MACHINE LEARNING-BASED CYBERATTACK DETECTION IN OT-NETWORKS: A COMPARATIVE ANALYSIS OF NETWORK ANOMALY CLASSIFICATION METHODS

Abstract

The growing number of cyberattacks targeting industrial networks increases the need for timely detection of anomalous activity in operational technology (OT) environments. This study aims to comparatively evaluate machine learning methods for cyberattack detection and network anomaly classification in OT networks. The experimental methodology includes network traffic preprocessing, informative feature space construction, and training of Random Forest, XGBoost, Support Vector Machine, and multilayer neural network models. Algorithm performance is evaluated using Accuracy, Precision, Recall, F1-score, and ROC-AUC, as well as their ability to identify different categories of attacks. XGBoost demonstrated the best performance, achieving an Accuracy of 98.4%, an F1-score of 98.1%, and a ROC-AUC of 0.994. The comparative analysis indicates that ensemble methods can improve network anomaly detection accuracy while maintaining a low false-positive rate. The obtained results can be applied to the development of intelligent intrusion detection systems for industrial OT infrastructures.