Toward Intelligent Infrastructure: MAIA, a Modular AI Architecture for Industrial Control Systems

Abstract

This work introduces MAIA, a Modular Artificial Intelligence (AI) Architecture for Industrial Control Systems (ICS), designed to support domain-specific, context-aware analysis in cybersecurity, plant operational efficiency, and operational technology (OT) personnel assistance. In alignment with IEC 62443 and related industrial standards, MAIA is designed for secure offline operation, efficient deployment on ICS-compliant hardware, real-time responsiveness, and explainable outputs understandable to OT personnel without expertise in Machine Learning (ML). The system integrates a DistilBERT model for classification and Phi-2 for Natural Language Generation (NLG), enabling low-latency analysis and interpretable Edge AI outputs without reliance on external cloud services. Its hybrid memory architecture supports short-term context tracking and long-term behavioural profiling, enabling the identification of both transient anomalies and evolving operational patterns. Cybersecurity has become a critical challenge in modern ICS environments, where connectivity is increasing, but many legacy protocols remain inherently unprotected. As the primary use case in this work, the MAIA-mb configuration implements Modbus TCP, a widely deployed yet insecure protocol that lacks encryption, authentication, and integrity mechanisms. MAIA-mb applies multi-layered AI analysis across the Modbus stack, combining deterministic validation and statistical modelling to detect structural, semantic, contextual, and payload-based anomalies. In addition, the architecture supports and extends both legacy and state-of-the-art ICS cybersecurity methods, thereby preserving existing protections while accommodating emerging approaches to ICS security. Alongside its cybersecurity focus, the MAIA-eei module extends the architecture to energy-efficiency monitoring and anomaly detection, enabling analysis and optimisation of plant energy consumption and, more broadly, process optimisation. Experimental validation was performed using real-world ICS hardware from a brownfield industrial plant, where MAIA was deployed to monitor supervisory-to-field communications and tested against simulated cyberattacks and energy-management scenarios.