OSB Watchtower

The IEEE Challenge

This project was developed for the TSYP13 Technical Challenge organized by the IEEE IAS Tunisia Section Chapter. The challenge asked participants to create practical and scalable Industry 4.0 solutions in three areas: energy management, industrial control and cybersecurity, and workplace safety. Our project focused on industrial cybersecurity.

Project Goal and Solution

OSB Watchtower is a federated threat detection system for industrial environments. It uses a CNN-LSTM to detect current attacks and a network-aware GNN to predict possible next attack techniques. Facilities train the models together by sharing protected model updates instead of raw network data. The system uses the DNN-EdgeIIoT dataset, MITRE ATT&CK knowledge, differential privacy, and robust aggregation.

What Is Federated Learning?

Federated Learning is a way to train one machine learning model using data from several organizations without moving their private data to one central place. Each organization trains the model locally, shares model updates, and receives an improved global model. This allows organizations to learn together while keeping their original data private.

The Two Deep Learning Models

OSB Watchtower uses two complementary deep learning models. The first model detects attacks that are happening now, while the second model predicts what an attacker may do next.

CNN-LSTM for Attack Detection

The CNN-LSTM model analyzes network traffic and classifies it as normal or malicious. The CNN layers extract important patterns from network packet features, while the LSTM layers learn how these patterns change over time. This combination helps the system detect both individual suspicious activities and attack sequences.

The model can classify several attack types, including DDoS, port scanning, vulnerability scanning, SQL injection, brute-force attacks, ransomware, man-in-the-middle attacks, and data exfiltration. Its output is used to identify the current state of a possible attack.

GNN for Attack Prediction

After an attack is detected, the network-aware Graph Neural Network predicts possible next steps. The graph represents relationships between attack techniques from the MITRE ATT&CK for ICS framework. It also includes network information, such as packet counts, byte counts, and transition patterns.

This allows the GNN to combine security knowledge with the current network context. For example, after detecting a port scan, the model can predict that lateral movement or program download may happen next. This gives security teams more time to prepare a response instead of only reacting to an attack after it happens.

The two models work together: the CNN-LSTM detects the current threat, and the GNN helps predict its possible progression. Their model updates can then be trained through the federated learning process without sharing the facilities’ raw network data.

Architecture

OSB Watchtower architecture

Teamwork

As my first experience as a team lead, leading a team that worked on different components taught me that good communication is the backbone of any successful project.

The work was divided into different parts, including attack detection with CNN-LSTM, attack prediction with GNNs, federated learning, privacy protection, backend services, and technical documentation. Each person focused on specific tasks while keeping regular communication with the rest of the team so that all parts could work together.

The project introduced us to new technologies and concepts, including Federated Learning, Graph Neural Networks (GNNs), and the MITRE ATT&CK framework.

We finished sixth out of 30 teams, but the real achievement was how much we grew and learned together during the challenge.

Technologies

TensorFlow and PyTorch
Flower for federated learning
Graph Neural Networks for attack prediction
MITRE ATT&CK for ICS
Differential privacy with Opacus
PostgreSQL, Redis, Neo4j, and Kafka
FastAPI and React