Ensemble Learning for Industrial Control System Security: A Multi-Dataset Framework for Critical Infrastructure Protection

Abstract

Industrial Control Systems (ICS) form the backbone of critical infrastructure sectors including power generation, water treatment, manufacturing, and transportation. The increasing connectivity of these systems has exposed them to sophisticated cyber threats that can cause physical damage and disrupt essential services. This paper presents a comprehensive evaluation of ensemble learning approaches for ICS security, leveraging the ICSCASD-MPLC dataset alongside standard intrusion detection benchmarks. Our proposed stacking ensemble framework, combining Random Forest, XGBoost, Deep Neural Networks (DNN), and Long Short-Term Memory (LSTM) networks, achieves 97.2% detection accuracy on ICS data with a false positive rate of 1.9% [26], [35]. The framework demonstrates robust performance across diverse attack types including Denial of Service (DoS), Man-in-the-Middle (MITM), ARP Spoofing, Data Injection, and Reconnaissance attacks. Comparative analysis with traditional security approaches shows substantial improvements: reduction in mean time to detect (MTTD) from hours to minutes, reduction in alert volume by over 95%, and significant improvement in analyst efficiency. The framework achieves near real-time performance with an average detection latency of 112 ms, making it suitable for operational environments. This research addresses a critical gap in ICS security research and provides a practical, deployable solution for protecting critical infrastructure in India and similar developing economies.