Understand the context, ignore the noise: Detecting semantic and temporal attacks in OT using Fuzzy Features with XGBoost

This repository contains the official dataset and source code for the DD-FFH (Data Driven - Fuzzy Feature Hybridization) framework integrated with eXtreme Gradient Boosting (XGBoost) to decouple malicious anomalies from natural operational fluctuations. Abstract:As Information Technology (IT) and Operational Technology (OT) environments converge, Industrial Control Systems (ICS) become highly susceptible to advanced cyber threats. Traditional Network Intrusion Detection Systems (NIDS) relying on L3/L4 signature analysis, fail against semantic attacks concealed within legitimate traffic and suffer from high False Positive Rates (FPR) due to natural process noise. To address these limitations, this paper proposes a data-driven fuzzy feature hybridization (DD-FFH) framework integrated with eXtreme Gradient Boosting (XGBoost) to decouple malicious anomalies from natural operational fluctuations in Modbus TCP networks. By injecting expert domain knowledge directly into the feature space via fuzzy logic, the model effectively mitigates the semantic overlap of volumetric and temporal attacks. Experimental validation on a custom IEC 62443-compliant testbed demonstrates that the proposed architecture achieves a 100% overall accuracy and a macro-average F1-score of 0.98, successfully classifying attacks. Furthermore, cross-dataset validation on a public ICS dataset provides a broader scope and demonstrates a promising direction for future research in autonomous defense systems. Repository Contents: Datasets: Own dataset Normal session: session_Dataset_A_nominal_1775899586.jsonl Attack session: session_Dataset_B_attack_1775909136.jsonl Power System Attack Datasets - Mississippi State University and Oak Ridge National Laboratory, description: http://www.ece.uah.edu/~thm0009/icsdatasets/PowerSystem_Dataset_README.pdfAA Three classes, dowload link: site Source code: Python implementation for own testbed of the feature engineering pipeline, hyperparameter configurations, and the XGBoost classification engine: XGBoost_DD-FFH_own_testbed.py Python implementation for publicly available dataset MSU/ORNL power grid dataset of the feature engineering pipeline, hyperparameter configurations, and the XGBoost classification engine: XGBoost_DD-FFH_MSU_ORNL_Dataset.py Citation: If you utilize this code or dataset in your research, please cite our paper: <tbc>