Researchers at Texas A&M University’s Clean and Resilient Energy Systems (CARES) Laboratory have developed a new cybersecurity framework designed to detect hidden cyber threats targeting critical infrastructure such as power grids, microgrids, and water systems. The system, called Reactive Autoencoder Defense for Industrial Adversarial Network Threats (RADIANT), strengthens defenses against stealth cyberattacks—those that disguise malicious activity as legitimate operational data.
In industrial control systems, stealth attacks are particularly dangerous because they can manipulate data streams to appear normal while causing physical harm or service disruptions. These attacks have grown more sophisticated as utilities and process industries increasingly rely on digitalized and AI-enhanced control systems.
“RADIANT was designed to maintain reliable detection even when attackers attempt to deceive machine learning systems,” explained Dr. Irfan Khan, Assistant Professor of Marine Engineering Technology at Texas A&M Galveston and affiliated faculty in Electrical and Computer Engineering. “Our goal is to sustain operator confidence and detection accuracy without costly retraining or downtime.”
RADIANT functions as a reactive defense layer that sits on top of existing intrusion detection systems (IDS). Instead of relying on constant retraining—which many current IDS models require—RADIANT reconstructs incoming network data and identifies inconsistencies indicative of adversarial manipulation.
In a peer-reviewed paper published in IEEE Transactions on Industrial Informatics, the research team demonstrated that RADIANT reduced false negatives by over 30% when tested against advanced stealth variants that had successfully evaded conventional machine learning models.
The system also showed improved adaptability against “zero-day” adversarial samples, detecting anomalies in milliseconds—crucial for preventing cascading failures in interconnected networks such as regional power grids.
The introduction of RADIANT represents a step forward for AI-integrated infrastructure resilience. The system can be deployed within substations, microgrids, or process plants without disrupting existing configurations, making it a practical option for utilities and energy operators seeking enhanced cyber protection.
“RADIANT’s deployment-oriented design makes it suitable for field integration,” said Syed Wali Abbas Rizvi, Ph.D. candidate and lead author of the study. “It enhances robustness against stealth attacks while maintaining low computational overhead.”
Industry analysts see this as part of a larger trend toward AI-driven cybersecurity for critical infrastructure. MarketsandMarkets forecasts that the AI in cybersecurity market will grow from $22.4 billion in 2023 to $60.6 billion by 2028, driven by industrial and energy-sector adoption.
The Texas A&M team plans to extend testing to adaptive adversaries—attackers that can dynamically adjust tactics based on defense feedback—and will run operator-in-the-loop simulations to study how human decision-making is affected by AI-assisted alerts.
This research is supported by the Office of Naval Research, which is funding several projects aimed at fortifying maritime and coastal infrastructure against both digital and physical threats.
“The stakes are high,” Khan noted. “A stealth attack on a regional grid or water utility could ripple across multiple systems before being noticed. RADIANT helps close that gap.”
