Cybersecurity Frameworks for Critical Infrastructure Protection: A Multi-Layer Defense Approach Using AI and Zero-Trust Architecture

Abstract

Critical infrastructure systems including power, water, transport, and healthcare face an evolving cybersecurity threat landscape characterised by sophisticated nation-state actors, ransomware operators, and the convergence of operational technology (OT) and information technology (IT) networks. This paper proposes and evaluates a multi-layer cybersecurity framework integrating AI-based threat detection with zero-trust architecture for critical infrastructure protection. The framework comprises six layers: (1) perimeter defence with adaptive policies; (2) network segmentation and micro-segmentation; (3) identity and access management with continuous authentication; (4) AI-based anomaly detection; (5) Security Information and Event Management (SIEM) with Security Orchestration, Automation, and Response (SOAR); and (6) incident response and recovery. AI components include an autoencoder-plus-LSTM hybrid for network anomaly detection (latent dimension 32, sequence length 100) and a Graph Neural Network (GNN) for attack path analysis (3-layer GraphSAGE). Evaluation on a SCADA simulation testbed using CICIDS2017, UNSW-NB15, and a custom OT attack dataset achieved precision of 0.971, recall of 0.962, F1 of 0.967, false alarm rate of 0.024, and average detection time of 1.7 seconds. Performance compared favourably with baseline IDS (Snort, Suricata, Zeek), with false alarm rate reduced by 38 per cent relative to Suricata. The framework was evaluated under adversarial conditions (FGSM, PGD attacks) demonstrating reasonable robustness. The paper contributes a comprehensive architectural framework, deployable AI components, and detailed evaluation methodology for emerging-economy critical infrastructure protection.