Abstract
The increased integration of operational technology (OT), Internet of Things (IoT), and business IT systems has allowed sophisticated attackers to circumvent isolated security features and launch cross-platform assaults. Current fragmented techniques, with discrete detectors monitoring Modbus, Kubernetes, MQTT, or other domain-specific protocols, cannot handle cross-system risks. These methodologies overlook 68% of multi-vector marketing that uses both physical and digital channels. This study introduces a transfer learning architecture to integrate detection capabilities by correlating threats across protocols, devices, and settings. The architecture generates a unified feature space that extracts behavioral semantics from industrial control system logs, cloud telemetry, network traffic, and device-level signals to produce protocol-agnostic threat representations. Adversarial domain adaptation and semantic graph embeddings enable cross-domain knowledge transfer with minimum retraining. Security teams may now discover kill chains like infected cloud containers preceding illegal PLC command execution every 23 minutes. Validated against real-world attack datasets from water treatment facilities (OT) and cloud infrastructure (IT), the system achieved 93.4% cross-platform attack recall, a 41.3 percentage point improvement over prior methodologies. It reduced OT data labeling by 89% and false positives by 93.5%. This paradigm shift transforms threat correlation from a reactive, domain-specific process to adaptive intelligence, boosting resilience for critical infrastructure, industrial ecosystems, and smart environments facing cyber-physical hazards. The framework's practical validation in energy, industry, and vital infrastructure shows its importance in protecting an increasingly linked world.
