THEORETICAL APPROACH TO THE APPLICATION OF MACHINE LEARNING METHODS FOR ASSESSING THE RISKS OF CRITICAL INFRASTRUCTURE FACILITIES

Abstract

The relevance of this study is driven by the growing cyber threat landscape affecting critical infrastructure amid the convergence of information technology and operational technology and the expansion of attack surfaces through cloud services, remote access, and supply chains. In civil aviation, these challenges are particularly sensitive because disruptions in information and communication systems may affect flight regularity, ground operations, passenger services, and the resilience of airport engineering infrastructure.

The problem addressed in the paper is the limited effectiveness of purely reactive risk management, insufficient visibility in technological networks, and the difficulty of timely incident prioritization. The purpose of the article is to substantiate an intellectualized cyber risk assessment approach based on machine learning to improve detection timeliness and response effectiveness while aligning with NIS2 and CER requirements and sector-specific guidance. The proposed solution is a process-oriented model in which machine learning is integrated with ISO IEC 27005, NIST SP 800-30, and the zone-and-conduit principles of IEC 62443. The paper summarizes key threat vectors relevant to critical infrastructure and aviation, including remote access compromise, supply chain attacks, and exploitation of known vulnerabilities with mitigation prioritization guided by the KEV catalog.

A hybrid machine learning strategy is justified by combining classification, regression, clustering, and anomaly detection, along with a feature engineering approach that leverages security logs, vulnerability indicators, OT telemetry, and asset criticality context for airports and airlines. The main result is a concept of a multi-layer risk assessment architecture covering data collection and normalization, feature generation, controlled model lifecycle management, and integration of risk outputs with SOC processes and the risk register. The conclusions demonstrate that the approach provides a reproducible and auditable basis for risk-driven response prioritization in civil aviation information and communication systems and outlines directions for further enhancement through richer feature sets and analytical modules.