerabilities and Attacks Against Industrial Control Systems and Critical Infrastructures](https://mlsanity.com/paper/2109.03945/) (2021)
- [Optimal Security Response to Network Intrusions in IT Systems](https://mlsanity.com/paper/2502.02541/) (2025)
- [Learning Optimal Defender Strategies for CAGE-2 using a POMDP Model](https://mlsanity.com/paper/2509.06539/) (2025)
- [Analysis of Publicly Accessible Operational Technology and Associated Risks](https://mlsanity.com/paper/2508.02375/) (2025)

## Abstract (arXiv)

Cyberattacks against Operational Technology (OT) systems, which monitor and control industrial processes, pose an increasing threat to essential societal services. For this reason, developing automated intrusion response strategies is highly important. In this paper, we present a formal model of an OT intrusion response use case using the POMDP framework. It includes a realistic model of partial observability that is based on traffic measurements. This approach allows us to develop tractable, learning-based solution methods for automated intrusion response, which are based on PPO. We evaluate the obtained response strategies on an emulated OT system and find that they are effective against several types of MITRE attacks for the studied use case.