{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,2]],"date-time":"2026-03-02T07:04:57Z","timestamp":1772435097958,"version":"3.50.1"},"reference-count":27,"publisher":"Frontiers Media SA","license":[{"start":{"date-parts":[[2026,3,2]],"date-time":"2026-03-02T00:00:00Z","timestamp":1772409600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["frontiersin.org"],"crossmark-restriction":true},"short-container-title":["Front. Comput. Sci."],"abstract":"<jats:sec>\n                    <jats:title>Introduction<\/jats:title>\n                    <jats:p>In the context of growing cyber risks to critical industries, including bakery complexes, this paper proposes a cognitive architecture for early incident detection in the operational technology (OT) network.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Methods<\/jats:title>\n                    <jats:p>The architecture integrates User and Entity Behavior Analytics (UEBA), a Security Information and Event Management (SIEM) system, and Zero Trust principles, focusing on hybrid threats: from external attacks on industrial controllers, such as programmable logic controllers (PLCs) to internal operator errors. At the analytics layer, two complementary deep learning pipelines are used: a convolutional neural network (CNN) + long short-term memory (LSTM) (CNN + LSTM) model for detecting low-level network patterns (Byte2Image) and an autoencoder (AE) combined with LSTM (AE + LSTM model) for predicting time-series data and identifying anomalies in equipment telemetry. An adaptive threshold decision procedure is introduced for the first time, optimizing both accuracy and computational resources on edge nodes. The architecture complies with the IEC 62443 and ISO\/IEC 27019 standards.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Results and discussion<\/jats:title>\n                    <jats:p>High performance metrics, specifically Precision, were demonstrated in the bakery plant\u2019s digital twin scenarios.<\/jats:p>\n                  <\/jats:sec>","DOI":"10.3389\/fcomp.2026.1751284","type":"journal-article","created":{"date-parts":[[2026,3,2]],"date-time":"2026-03-02T06:42:43Z","timestamp":1772433763000},"update-policy":"https:\/\/doi.org\/10.3389\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Machine learning-based early incident detection system in a bakery plant\u2019s industrial network: a cognitive model for counteracting hybrid threats"],"prefix":"10.3389","volume":"8","author":[{"given":"Gulshat Amanzholovna","family":"Amirkhanova","sequence":"first","affiliation":[{"name":"Department of Artificial Intelligence and Big Data, Faculty of Information Technology, Al-Farabi Kazakh National University","place":["Almaty, Kazakhstan"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Dmytro Ihorovych","family":"Prokopovych-Tkachenko","sequence":"additional","affiliation":[{"name":"Department of Cybersecurity and Information Technologies, University of Customs and Finance","place":["Dnipro, Ukraine"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Saltanat Almykhametovna","family":"Adilzhanova","sequence":"additional","affiliation":[{"name":"Department of Cybersecurity and Cryptology, Faculty of Information Technology, Al-Farabi Kazakh National University","place":["Almaty, Kazakhstan"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Nazar","family":"Zubchenko","sequence":"additional","affiliation":[{"name":"Department of Cybersecurity and Information Technologies, University of Customs and Finance","place":["Dnipro, Ukraine"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Liya Erbolkyzy","family":"Bektemir","sequence":"additional","affiliation":[{"name":"Department of Artificial Intelligence and Big Data, Faculty of Information Technology, Al-Farabi Kazakh National University","place":["Almaty, Kazakhstan"]}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1965","published-online":{"date-parts":[[2026,3,2]]},"reference":[{"key":"ref1","doi-asserted-by":"publisher","first-page":"103160","DOI":"10.1016\/j.cose.2023.103160","article-title":"Hybrid deep learning-based intrusion detection system for industrial networks","volume":"128","author":"Abhishek","year":"2023","journal-title":"Comput. Secur."},{"key":"ref2","doi-asserted-by":"publisher","first-page":"95278","DOI":"10.1109\/ACCESS.2023.3318743","article-title":"Security risk assessment in industrial control systems using fuzzy logic and machine learning","volume":"11","author":"Ahmad","year":"2023","journal-title":"IEEE Access"},{"key":"ref3","doi-asserted-by":"publisher","first-page":"tyab006","DOI":"10.1093\/cybsec\/tyab006","article-title":"A three-tiered intrusion detection system for industrial control systems","volume":"7","author":"Anthi","year":"2021","journal-title":"J. Cybersecur."},{"key":"ref001","author":"Basseville","year":"1993","journal-title":"Detection of Abrupt Changes: Theory and Application"},{"key":"ref4","doi-asserted-by":"publisher","first-page":"101677","DOI":"10.1016\/j.cose.2019.101677","article-title":"Cybersecurity for industrial control systems: a survey","volume":"89","author":"Bhamare","year":"2020","journal-title":"Comput. Secur."},{"key":"ref5","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1016\/j.cose.2015.09.009","article-title":"A review of cyber security risk assessment methods for SCADA systems","volume":"56","author":"Cherdantseva","year":"2016","journal-title":"Comput. Secur."},{"key":"ref6","doi-asserted-by":"publisher","first-page":"77","DOI":"10.1109\/MSEC.2019.2961650","article-title":"Unleashing the digital twin\u2019s potential for ICS security","volume":"18","author":"Dietz","year":"2020","journal-title":"IEEE Secur. Privacy"},{"key":"ref8","doi-asserted-by":"publisher","first-page":"18","DOI":"10.1186\/s42400-021-00095-5","article-title":"Machine learning for intrusion detection in industrial control systems: challenges and lessons from experimental evaluation","volume":"4","author":"Gauthama Raman","year":"2021","journal-title":"Cybersecurity"},{"key":"ref9","doi-asserted-by":"publisher","first-page":"4440","DOI":"10.3390\/electronics13224440","article-title":"Network-based intrusion detection for industrial and robotic systems","volume":"13","author":"Holdbrook","year":"2024","journal-title":"Electronics"},{"key":"ref10","doi-asserted-by":"publisher","first-page":"2195","DOI":"10.1007\/s10462-024-10805-3","article-title":"A review of digital twins and their application in cybersecurity based on artificial intelligence","volume":"57","author":"Homaei","year":"2024","journal-title":"Artif. Intell. Rev."},{"key":"ref11","author":"Inoue","year":"2017"},{"key":"ref12","doi-asserted-by":"publisher","first-page":"30275","DOI":"10.1038\/s41598-024-30275-3","article-title":"Machine learning-based intrusion detection framework for detecting security attacks in internet of things","volume":"14","author":"Kantharaju","year":"2024","journal-title":"Sci. Rep."},{"key":"ref13","doi-asserted-by":"publisher","first-page":"52","DOI":"10.1016\/j.ijcip.2015.02.002","article-title":"A survey of cyber security management in industrial control systems","volume":"9","author":"Knowles","year":"2015","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"ref14","author":"Kravchik","year":"2018"},{"key":"ref15","doi-asserted-by":"publisher","first-page":"2651","DOI":"10.1109\/JIOT.2023.3321687","article-title":"Multimodal deep fusion anomaly detection for industrial cyber-physical systems","volume":"11","author":"Li","year":"2024","journal-title":"IEEE Internet Things J."},{"key":"ref16","doi-asserted-by":"publisher","first-page":"2532","DOI":"10.1109\/TII.2021.3116743","article-title":"Data-driven anomaly detection for industrial control systems based on dynamic threshold adjustment","volume":"18","author":"Lin","year":"2022","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref17","doi-asserted-by":"publisher","first-page":"6777","DOI":"10.3390\/s20236777","article-title":"Security issues and software updates management in the industrial internet of things: a survey","volume":"20","author":"Mugarza","year":"2020","journal-title":"Sensors"},{"key":"ref18","doi-asserted-by":"publisher","first-page":"289","DOI":"10.1098\/rsta.1933.0009","article-title":"On the problem of the most efficient tests of statistical hypotheses","volume":"231","author":"Neyman","year":"1933","journal-title":"Philos. Trans. R. Soc. Lond. Ser. A"},{"key":"ref19","doi-asserted-by":"publisher","first-page":"6743","DOI":"10.3390\/s22186743","article-title":"Deep hybrid autoencoder-LSTM model for anomaly detection in industrial IoT","volume":"22","author":"Nisar","year":"2022","journal-title":"Sensors"},{"key":"ref20","doi-asserted-by":"publisher","first-page":"39","DOI":"10.1016\/j.future.2024.02.009","article-title":"Digital twin-based cybersecurity framework for smart manufacturing systems","volume":"158","author":"Qureshi","year":"2024","journal-title":"Futur. Gener. Comput. Syst."},{"key":"ref21","doi-asserted-by":"publisher","first-page":"27","DOI":"10.1186\/s42400-021-00095-5","article-title":"Machine learning for intrusion detection in industrial control systems: challenges and lessons from experimental evaluation","volume":"4","author":"Raman","year":"2021","journal-title":"Cybersecurity"},{"key":"ref22","doi-asserted-by":"publisher","first-page":"612","DOI":"10.1016\/j.procs.2019.08.086","article-title":"Securing SCADA-based critical infrastructures: challenges and open issues","volume":"155","author":"Tariq","year":"2019","journal-title":"Procedia Comput. Sci."},{"key":"ref23","doi-asserted-by":"publisher","first-page":"81","DOI":"10.3390\/w13010081","article-title":"A systematic review of the state of cyber-security in water systems","volume":"13","author":"Tuptuk","year":"2021","journal-title":"Water"},{"key":"ref24","doi-asserted-by":"publisher","first-page":"13210","DOI":"10.1109\/JIOT.2021.3128749","article-title":"End-to-end encrypted telemetry protection for SCADA systems using edge intelligence","volume":"9","author":"Wang","year":"2022","journal-title":"IEEE Internet Things J."},{"key":"ref25","doi-asserted-by":"publisher","first-page":"546","DOI":"10.1109\/COMST.2020.3024748","article-title":"A survey of machine learning techniques applied to cybersecurity","volume":"23","author":"Xie","year":"2021","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref26","doi-asserted-by":"publisher","first-page":"102547","DOI":"10.1016\/j.rcim.2022.102547","article-title":"A digital twin-driven approach for industrial anomaly detection","volume":"81","author":"Zhang","year":"2023","journal-title":"Robot. Comput.-Integr. Manuf."},{"key":"ref27","doi-asserted-by":"publisher","first-page":"450","DOI":"10.3390\/info13100450","article-title":"Anomaly detection approach in industrial control systems using PSO-1DCNN-BiLSTM","volume":"13","author":"Zhao","year":"2022","journal-title":"Information"}],"container-title":["Frontiers in Computer Science"],"original-title":[],"link":[{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/fcomp.2026.1751284\/full","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,2]],"date-time":"2026-03-02T06:42:44Z","timestamp":1772433764000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/fcomp.2026.1751284\/full"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3,2]]},"references-count":27,"alternative-id":["10.3389\/fcomp.2026.1751284"],"URL":"https:\/\/doi.org\/10.3389\/fcomp.2026.1751284","relation":{},"ISSN":["2624-9898"],"issn-type":[{"value":"2624-9898","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,3,2]]},"article-number":"1751284"}}