Design secure architecture for operational technology

Operational technologies consist of subsystems and devices that manage equipment interacting with the physical environment. The PURDUE architecture is a comprehensive architecture that integrates Information Technology (IT) and Operational Technology (OT), enabling these two disparate technologies to work together in a secure and integrated manner. The PURDUE architecture, often the preferred architecture for operational technologies, incorporates many traditional security practices used in information technology, such as segmentation, access lists, and security devices. However, the PURDUE architecture does not have a security procedure for cyber-attacks that result in operational failures and physical anomalies. The addition of the EA-GAT model, which can detect physical anomalies in addition to the traditional cyber security procedures in the PURDUE architecture, creates an innovative architecture that maximizes the level of security. The EA-GAT model is an approach that detects anomalies in the system by modeling the events that occur in operational technologies using a dynamic graph generation approach. EA-GAT uses a memory-based architecture that combines data-driven and design-centric approaches to modeling events in the system. Event detection and modeling modules detect physical events and create a graph model of the event. The graph attention network is trained using the generated graph models. In this way, the relational state of the system is learned without the need for design information about the system. In addition, the target and other affected components can be identified by analyzing the graph model of the attack time. The EA-GAT method is tested on SWaT, WADI, and MSL datasets and achieves F1 scores of 97.40%, 66.20%, and 92.85%, respectively, distinguishing it from existing literature studies.