## 3 Proposed Approach
* Defense Strategy Formulation: The final phase organizes cyberattacks by malware type, entry vector, and impact, establishing security protocols that reinforce each infrastructure layer. To validate the effectiveness of the proposed multi-layered defense system, a control group comprising systems without layered defenses was also analyzed. This allowed for a comparative evaluation, demonstrating how single-layer or perimeter-focused systems performed under similar attack conditions, thereby highlighting the additional benefits provided by the layered security approach. Further, network segmentation and SCADA control protocol encryption ensure that, even if network anomalies arise, control commands remain safeguarded at the application layer. This interdependent layer structure provides flexibility, allowing each defense layer to act autonomously while collectively contributing to system resilience. Each step distinctly supports a comprehensive analysis model, allowing targeted examination of each infrastructure layer: SCADA vulnerabilities, ICS robustness, and SIS integrity. However, due to variations in infrastructure setups and external conditions across different energy facilities, some experimental controls--such as real-time user behavior monitoring--could not be fully standardized. Consequently, these factors were noted in the result interpretations to ensure that the limitations were considered in drawing broader conclusions. By following a structured research methodology--beginning with data collection from reliable threat intelligence sources, progressing to specific threat vector analysis for each layer, and concluding with a defense strategy optimized for each infrastructure layer--this study demonstrates the efficacy of the layered defense approach. Each phase supports our goal of creating a robust, multi-tiered defense system capable of protecting complex energy infrastructure from diverse cyber threats. This research design provides both depth and redundancy, allowing each layer to function independently yet reinforce others, which is critical for mitigating sophisticated threats targeting interconnected infrastructure systems. This systematic approach highlights why the layered model offers an optimal defense mechanism compared to traditional single-layer models, providing the energy sector with a resilient framework against evolving cybersecurity challenges [35]. Following this, industry-standard threat intelligence tools such as the MITRE ATT&CK framework are employed to systematically identify and map attack vectors. For instance, at the control layer, the ATT&CK framework facilitates the cataloging of attack techniques used to target SCADA systems, identifying potential areas for protocol encryption and command verification. Additionally, NIST's Cybersecurity Framework is referenced to ensure compliance with best practices across all layers, providing a structured foundation for implementing effective incident response and mitigation protocols. [PERSON]'s model adds a predictive analytics layer, specifically focusing on human factors, or 'cyber personas', to detect potential insider threats and anticipate social engineering risks through structured behavior analysis. While [PERSON]'s model emphasizes the proactive assessment of human risks, our study targets a distinct scope by focusing on system vulnerabilities across the SCADA, ICS, and SIS layers. Unlike [PERSON]'s human-centered approach, this study provides a multi-layered technical defense model, with each layer independently assessing system-level vulnerabilities while complementing human-centered defenses. This dual focus offers a balanced and comprehensive security strategy, incorporating both technical resilience and behavior-based predictions. Machine-learning-based IDSs significantly enhance infrastructure resilience by prepitively identifying attack patterns and adjusting defensive strategies in real time.