Turn it off and on again, but for critical infrastructure
KTH researchers trained a reinforcement-learning intrusion response agent on an emulated segmented OT network that autonomously resets hosts and processes to disrupt intruders.
Researchers at KTH Royal Institute of Technology built a containerized replica of a segmented industrial network, attacked it across 14 days, and captured 40,000 30-second traffic intervals to train a defense agent under partial observability. The agent observes six packet-count numbers per interval, maintains 500 running state hypotheses, and can reset supervisory hosts, water tank processes, or entire subnets, with resets rebooting the target, renewing credentials, and changing its IP. The best agent approached a full-visibility baseline but depends on an assumed attacker behavior model; the testbed comprised three supervisory hosts, two PLCs, two tanks, weak credentials, and CVE-2017-7494 exposure. The team released its implementation and plans validation on a real industrial testbed with a partner.
- Agent infers intrusion progress from six packet counts and chooses resets of hosts or tank processes.
- Best agent kept 500 state hypotheses and nearly matched a full-visibility baseline.
- Performance relies on a built-in model of attacker behavior, a transferability limitation.
- Testbed: 3 supervisory hosts, 2 PLCs, 2 tanks, weak credentials, CVE-2017-7494 exposure.
- Implementation released; real industrial testbed evaluation planned with a partner.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-7494 | Unauthenticated RCE in Samba via malicious shared library upload (SambaCry) CVE-2017-7494, widely known as "SambaCry," is a remote code execution vulnerability (CWE-94, code injection) in Samba versions since 3.5.0, fixed in 4.6.4, 4.5.10, and 4.4.14. A malicious client with write access to a share uploads a shared library to a writable share and then causes the Samba server to load and execute it, giving the attacker code execution on the host with the privileges of the Samba service. Because Samba is bundled with most Linux distributions and with NAS and other embedded devices, both enterprise Linux servers and consumer/small-business NAS appliances are affected; Debian also ships affected Samba packages. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2023-03-30) with known ransomware use, and public reporting ties it to the SambaCry, CowerSnail, ETERNALSILENCE, and SHELLBIND malware campaigns. EPSS assigns a 99.4% probability of exploitation within 30 days (100th percentile). Do: Upgrade Samba to 4.6.4 or later (4.6.x), 4.5.10 or later (4.5.x), or 4.4.14 or later (4.4.x/earlier), or install updated samba packages from your distribution (e.g., Debian) per vendor instructions, as required by the CISA KEV catalog. Until patched, remove or restrict write access on shares reachable by untrusted clients, and audit writable shares for unexpected shared-library (.so) files that may have been planted by attackers. Prioritize internet-facing Samba servers and NAS devices, given confirmed ransomware and IoT/NAS malware exploitation of this flaw. | 9.8 | 99% | KEV ransomware |
| massOn the order of hundreds of thousands of internet-exposed Samba/SMB servers and NAS devices; millions of installations in total |
Full article580 words · extracted from helpnetsecurity.com · click to collapse
Researchers at KTH Royal Institute of Technology built a container replica of a segmented industrial network, attacked it repeatedly across 14 days of running time, and used the captured traffic to train a defense agent that decides on its own when to intervene.
The agent sees six numbers per interval: packet counts crossing the network’s segments and moving to and from individual machines. From those counts it infers how far an intruder has progressed, and acts.
It can do nothing, reset one of three supervisory hosts, reset one of two water tank processes, or reset every host in the supervisory and control subnets at once. A reset reboots the target, renews its credentials, and changes its IP address. A reset can briefly interrupt industrial operations. An agent reading packet counts decides to bounce a running process, and the plant absorbs the outage.
The OT infrastructure of the intrusion response use case (Source: Research paper)
Most work in this area assumes the attacker is visible
Research on reinforcement learning for industrial intrusion response has mostly assumed the agent observes the system state or the attacker’s actions directly. The authors call that assumption unrealistic, and say the studies that do model partial observability tend not to explain where their observation model came from. So they measured one, running the emulated network in 30-second periods and collecting 40,000 of them. Even that was thin. Modeling how traffic varies with the full system state would take roughly 100 million measurements, so they estimated something simpler: how traffic varies with the attacker’s action alone. The packet counts are real. What the model can do with them is less than the math calls for.
The results, and the assumption underneath them
The best of the three agents the researchers trained keeps 500 running guesses about the state of the network, updates them every interval, and feeds a compressed version to its policy. It beat the two agents fed raw observation history and came close to a baseline agent handed full visibility into the system state. Feeding a policy four intervals of history instead of one made it worse.
There is a catch in how that estimate gets built. To update its guesses, the agent runs them through a model of how the system evolves, and that model includes how the attacker behaves. The agent performing closest to the full-visibility baseline is working from a description of the adversary it is defending against.
What transfers to a real network
The test network is three supervisory hosts, two PLCs, and two tanks. Both HMIs run HTTP with weak credentials, and the engineering workstation runs SSH, Telnet, and SMB, with weak credentials and exposure to CVE-2017-7494. The researchers did not study whether their model generalizes to other configurations or attack types.
The idea that transfers without any of the machinery is belief tracking. The learning agent and the paper‘s simpler threshold baseline both maintain a probability distribution over how far an intrusion has progressed on each asset, from undiscovered through scanned, exploited, and inspected, weighting each stage by what it would cost. A console showing the probability that a host has been exploited is buildable without reinforcement learning.
The researchers have released their implementation and plan to test the approach on an industrial testbed with a partner. They put operational safety in their future work, and note that it constrains what a defender strategy is allowed to do.
Download report: How security controls perform in practice
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/09/14/ot-intrusion-response-agent/