Using Kolmogorov–Arnold network for cyber–physical system security: A fast and efficient approach

Abstract

A cyber–physical system (CPS) is the foundation of modern industrial infrastructures but is vulnerable to cyber attacks due to its connectivity. Detecting these attacks is crucial, driving research into machine learning and deep learning-based models for intrusion detection systems. Many of these models, though effective, suffer from high computational complexity and large parameter counts, limiting their practicality for real-time deployment. Additionally, extensive data preprocessing, commonly used in attack detection, can introduce drawbacks such as loss of critical information, reduced interpretability, and increased latency. This paper employs the Kolmogorov–Arnold network (KAN) as a lightweight and efficient alternative to conventional models for attack detection in CPSs. With a compact architecture and significantly fewer parameters, KAN achieves high classification accuracy while minimizing computational overhead. It eliminates the need for complex feature extraction and preprocessing, preserving data integrity and enabling faster decision-making. Evaluated on the SWaT, WADI, and ICS-Flow datasets, KAN demonstrates superior performance in detecting cyber attacks across binary and multi-class tasks on both physical and network data. Its low inference time and minimal resource requirements make it a practical solution for real-time CPS security.