7 papers
Digital Twin-Assisted Mapping of ICS Telemetry to ATT&CK for ICS with Evidence-Driven Dependency Reasoning
Konstantinos E. Kampourakis, Vyron Kampourakis, Vasileios Gkioulos +1
Reconstructing adversarial behavior from Industrial Control System (ICS) telemetry is difficult because process observations reveal physical changes more directly than the actions…
Detect First, Explain Later: Training-Free Temporal-Memory Digital Twin Anomaly Detection with Post-Hoc LLM Interpretation for ICS
Konstantinos E. Kampourakis, Vasileios Gkioulos, Sokratis Katsikas
Industrial Control Systems (ICS) are increasingly exposed to cyber-physical attacks that manifest as subtle and temporally evolving deviations in process behavior. Detecting such a…
ICS Cybersecurity Datasets: A Systematic Meta-Review of Coverage, Evaluation Practice, and Structural Gaps
Konstantinos E. Kampourakis, Vyron Kampourakis, Georgios Kambourakis +4
Intrusion detection research in Industrial Control Systems (ICS) heavily depends on public datasets, yet no prior work has systematically assessed whether the collective dataset co…
Digital Twin Degradation: Detecting Cyber Physical Attacks via Temporal Inconsistencies
Konstantinos E. Kampourakis, Vasileios Gkioulos, Sokratis Katsikas
Digital Twins (DTs) are increasingly used to monitor and analyze Cyber Physical Systems (CPS). However, in adversarial environments, the fidelity of a DT cannot be assumed. Communi…
Between Zeros and Ones: Behavioral Characterization Beyond Binary Labeling Across Public ICS Datasets
Konstantinos E. Kampourakis, Vyron Kampourakis, Georgios Spathoulas +1
Intrusion detection in Industrial Control Systems (ICS) is typically evaluated on a small set of public benchmarks using binary ``normal'' versus ``attack'' labels, a practice that…
Systematic Integration of Digital Twins and Constrained LLMs for Interpretable Cyber-Physical Anomaly Detection
Konstantinos E. Kampourakis, Vasileios Gkioulos, Sokratis Katsikas
Cyber attacks targeting Industrial Control Systems (ICS) have become increasingly sophisticated and hard to identify. Detecting such attacks requires integrating low-level behavior…
Knowledge-to-Data: LLM-Driven Synthesis of Structured Network Traffic for Testbed-Free IDS Evaluation
Konstantinos E. Kampourakis, Vyron Kampourakis, Efstratios Chatzoglou +2
Realistic, large-scale, and well-labeled cybersecurity datasets are essential for training and evaluating Intrusion Detection Systems (IDS). However, they remain difficult to obtai…