SENTINEL: Evasion-Aware Trust Scoring, Deception, and Cryptographic Write Authorization for Industrial IoT

Abstract

Mohammad Salman Khan, Hammad Chughtai, Halil Ibrahim Ozkul and Burak Yılmaz

Industrial Internet of Things (IIoT) environments require security controls that can distinguish legitimate operational changes from credential misuse, gradual process manipulation, and unauthorized command execution without violating realtime and availability constraints. Detection alone is insufficient when a compromised network-facing service can still issue writes to operational technology. This paper presents SENTINEL, an architecture that separates a public command broker from a protected trust decision point, routes uncertain sessions to a session-isolated deception environment, and requires a shortlived, HMAC-authenticated write capability for every live actuator update. A windowed trust scorer evaluates 152 statistical features across identity, temporal cadence, role authorization, and cross- sensor process consistency. Across five independent runs, each using a newly generated synthetic corpus of 192,000 commands organized into 4,000 sessions, SENTINEL achieved 98.40% ± 0.45% accuracy, 97.00% ± 0.92% macro-F1, and 99.76%±0.33% simulated decision-path containment. In an end-to-end Modbus/TCP software testbed, 5,000 attack trials spanning role violation, replay, payload modification, slow drift, and broker retargeting caused no unauthorized modification of the protected OpenPLC register. Valid protected writes achieved a median end-to-end latency of 17.52 ms (P95: 18.56 ms, P99: 18.73 ms), adding 4.06 ms paired median overhead over the unprotected Modbus baseline. These results demonstrate the architectural feasibility of combining continuous behavioral scoring, active deception, and short-lived write authorization to limit unauthorized process manipulation following compromise of a network- facing component.

PDF