Bridging The Digital-Physical Divide: Transfer Learning For Unified Threat Correlation in Converged IT/OT/IOT Ecosystems - Dzreke, Simon Suwanzy (Economics and Business Journal (ECBIS), 2025)
The increased integration of operational technology (OT), Internet of Things (IoT), and business IT systems has allowed sophisticated attackers to circumvent isolated security features and launch cross-platform assaults. Current fragmented techniques, with discrete detectors monitoring Modbus, Kubernetes, MQTT, or other domain-specific protocols, cannot handle cross-system risks. These methodologies overlook 68% of multi-vector marketing that uses both physical and digital channels. This study introduces a transfer learning architecture to integrate detection capabilities by correlating threats across protocols, devices, and settings. The architecture generates a unified feature space that extracts behavioral semantics from industrial control system logs, cloud telemetry, network traffic, and device-level signals to produce protocol-agnostic threat representations. Adversarial domain adaptation and semantic graph embeddings enable cross-domain knowledge transfer with minimum retraining. Security teams may now discover kill chains like infected cloud containers preceding illegal PLC command execution every 23 minutes. Validated against real-world attack datasets from water treatment facilities (OT) and cloud infrastructure (IT), the system achieved 93.4% cross-platform attack recall, a 41.3 percentage point improvement over prior methodologies. It reduced OT data labeling by 89% and false positives by 93.5%. This paradigm shift transforms threat correlation from a reactive, domain-specific process to adaptive intelligence, boosting resilience for critical infrastructure, industrial ecosystems, and smart environments facing cyber-physical hazards. The framework's practical validation in energy, industry, and vital infrastructure shows its importance in protecting an increasingly linked world.