Performance Evaluation of Machine Learning and Deep Learning Models for Real-Time Cyberattack Detection in Oil and Gas Networks
Abstract: The rapid digital transformation of the oil and gas industry has significantly improved operational efficiency through the integration of Information Technology (IT) and Operational Technology (OT) systems. However, this increased connectivity has also expanded the cyberattack surface, exposing critical infrastructure to increasingly sophisticated cyber threats such as ransomware, Advanced Persistent Threats (APTs), Distributed Denial-of-Service (DDoS) attacks, insider threats, and zero-day exploits. Traditional intrusion detection systems (IDSs), which primarily rely on predefined signatures and static rule sets, often fail to detect evolving attack patterns and frequently generate high false-positive rates. Consequently, Artificial Intelligence (AI), particularly Machine Learning (ML) and Deep Learning (DL), has emerged as a promising solution for intelligent cyber threat detection. This study presents a comprehensive performance evaluation of selected ML and DL algorithms for real-time cyberattack detection in oil and gas networks. Random Forest (RF), Support Vector Machine (SVM), Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM), and Transformer models were evaluated using benchmark cybersecurity datasets and a hybrid Operational Technology/Information Technology dataset representative of industrial environments. The models were assessed using classification accuracy, precision, recall, F1-score, false-positive rate, and detection latency to determine their effectiveness in identifying cyber threats under realistic operational conditions. Experimental results indicate that deep learning models consistently outperformed conventional machine learning algorithms in detecting sophisticated attacks. Among the evaluated models, the Transformer achieved the highest individual performance with an accuracy of 97.8%, while the CNN and LSTM models demonstrated strong capabilities in identifying spatial and temporal attack patterns, respectively. Random Forest remained the most effective traditional machine learning algorithm due to its computational efficiency and robustness. The findings provide valuable insights into the strengths and limitations of contemporary AI models and offer practical guidance for selecting appropriate intrusion detection techniques in industrial cybersecurity environments.