Uncertainty-Aware Intrusion Detection and Prevention for DDS-Based SCADA Systems

Supervisory Control and Data Acquisition (SCADA) deployments increasingly adopt publish–subscribe middleware to improve scalability, latency, and interoperability across heterogeneous field sites. Data Distribution Service (DDS) is a prominent real-time publish–subscribe standard that provides fine-grained Quality-of-Service (QoS) controls and security extensions, yet its data-centric communication model also introduces distinct attack surfaces, including topic spoofing, unauthorized publishers/subscribers, replay and delay injection, QoS abuse, and control-relevant data poisoning. This paper presents an intrusion detection and prevention system tailored to SCADA-over-DDS, emphasizing uncertainty-aware, autonomous decision-making. We evaluate the framework using replayed industrial control system traces in an emulated industrial testbed designed to approximate DDS-SCADA deployments, and additionally perform cross-dataset generalization experiments and a closed-loop digital twin simulation to assess cyber-physical coupling. No live physical process or operational industrial site was used. The framework formalizes SCADA-over-DDS as a closed-loop cyber-physical system with a middleware-mediated observation channel and proposes a multi-layer architecture that (i) fuses protocol, timing, and control-invariant signals; (ii) quantifies epistemic uncertainty for detection outputs; and (iii) executes prevention actions through a risk-sensitive policy constrained by control-safety envelopes. Under the evaluated conditions, the framework demonstrates detection accuracy (F1 > 0.93), inference latency (<250μs), and tamper-evident logging with measurable advantages including 54% reduction in false alarms and 79% fewer operator notifications over deterministic baselines and centralized database alternatives.