Adi Hermansyah

(Cyber-Physical Systems (CPS) tightly integrate physical devices, computation, and communication networks, making them highly susceptible to cyberattacks such as Man-in-the-Middle (MITM), which threaten data integrity and system reliability. This study proposes a layered CPS architecture integrated with a machine learning–based Intrusion Response System (IRS) to support a complete detection–decision–response cycle, encompassing physical, network, cyber/computation, control, application, and security layers. Several classification models, including Random Forest, Extra Trees, XGBoost, SVM-RBF, Logistic Regression, and Gaussian Naive Bayes, are evaluated using accuracy, precision, recall, F1-score, and response time under different batch sizes to reflect real-time and near real-time processing conditions. Experimental results demonstrate that ensemble-based models outperform simpler approaches in terms of detection stability and robustness, with Random Forest achieving the most balanced performance, evidenced by an accuracy of 88.20% and a weighted F1-score of 0.8872, alongside strong precision and recall for attack traffic. Although Random Forest requires higher inference time than lightweight models, its latency remains within the millisecond range and does not introduce bottlenecks in streaming network traffic. The findings reveal a clear trade-off between computational efficiency and detection performance, confirming that Random Forest is the most suitable model for IRS implementation in CPS environments, providing accurate, stable, and reliable MITM attack detection under dynamic network conditions.