Solving the Cross-Sector Generalization Gap: A Generalizable AI Framework for Detecting Known and Unseen Cyberattacks in Critical Infrastructure
Abstract
Afia Ibnat and Nazia Afrin
Operational technology (OT) security research has largely produced sector-specific intrusion-detection systems, one model per critical-infrastructure domain, which limits transferability and raises the cost of securing the many interconnected sectors that modern societies depend on. This paper proposes and evaluates a cross-sector generalizable artificial intelligence (AI) framework that learns a single, sector-agnostic statistical representation of operational telemetry and uses one classifier to detect cyberattacks across five heterogeneous criticalinfrastructure domains: water/wastewater, power grid, railway, maritime, and industrial/manufacturing systems. We evaluate the framework along five dimensions that prior single-sector systems rarely test together: within-sector detection, leave-onesector-out cross-sector transfer, detection of a completely unseen (zero-day) attack type, discrimination between cyberattacks and ordinary physical faults, and global feature-level explainability. On physically-motivated synthetic telemetry generated for all five sectors, a single Random Forest classifier trained on a 15dimensional shared feature space achieves within-sector accuracy of 79–86% and comparable leave-one-sector-out cross-sector transfer accuracy of 80–86%, a global multi-sector accuracy of 82.6% (macro-F1 0.822), a 0.973 ROC-AUC and 82.2% recall on a zero-day attack type withheld entirely from training, and 89.2% accuracy discriminating cyberattacks from physical faults. Feature- importance analysis shows that rate-of-change volatility and dispersion statistics dominate detections, offering an inspectable evidence trail rather than an opaque label. These results indicate that a single generalizable framework can plausibly replace a fleet of per-sector detectors while remaining explainable, motivating validation on real multi-sector OT datasets as they become available.