Deep Learning for Cybersecurity Threat Detection in Industrial Process Control and Monitoring Systems

The increasing digital integration of Industrial Control Systems (ICSs), including Supervisory Control and Data Acquisition (SCADA) and Distributed Control Systems (DCSs), has brought both operational efficiencies and greater exposure to cyber threats. Traditional cybersecurity approaches, such as signature- and rule-based Intrusion Detection Systems (IDSs), often fail to detect novel and stealthy attacks, posing significant risks to critical infrastructure. This paper presents a deep learning-based threat detection framework tailored for ICS environments, leveraging sensor data, actuator signals, and network communication logs. The framework incorporates advanced neural architectures, including Convolutional Neural Networks (CNNs), Long Short-Term Memory (LSTM) networks, and Transformer models to capture complex temporal and spatial patterns indicative of malicious activity. These models were trained and evaluated using the publicly available HAI security dataset. The results demonstrate high effectiveness across all models, with the Transformer achieving the highest accuracy (92%), followed by the CNN (91%) and LSTM (90%). Precision scores were 93% for LSTM, 92% for CNN, and 91% for Transformer; recall was 92% for Transformer, 91% for CNN, and 90% for LSTM. All models yielded an F1-score of 91%, reflecting a strong balance between precision and recall. While each architecture showed strengths, the Transformer exhibited superior generalization. The study also addresses key challenges such as data imbalance, overfitting, explainability, and deployment constraints. Solutions such as hybrid modeling, federated learning, and digital twin integration are discussed to enhance resilience and scalability. The proposed approach demonstrates that deep learning can significantly strengthen real-time cybersecurity monitoring in ICS, offering a robust defense against evolving threats.