The increasing number of multi-stage attacks has brought severe cybersecurity threats to industrial control system (ICS), making it crucial to develop autonomous and effective intrusion response systems (IRS). Most existing IRS approaches depend on the idealized assumption that the system state is perfectly known and directly available for intelligent control decisions. However, this assumption is rarely satisfied in practice, as state information is typically incomplete and only partially observable, which severely limits the applicability and effectiveness of these methods. To address this challenge, we propose a model-free intrusion response approach (MFIR) tailored to ICS with partially observable states. We formulate intrusion response as a partially observable Markov decision process and construct a simulated ICS with incomplete state observations. Then we use a recurrent neural network to infer the hidden complete states from historical observation sequences, thereby avoiding reliance on prior knowledge such as transition or observation probabilities. Based on the inferred states, we develop a deep reinforcement learning algorithm with a dual-branch neural network to make response decisions. Experiments on a Tennessee Eastman-based ICS testbed demonstrate that MFIR outperforms existing approaches, achieving up to 32.86% higher total reward, fewer compromised nodes, and lower defense cost under various observability levels. These results verify that the proposed approach is well-suited for intrusion response in partially observable ICS environments.

The Internet-of-Things (IoT) technology is widely used in various fields. In the Earth observation system, hyperspectral images (HSIs) are acquired by hyperspectral sensors and always transmitted to the cloud for analysis. In order to reduce cost and reply promptly, we deploy artificial intelligence (AI) models for data analysis on edge servers. Subspace clustering, the core of the AI model, is employed to analyze high-dimensional image data such as HSIs. However, most traditional subspace clustering algorithms construct a single model, which can be affected by noise more easily. It hardly balances the sparsity and connectivity of the representation coefficient matrix. Therefore, we proposed a postprocess strategy of subspace clustering for taking account of sparsity and connectivity. First, we define close neighbors as having more common neighbors and higher coefficients neighbors, where the close neighbors are selected according to the nondominated sorting algorithm. Second, the coefficients between the sample and close neighbors are reserved, incorrect, or useless connections are pruned. Then, the postprocess strategy can reserve the intrasubspace connection and prune the intersubspace connection. In experiments, we verified the universality and effectiveness of postprocessing strategies in the traditional image recognition field and IoT field, respectively. The experiment results demonstrate that the proposed strategy can process noise data in the IoT to improve clustering accuracy.