AI models guarding water and power

0:00In today's digital age, your data is everywhere, and it's constantly at risk. Traditional methods with fragmented legacy tools just don't cut it anymore. They make everything slower, more complex, and a lot harder to manage when things go awry. That's exactly why Cohesity Data Cloud is a game changer. With one AI-powered platform, Cohesity enables you to not only protect and secure your data, but also to unlock valuable insights. You can detect threats earlier with AI and automation and recover your data in hours, not days. It's not just about reacting. It's about building resilience across AI, cloud, and identity. To learn more, visit Cohesity.com slash data cloud. Cohesity, resilience everywhere. Shop Vons and Albertsons for fresh savings every time you shop. This week at Vons and Albertsons, get fresh, boneless, skinless chicken breasts for $199 per pound limit 10 pounds. And locally grown, grape-ary cotton candy grapes are $299 per pound with digital coupon. Plus, 24 packs of Canada Dry or 7-Up 12-ounce cans are $499 limit 1 with digital coupon.

1:05Enjoy fresh and delicious savings for every meal. Hurry in! These deals won't last. Visit vonsoralbertsons.com for more deals and ways to save. You can't predict the future, but you can prepare for it. Arizona State University is building degrees for what's ahead. Programs designed around emerging fields taught by faculty whose research is shaping our future. Not just teaching about it. It's why we've been ranked number one in innovation for more than a decade. Your future is worth preparing for, and you don't have to prepare alone. Become future-ready. Explore more than 400 programs at ASUOnline.asu.edu. That's a degree better. Right now, as you're listening to this, there are literally thousands of invisible completely automated cyber attacks just hammering the power grid. You know, the exact same grid that's keeping your device charged right this second. Yeah, and it's wild because it is entirely invisible. I mean, it's happening constantly right under our noses.

2:06Exactly. And the only thing stopping a massive citywide blackout right now isn't some human operator sitting behind a desk reacting to a blinking red light. It's actually a mathematical equation operating in milliseconds. It really is. The scale of the threat against our critical infrastructure is, honestly, it's something most of us just never want to think about. We just expect the tap to flow and the lights to turn on. Right, but the reality of operating these water treatment facilities and the modern power grid is that, well, it's basically a war zone. And the weapons being used to defend these systems have evolved incredibly fast. Oh, absolutely. So welcome to another deep dive. Today, we are looking at the invisible safety net keeping modern society running, you know, our critical infrastructure. And we've got a really fascinating stack of sources for you today tracking this profound shift in how these systems survive. We've got some great material to get into. Yeah, we are looking at academic papers covering AI driven predictive maintenance in water treatment facilities, plus a highly complex hybrid deep learning

3:07model, specifically a CNN LSTM architecture, which is used to detect cyber attacks on smart grids, which is just incredible tech, by the way. It really is. And we also have an incredible study on using large language models to actually translate these cyber threats in real time, right? Because the overarching mission here is to explore how artificial intelligence has really evolved from, you know, just a generative novelty into the ultimate shield. We are talking about AI systems designed to protect our most vital resources from both internal physical decay and external highly sophisticated malicious attacks. Okay, let's unpack this. Let's start with the physical world first. The water we drink, water treatment facilities operate in what has to be like one of the absolute harshest industrial environments on earth without a doubt. It's brutal in there. Right. You have incredibly strict environmental and health regulations, massively growing populations and the physical equipment itself is just under constant assault. Exactly. Because when you look at the engineering inside a modern water treatment plant, it is just

4:11astonishingly complex. I mean, you have high pressure centrifugal pumps, these incredibly delicate reverse osmosis filtration membranes, precision chemical dosing units, all working together 24, 7, right? And all of these interconnected mechanical and electrical systems are constantly exposed to moisture, harsh chemicals, biological fouling and extreme pressure differential. So, you know, they inevitably degrade. It's just a matter of physics. And for anyone listening who follows industrial tech, we know that historical maintenance models like just waiting for a catastrophic failure or maybe swapping parts out on a rigid calendar-based schedule are completely inadequate for this level of complexity. Yeah, they are just way too blunt because in a complex water treatment environment, fluid dynamics and chemistry, well, they just don't care about your calendar schedule. Right. So, swapping out a massive, expensive industrial pump just because a spreadsheet says, you know, it's been six months, that just leads to incredibly inefficient resource utilization. It's like changing your car's oil exactly every 3,000 miles, whether it actually needs it or not.

5:12Precisely. Or worse, the pump fails at month five because of an unseen cavitation issue and suddenly you have compromised water quality and well, potential regulatory fines. So, the solution presented in our sources is AI PDM, right? AI-driven predictive maintenance. But how does this actually function in such a chaotic environment? Because water chemistry isn't perfectly predictable. Well, what's fascinating here is how the AI synthesizes disparate streams of physical data to basically find the signal in the noise. AI PDM uses machine learning algorithms fed by real-time sensor networks across the entire facility. So, it's pulling in data from everywhere all at once? Exactly. It's not just looking at one metric. It is constantly correlating microscopic shifts like it tracks a 0.5 degree temperature rise in a motor casing. Cross references that with a slight change in the vibration frequency of a rotor. Oh, wow. Yeah, and then factors in a fractional drop in pressure across a filtration membrane.

6:12So, it's looking at the holistic state of the machine in real-time. It's like a car analyzing its own internal chemistry on the fly until you exactly when the oil is going to break down. It's a perfect way to look at it. Yes, and then it cross references all of that real-time telemetry with decades of historical maintenance records and degradation curves. So, it finds the invisible mathematical patterns that precede a physical failure. Wait, so it's not just telling you the machine is broken. It's forecasting the exact vector of degradation before it even manifests physically. Precisely. And this fundamentally changes how a facility operates. Because now operators can perform maintenance only when it's warranted by actual granular equipment conditions. Which saves a ton of money, I imagine. Oh, absolutely. It optimizes spare parts management, so you aren't warehousing expensive components you don't actually need. And it ensures total process stability for the entire water supply. I think that's the real insight here. We are shifting the entire timeline of infrastructure. Like we are moving from a society that repairs the past fixing things after they break

7:15to one that mathematically repairs the future before the damage even occurs. That is a profound way to look at it, really. But we should definitely note the research highlights that this transition is incredibly difficult in practice. Right, because theory is clean, but the physical world is always messy. So what are the actual barriers to getting this running? Well, first and foremost is data quality. I mean, AI is entirely dependent on the integrity of its data pool. Yep. If your physical sensors are calcified, miscalibrated, or just degrading themselves in this harsh environment, well, the AI is learning from bad data. Garbage in, garbage out. Exactly. Second is the integration piece. Trying to integrate cutting edge cloud capable AI with legacy highly isolated industrial control systems, which might be, you know, 20 years old, is an absolute integration nightmare. Oh, why that? And finally, there's the workforce gap. You need operators who possess a really rare overlap of skills. They need an innate understanding of water chemistry and mechanics

8:16combined with the ability to interpret machine learning outputs. Yeah, that's not exactly a common resume. So in water systems, we have this massive flood of physical environmental data and the AI's jobs to find the signal and the noise to predict a physical decay over, say, weeks or months. Right. In today's digital age, your data is everywhere, and it's constantly at risk. Traditional methods with fragmented legacy tools just don't cut it anymore. They make everything slower, more complex, and a lot harder to manage when things go awry. That's exactly why Cohesity Data Cloud is a game changer. With one AI-powered platform, Cohesity enables you to not only protect and secure your data, but also to unlock valuable insights. You can detect threats earlier with AI and automation and recover your data in hours, not days. It's not just about reacting. It's about building resilience across AI, cloud, and identity. To learn more, visit Cohesity.com slash data cloud. Cohesity resilience everywhere.

9:17Shop vans and Albertsons for fresh savings every time you shop. This week at vans and Albertsons, get fresh, boneless, skinless chicken breasts for 199 per pound limit 10 pounds, and locally grown grape-ery cotton candy grapes are 299 per pound with digital coupon. Plus, 24 packs of Canada Dry or 7-up 12-ounce cans are 499 limit 1 with digital coupon. Enjoy fresh and delicious savings for every meal. Hurry in! These deals won't last. Visit vans or Albertsons.com for more deals and ways to save. Rubric is the security and AI operations company. Build for what happens after an attack hits. Not just the moments before. AI has turned the threat landscape into quicksand, moving too fast for any human to fully predict. That's why an agentic cyber resilience platform matters. Automated recovery, clean data, a business that keeps moving, no matter what hits. One platform, not a patchwork of stitched together tools and gaps. Don't wait for the next attack. Secure and accelerate your business at rubric.com. Again, rubric.com.

10:18But when we pivot to the power grid, we are dealing with a slow physical decay. We are dealing with an active digital enemy. And that data flood is moving in milliseconds. It's an entirely different battle space. If we look at the evolution of this smart grid, it represents a fundamental shift in energy management. I mean, the grid is no longer just a one-way pipeline from a coal plant to your house. It's way more interactive now. Exactly. It utilizes information and communications technologies, ICT and massive IoT integration to create a constant two-way flow of both power and data. Which is structurally necessary for modern energy, right? Because you need that two-way communication for dynamic demand response. You know, balancing supply and demand instantly. And for integrating decentralized, newable energy sources like wind and solar, which are obviously highly volatile based on the weather. That's right. The engineering fee of the smart grid is a marvel truly. But structurally, that two-way communication radically expands the attack surface.

11:18And the core vulnerability lies in the legacy systems running the grid, specifically the SCADA systems. SCADA, meaning supervised recontrol and data acquisition. Right. SCADA is basically the brain of the grid. It connects all the field equipment, the remote terminal units, sensors, circuit breakers, to the centralized human control centers. OK. The critical flaw, though, is in the communication protocols, these SCADA systems were by on. The sources highlight DNP3, which is the backbone protocol in North America. And IEC 608705104, which is commonly used elsewhere. And these protocols were designed decades ago, right? Like, well before anyone even conceived of a connected internet. Precisely. They were built for closed, isolated serial networks, where the only thing on the wire was grid data. And because of that old architecture, they completely lack fundamental security features. Like what? Zero authentication, zero encryption. Wow. So they just inherently trust whatever data packet they received as long as it's formatted correctly.

12:19Exactly. Which leaves them incredibly vulnerable to denial of service or DOS attacks. OK. And just to be clear on the mechanics of a DOS attack in this specific context. The attacker is flooding the SCADA network with so much junk traffic that the centralized system just gets overwhelmed. But what does that actually do to the physical grid? It blinds the operators. Grid operators rely on a process called dynamic state estimation. Because electricity is consumed the exact millisecond it's generated, operators need a continuous real-time mathematical model of the grid state. Right. They have to know exactly what's happening everywhere instantly. Yes. So if a DOS attack floods the communication channels, those real-time measurements stop arriving. The operators are suddenly flying blind. They don't know if they are over generating, which fries the transmission lines or under generating, which causes rolling brownouts. They can't see physical faults. And they can't send control orders to balance the load. OK. Here's where it gets really interesting. If we know that protocols like DNP3 and IEC 104 are unencrypted,

13:23unauthenticated, and just structurally insecure, why don't grid operators just patch them? Like push it over the air firmware update, like we do on our smartphones, rewrite the foundational code, and just add encryption. Well, if we connect this to the bigger picture, it really comes down to the reality of critical infrastructure. You simply cannot reboot civilization. Oh. Right. You can't just take the entire Eastern interconnection offline for a weekend to run a software update. I mean, people are in surgery, traffic grids are live. Exactly. These are continuous life-critical legacy systems. Adding encryption to an ancient protocol introduces computational overhead and latency that the legacy hardware simply cannot process in real time. The old hardware just can't handle the new math. Right. So because we cannot alter the foundational code, we have to build overlay defenses. We have to build an intelligent shield around the vulnerable protocols, which brings us to intrusion detection systems or IDS. But the sources are pretty clear that traditional IDS is failing.

14:23It is because traditional IDS is rule-based. It relies on known signatures of past attacks. It's essentially just a massive blacklist. But modern state-sponsored actors and automated botnets are generating novel, zero-day attacks continuously. So they're coming up with stuff we've never seen before? Exactly. Cyber threats are evolving too rapidly for rules. We need an autonomous system that doesn't just look for a known bad signature, but dynamically learns the mathematical baseline of what normal grid traffic looks like, and then instantly identifies complex never-before-seen anomalies. Which leads us to the core solution in our smart grid sources, the hybrid CNN LSTM deep learning model. I really want to spend some time here because the architecture is just fascinating. For those listening, let's break down the two halves of this AI. CNN stands for convolutional neural networks. And these are traditionally used in image processing, because they are incredible at extracting spatial feeders. They recognize complex patterns in a static space. And then LSTM stands for long short-term memory.

15:26This is a type of recurrent neural network designed to handle sequential time series data. It has a memory state, allowing it to understand what happened a minute ago, and how it relates to what is happening right now. Yes. If you conceptualize it structurally, the CNN is analyzing the structural shape of the network traffic data packet in the isolated moment, while the LSTM is tracking the behavioral sequence of those packets over time. I picture it like a highly trained security guard at a sensitive facility. The CNN part of their brain recognizes the exact physical shape of a suspicious lock pick in someone's hand at the gate. But the LSTM part of their brain remembers that this exact same individual was pacing nervously outside the perimeter fence three hours ago. That is a brilliant analogy. It's the synthesis of the immediate spatial pattern and the historical temporal sequence that triggers the threat alarm. Exactly. And the architecture of this hybrid model, as detailed in the source paper, achieves the synthesis beautifully. So the raw network traffic data is fed into the system, starting with three CNN blocks.

16:29These convolutional layers use randomly initialized filters to basically extract hierarchical spatial features from the raw data. Okay, I'm with you. And after each CNN layer, they apply a max pooling layer to downsample the data. Wait, let me pause you right there. Downsample. If we are looking for incredibly stealthy anomalies like a needle in a digital haystack, why are we intentionally throwing away data? It's a great question. You aren't throwing away the important data. You are basically discarding the noise. Max pooling extracts the most prominent dominant features from the convolutional layer while drastically reducing the spatial dimensions. Okay, so it shrinks it down. Right. This reduces the computational complexity and the memory footprint. Remember, this model has to evaluate millions of packets and make a binary threat decision in milliseconds. If it evaluates every single piece of redundant background noise, the latency would allow the attack to succeed. Got it. So it isolates the highest value threat indicators so it can move fast. Exactly. Then this process spatial data is flattened into a one-dimensional vector

17:31and concatenated or joined together with the temporal features coming out of two LSTM layers. The first LSTM layer has 128 hidden units and the second has 64 units, allowing it to capture incredibly complex long-term sequential dependencies in the traffic flow. So it's weaving the spatial shape of the attack and the timeline of the attack into one unified data stream? Yes. And to ensure the model actually generalizes well to new attacks, they use a dropout layer at a rate of multi-point-4 during the training phase. Wait, hold on. You're losing me. A dropout layer of point-4 means they're literally turning off 40% of the neural connections during training. Why are we randomly lobotomizing the AI? Doesn't that just make it dumber? Well, it actually forces it to be smarter. Really? Yeah. Deep learning models are prone to a phenomenon called overfitting. Think of it like a student who memorizes a highly specific textbook to pass a test, but doesn't actually learn the underlying concepts. Ah, so if the questions change, they fail. Exactly. If you give that student a problem query slightly differently, they bomb the test.

18:33By randomly deactivating 40% of the neurons during training, the network cannot rely on any single dominant pathway to identify an attack. It forces the entire network to learn robust, redundant, generalized patterns. It learns the concept of an attack rather than just memorizing a specific training set. That is wild. It's basically building structural resilience into its own mathematical reason. Exactly. And finally, all of this spatial and temporal data feeds into a sigmy classification layer. This layer crunches everything into a probability score between 0 and 1, outputting a final prediction is this normal grid traffic or is this a cyber attack? And the performance results from the source data. Staggering, honestly, when trained and tested on data sets containing highly realistic, complex cyber attacks against scatter protocols, the hybrid model achieved an accuracy of 99.68% on the DMP3 data set and 99.70% on the IEC 104 data set. Wow. With virtually zero false positives, which is obviously critical.

19:35You don't want the AI shutting down grid communication just because it got spooked by normal load balancing. Exactly. It operates with a nearly 100% detection rate. But despite these incredible metrics, the source is highlight a massive operational bottleneck. Catching a zero-day attack in milliseconds with 99.7% accuracy is an absolute triumph of network engineering. But deep learning models are notoriously opaque. They are black boxes. And that is the operational reality of the control room. The CNN LSTM model is incredibly fast and accurate, but it only outputs a probability score. Let's visualize this. The model detects a highly sophisticated anomaly targeting a regional substation. The human grid operator sees a flashing red alert on their dashboard that just says anomaly detected 99.7% probability. So the AI knows it's an attack, but it doesn't explain why it's an attack. Exactly. A high percentage score does not tell the human operator what the attacker is specifically trying to do, which protocol they are exploiting or most importantly, how to mitigate it.

20:35When the grid is under active attack, seconds dictate whether a region goes dark. The operator cannot waste five minutes reverse engineering the data packet to understand the vector. They need immediate context. They need a translator. Which brings us to our final source, and a fascinating application of a technology that is dominating the current conversation. Large language models. We are looking at studies using LLMs, the underlying architecture behind things like chat GPT, as explainable cyber attack detectors for energy industrial control systems. Yes, the application of LLMs here directly solves the black box problem of deep learning. But I have a major security question right out of the gate. If I am running a critical, highly vulnerable, scatter system, there is zero chance I am opening an API connection to a public cloud-based LLM. Connecting the core of the power grid to an external AI server defeats the entire purpose of isolated security. How is this actually applied safely? That is the critical distinction here. These are not public cloud-hosted models.

21:37The research relies on utilizing open source LLMs that are brought inside the security perimeter. Oh, yeah, they are fine-tuned on specific industrial control system, cyber security logs, and threat intelligence, and they run locally on-premises completely air-gapped from the public internet. Okay, that makes much more sense. It's a localized intelligence. So how does it interact with the CNN LSTM model? The deep learning model acts as the hyper-vigilant guard dog. When the CNN LSTM flags an anomaly, that raw, highly technical, hexadecimal data packet is immediately routed to the localized LLM. The LLM then acts as the translator. It analyzes the raw data against its training on industrial protocols and translates the anomaly into the exact operational impact. So what does this all mean? Instead of the dashboard just screaming 99.7% probability of attack, what if the human operator actually read? The LLM generates a clear actionable sentence in real time. To quote a specific output example from the research it might say, unauthorized attempt to alter device state via right command.

22:38The difference there is just staggering. The AI is no longer just barking at a noise in the dark. It is an intelligence briefer standing next to you, speaking plain English, telling you exactly which digital window the attacker is trying to pry open. If we connect this to the bigger picture, it really reinforces a fundamental reality of defense knowledge is only valuable when it is understood and applied. An operator cannot mitigate a threat based on abstract math. They cannot block a vector they don't comprehend. But right, a percentage doesn't give you instructions. Exactly. But when the LLM explains that an attacker is specifically using a right command to try and alter the physical state of a device like attempting to manually open a massive circuit breaker to trigger a cascading blackout, well, the human operator knows exactly what to do. They can instantly isolate that specific hardware device or dynamically block that specific command protocol. The LLM acts as the vital bridge between machine intelligence and human action. It is a complete paradigm shift in how we manage the physical world.

23:41Let's take a step back and look at the whole ecosystem we've just explored. We started with water facilities where AI PDM synthesizes a massive flood of physical telemetry to predict mechanical decay months before it happens, mathematically repairing the future. Yes. Then we move to the digital battle space of the smart grid where hybrid deep learning models weaving spatial CNN data and temporal LSTM data together autonomously detect zero data attacks in milliseconds. And finally, we see localized, large language models acting as real-time translators converting complex digital warfare into actionable human language. It is a comprehensive, layered defense architecture. AI monitoring the physical, defending the digital, and communicating directly with the human element. But I want to leave you with a thought that builds on this entire automated ecosystem. Think about that invisible safety net we rely on every day. Right now, AI is predicting physical decay autonomously. It is blocking invisible cyber armies with 99.7% accuracy autonomously. And it is now capable of writing its own highly specific incident reports.

24:44It's doing the heavy lifting at every stage. Exactly. So consider the timeline of an attack on the grid. It happens in milliseconds. The deep learning model detects it in milliseconds. The LLM translates it in milliseconds. And then the system waits. It waits. Yeah, it waits 10, maybe 15 seconds for the human operator to read the sentence on the screen, process the information, and physically click a mouse to authorize the defense protocol. The human cognition time. Right. Human reaction time is rapidly becoming the weakest link, the ultimate bottleneck in the defense architecture. If the AI knows the threat, knows the vector, and knows the solution in milliseconds, well, how long until the automated system realizes that waiting for the human to read the report is an unacceptable security risk. What happens to our critical infrastructure when the AI decides the safest, most logical way to protect civilization's grid is to lock the human operators out of the control loop entirely. That is the ultimate tension of autonomous defense. At what point does the shield become so fast and so intelligent that it simply bypasses

25:48the people it was built to protect? It's something to think about the next time you turn the tap, or flip a light switch, and blindly trust that invisible system to work. Thank you for joining us for this deep dive into the architecture, keeping our world running. Keep questioning the systems around you, keep exploring, and keep learning. We'll catch you next time.

27:26For more information, visit www.ringscentral.com