Mitigating Cyber-Physical Attacks in ERP-Controlled Infrastructures through AI-Based Intrusion Response Systems

Abstract

Enterprise Resource Planning (ERP) systems are increasingly acting as the conductor of cyber-physical operations in the manufacturing, utilities, logistics, and healthcare sectors. This tight OT-IT integration enhances effectiveness but increases the attack surface: an attacker can use ERP identities and APIs and switch to plant-floor controllers or pollute master data to create recipes with wrong proportions or schedule so as to cause unsafe conditions. Suggest an AI-Based Intrusion Response System (AIRS) to be placed at the ERP-operations border and identify, describe, and securely handle multi-stage attacks on the fly. AIRS unites diverse telemetry ERP audit trails, identity and API activity, network/flow, PLC/SCADA tags and process KPIs into a graph-temporal model that maintains a relationship between users, assets, and work orders. Supervised and unsupervised detectors raise known and unknown behaviors and specification checks check control invariants. A reinforcement policy based on safety-shielded learning identifies the least disruptive moves e.g. isolating interface accounts, throttling risky releases of orders, reverting controllers to safe set-points the process and service constraints. Digital-twin sandbox is continually trained and tested, policies against realistic attack playbooks and faults, and SOAR translates to auditable runbooks that are compliant with IEC 62443 and MITRE ATT&CK applied to ICS. Trust and compliance are guaranteed by human-in-the-loop controls, counterfactual explanations as well as rollback plans. The tests of a hybrid ERP/ICS testbed show that the faster lateral-movement detection, lower MTTD/MTTR, and sustained availability with a small number of false-positive actions are feasible and offer a viable standards-preferred road to resilient ERP-controlled infrastructures