In The News
-Sathish Raman
A cybersecurity researcher on a different way to watch industrial networks, one that treats an intrusion as a shape rather than a list of separate events
Traditional cybersecurity detection misses evolving threats. Dr. Inguva’s research introduces an AI-driven approach for industrial networks, treating intrusions as ‘shapes’ rather than isolated events. Using graph neural networks, this method promises to proactively identify complex attacks, safeguarding critical infrastructure from vulnerabilities that current systems overlook.
A signature-based detector is really a memory. It holds a catalogue of attacks somebody has already seen, documented and turned into a rule. When traffic matches the catalogue, it fires. When traffic does not match, it stays quiet. That arrangement works well against yesterday’s attacks and much less well against the ones being built right now.
Dr. Naga Venkata Aswini Pavan Kumar Inguva has spent most of his research career on that gap. He holds a Ph.D. in Information Technology from the University of the Cumberlands and a master’s degree in computer science, taught as a professor in India before moving into industry, and has spent more than seven years working in enterprise technology in the United States. His research sits where artificial intelligence meets cyber defence, and his current work asks a question that sounds simple. If an attacker never triggers a rule, what exactly is a detector supposed to notice?
His answer starts with an observation about how most tools are built. They examine events one at a time. A login here, a file transfer there, a device reaching out to another device. Each event is scored on its own and judged innocent or suspicious in isolation. The trouble is that serious attacks rarely announce themselves in a single event. They unfold in stages, over time, moving quietly from one connected system to the next, and every individual step can look unremarkable while the sequence as a whole is anything but.
“Most existing detection approaches analyse network events individually without fully considering the relationships among industrial devices, communication patterns, and operational processes,” Inguva said. That is the blind spot he is trying to close.
The setting he has chosen makes the stakes concrete. Industrial control systems run water treatment plants, power infrastructure, factories and industrial automation. A breach in an office network costs data. A breach in these environments can interrupt a physical process that a community depends on, which is why detection there cannot simply be a matter of catching up after the fact.
His current research models an industrial control system as a graph. Rather than a queue of separate alerts, the network becomes a structure: devices as nodes, the communication between them as edges, and the timing of those interactions captured as temporal relationships. On top of that representation he proposes applying graph neural networks, a family of machine learning models designed to reason about connected data rather than isolated records. The framework defines a planned comparative evaluation across several graph architectures, including GCN, GraphSAGE, GAT and GIN, to establish which are best suited to the problem.
It is important to be precise about where this stands. The framework is research, not a product. Inguva designed the conceptual architecture, conducted the literature review across cybersecurity, graph machine learning and industrial systems, and built the graph representation methodology. What exists is a foundation for future implementation and comparative evaluation, and he describes it that way himself. The contribution at this stage is the argument and the design, not a deployed tool.
That argument has a certain logic to it. If an attack is a path through a system, then a detector that only ever sees points will keep missing paths. Modelling the relationships is what makes the shape of an intrusion visible at all.
He has approached the same problem from other directions in earlier published research, including work on cyber threat detection using generative adversarial networks, deep learning applied to network threat detection, machine learning for classifying cyber attacks, and data security built on nature-inspired algorithms. Some of that work received best paper awards. He is the author of two books and a number of peer-reviewed papers on cybersecurity and artificial intelligence, and he has written on digital safety and emerging threats for mainstream outlets including The Indian Express and Deccan Chronicle.
His research is not conducted at a remove from practice. Inguva works as a senior software developer for a US state government agency, building and modernising enterprise applications including telecommunications and network systems, and he co-founded Thaapasi Smart Infratech Pvt. Ltd. That daily exposure shapes what he considers a useful result. “Innovation must be practical,” he said. “Artificial intelligence and machine learning offer tremendous potential for improving cybersecurity, but successful implementation requires solutions that are explainable, scalable, and aligned with real world operational requirements.” A model that cannot explain itself to an analyst, or cannot run inside an existing workflow, does not survive contact with an operations centre.
He expects the ground to keep shifting under this problem. “As industrial environments become more connected through Industrial IoT, smart manufacturing, and digital transformation initiatives, cybersecurity must evolve beyond protecting individual PM devices,” he said. “Future security solutions should understand how systems interact across operational technology and information technology environments.”
Which returns to the point he keeps making about sequencing. “Cybersecurity should be integrated into system design rather than added after deployment,” he said. A detector bolted onto a finished system inherits whatever blind spots the design left behind. Building for the connections from the start is how you get to see them at all.
