Automated detection-in-depth in industrial control systems
Open accessIntegrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Jadidi et al. [137] proposed a hybrid anomaly detection scheme that applies a defence-in-depth/detection-in-depth strategy by combining network traffic and process logs in ICS.
“Jadidi et al. [137] proposed a hybrid anomaly detection scheme that applies a defencein-depth/detection-in-depth strategy by combining network traffic and process logs in ICS.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [137]
In Jadidi et al. [137], network packets captured from a Purdue-model ICS are converted into NetFlow records to extract flow-level statistics, while PLC logs containing sensor/actuator states and control actions are collected and preprocessed as CSV time-series data.
“Network packets captured from a Purdue-model ICS are converted into NetFlow records to extract flow-level statistics, while PLC logs-containing sensor/actuator states and control actions-are collected and preprocessed as CSV time-series data.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [137]
In Jadidi et al. [137], in the first layer, hierarchical cluster analysis (HCA) is applied to NetFlow histograms to detect flooding-type network anomalies that deviate from normal flow distributions.
“In the first layer, hierarchical cluster analysis (HCA) is applied to NetFlow histograms to detect floodingtype network anomalies that deviate from normal flow distributions.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [137]
Several ensemble and decision-fusion works go beyond pure 'detection accuracy' and link fused anomaly decisions to higher-level concepts-such as safety integrity, risk scores, or physical impact validation-thereby prioritizing responses to attacks that threaten equipment and process safety instead of treating all alerts as equally important.
“Third, several works go beyond pure 'detection accuracy' and link fused anomaly decisions to higher-level concepts-such as safety integrity, risk scores, or physical impact validation-thereby prioritizing responses to attacks that threaten equipment and process safety instead of treating all alerts as equally important [134,136,137].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [137]
In Jadidi et al. [137], in the second layer, ARIMA/GARCH-based time-series prediction models learn a baseline of normal PLC behavior and identify process anomalies when residuals between predicted and actual log values exceed a threshold.
“In the second layer, ARIMA/GARCH-based time-series prediction models learn a baseline of normal PLC behavior and identify process anomalies when residuals between predicted and actual log values exceed a threshold.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [137]
In Jadidi et al. [137], the outputs of the two detectors are fused via an OR rule at the decision level; if either layer reports an anomaly, the system flags a potential attack at the ICS level.
“The outputs of the two detectors are fused via an OR rule at the decision level; if either layer reports an anomaly, the system flags a potential attack at the ICS level.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [137]
Ensemble and decision-fusion-based hybrid data studies explicitly combine detectors with heterogeneous inductive biases-tree ensembles, kernel methods, deep sequence models, and state observers-so that cyber-layer traffic anomalies and physical-layer process deviations are jointly reflected in the final decision, improving robustness under noisy hybrid data and nonstationary operating regimes.
“First, they explicitly combine detectors with heterogeneous inductive biases-tree ensembles, kernel methods, deep sequence models, and state observers-so that cyber-layer traffic anomalies and physical-layer process deviations are jointly reflected in the final decision, improving robustness under noisy hybrid data and nonstationary operating regimes [133-137].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [137]
Cites
Silhouettes: A graphical aid to the interpretation and validation of cluster analysis
Rousseeuw, P. J. (1987) · Journal of Computational and Applied Mathematics · doi:10.1016/0377-0427(87)90125-7 · Cited by 21,392 · see citing works
A Dendrite Method for Cluster Analysis
Caliński, T., & Harabasz, J. (1974) · Communications in Statistics - Simulation and Computation · doi:10.1080/03610927408827101 · Cited by 7,866 · see citing works
A survey on security control and attack detection for industrial cyber-physical systems
Ding, D., Han, Q., Xiang, Y., Ge, X., & Zhang, X. (2017) · Neurocomputing · doi:10.1016/j.neucom.2017.10.009 · Cited by 947 · see citing works
A Dataset to Support Research in the Design of Secure Water Treatment Systems
Goh, J., Adepu, S., Junejo, K. N., & Mathur, A. (2017) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-71368-7_8 · Cited by 729 · see citing works
A moving-average filter based hybrid ARIMA–ANN model for forecasting time series data
Babu, C. N., & Reddy, B. E. (2014) · Applied Soft Computing · doi:10.1016/j.asoc.2014.05.028 · Cited by 507 · see citing works
On measuring the distance between histograms
Cha, S.-H., & Srihari, S. N. (2002) · Pattern Recognition · doi:10.1016/s0031-3203(01)00118-2 · Cited by 389 · see citing works
Zhang, F., Kodituwakku, H. A. D. E., Hines, J. W., & Coble, J. B. (2019) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2019.2891261 · Cited by 371 · see citing works
VoltageIDS: Low-Level Communication Characteristics for Automotive Intrusion Detection System
Choi, W., Joo, K., Jo, H. J., Park, M. C., & Lee, D. H. (2018) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2018.2812149 · Cited by 312 · see citing works
PHY-Layer Spoofing Detection With Reinforcement Learning in Wireless Networks
Xiao, L., Li, Y., Han, G., Liu, G., & Zhuang, W. (2016) · IEEE Transactions on Vehicular Technology · doi:10.1109/tvt.2016.2524258 · Cited by 296 · see citing works
A survey of network flow applications
Li, B., Springer, J., Bebis, G., & Güneş, M. H. (2013) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2012.12.020 · Cited by 225 · see citing works
Short-time traffic flow prediction with ARIMA-GARCH model
Chen, C., Hu, J., Meng, Q., & Zhang, Y. (2011) · IEEE Intelligent Vehicles Symposium · doi:10.1109/ivs.2011.5940418 · Cited by 208 · see citing works
A survey of intrusion detection on industrial control systems
Hu, Y., Yang, A., Li, H., Sun, Y., & Sun, L. (2018) · International Journal of Distributed Sensor Networks · doi:10.1177/1550147718794615 · Cited by 185 · see citing works
Histogram-based traffic anomaly detection
Kind, A., Stoecklin, M. P., & Dimitropoulos, X. A. (2009) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2009.090604 · Cited by 178 · see citing works
HML-IDS: A Hybrid-Multilevel Anomaly Prediction Approach for Intrusion Detection in SCADA Systems
Khan, I. A., Pi, D., Khan, Z. U., Hussain, Y., & Nawaz, A. (2019) · IEEE Access · doi:10.1109/access.2019.2925838 · Cited by 156 · see citing works
Ding, C., Duan, J., Zhang, Y., Wu, X., & Yu, G. (2017) · IEEE Transactions on Intelligent Transportation Systems · doi:10.1109/tits.2017.2711046 · Cited by 152 · see citing works
Hao, W., Yang, T., & Yang, Q. (2023) · IEEE Transactions on Automation Science and Engineering · doi:10.1109/tase.2021.3073396 · Cited by 143 · see citing works
Yang, J. Y., Zhou, C., Yang, S., Xu, H., & Hu, B. (2017) · IEEE Transactions on Industrial Electronics · doi:10.1109/tie.2017.2772190 · Cited by 127 · see citing works
Efficient DDoS flood attack detection using dynamic thresholding on flow-based network traffic
David, J., & Thomas, C. (2019) · Computers & Security · doi:10.1016/j.cose.2019.01.002 · Cited by 113 · see citing works
Anomaly detection for industrial control systems using process mining
Myers, D., Suriadi, S., Radke, K., & Foo, E. (2018) · Computers & Security · doi:10.1016/j.cose.2018.06.002 · Cited by 110 · see citing works
Self-citationAhmed, C. M., Zhou, J., & Mathur, A. P. (2018) · Annual Computer Security Applications Conference · doi:10.1145/3274694.3274748 · Cited by 104 · see citing works
Causality Countermeasures for Anomaly Detection in Cyber-Physical Systems
Shi, D., Guo, Z., Johansson, K. H., & Shi, L. (2017) · IEEE Transactions on Automatic Control · doi:10.1109/tac.2017.2714646 · Cited by 80 · see citing works
Flow Aggregation for the IP Flow Information Export (IPFIX) Protocol
Trammell, B., Wagner, A., & Claise, B. (2013) · doi:10.17487/rfc7015 · Cited by 72 · see citing works
Hadeli, H., Schierholz, R., Braendle, M., & Tuduce, C. (2009) · IEEE International Conference on Emerging Technologies and Factory Automation (ETFA) · doi:10.1109/etfa.2009.5347134 · Cited by 66 · see citing works
Short‐Term High-Speed Traffic Flow Prediction Based on ARIMA-GARCH-M Model
Lin, X., & Huang, Y. (2021) · Wireless Personal Communications · doi:10.1007/s11277-021-08085-z · Cited by 65 · see citing works
Shalyga, D., Filonov, P., & Lavrentyev, A. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1807.07282 · Cited by 64 · see citing works
Flow-based intrusion detection
Sperotto, A., & Pras, A. (2011) · IFIP/IEEE International Symposium on Integrated Network Management (IM) · doi:10.1109/inm.2011.5990529 · Cited by 61 · see citing works
Frazão, I., Abreu, P. H., Cruz, T., Araújo, H. J., & Simões, P. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-05849-4_19 · Cited by 59 · see citing works
Anomaly Detection in Manufacturing Systems Using Structured Neural Networks
Liu, J., Guo, J., Orlik, P. V., Shibata, M., Nakahara, D., Mii, S., & Takáč, M. (2018) · World Congress on Intelligent Control and Automation · doi:10.1109/wcica.2018.8630692 · Cited by 57 · see citing works
A Method for Anomalies Detection in Real-Time Ethernet Data Traffic Applied to PROFINET
Sestito, G. S., Turcato, A. C., Dias, A. L., Rocha, M. S., da Silva, M. M., Ferrari, P., & Brandão, D. (2017) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2017.2772082 · Cited by 56 · see citing works
Alerts Correlation and Causal Analysis for APT Based Cyber Attack Detection
Khosravi, M., & Ladani, B. T. (2020) · IEEE Access · doi:10.1109/access.2020.3021499 · Cited by 55 · see citing works
Flow-Based Web Application Brute-Force Attack and Compromise Detection
Hofstede, R., Jonker, M., Sperotto, A., et al. (2017) · Journal of Network and Systems Management · doi:10.1007/s10922-017-9421-4 · Cited by 41 · see citing works
Spoofing Detection with Reinforcement Learning in Wireless Networks
Xiao, L., Li, Y., Liu, G., et al. (2015) · Globecom · doi:10.1109/glocom.2015.7417078 · Cited by 37 · see citing works
NIS04-2: Detection of DNS Anomalies using Flow Data Analysis
Karasaridis, A., Meier-Hellstern, K. S., & Hoeflin, D. (2006) · Globecom · doi:10.1109/glocom.2006.280 · Cited by 36 · see citing works
EDMAND: Edge-Based Multi-Level Anomaly Detection for SCADA Networks
Ren, W., Yardley, T. M., & Nahrstedt, K. (2018) · IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm) · doi:10.1109/smartgridcomm.2018.8587533 · Cited by 29 · see citing works
Unsupervised learning with normalised data and non-Euclidean norms
Doherty, K. A. J., Adams, R. G., & Davey, N. (2005) · Applied Soft Computing · doi:10.1016/j.asoc.2005.05.005 · Cited by 28 · see citing works
A New Burst-DFA model for SCADA Anomaly Detection
Markman, C., Wool, A., & Cárdenas, Á. A. (2017) · Workshop on Cyber-Physical Systems Security and PrivaCy (CPS-SPC) · doi:10.1145/3140241.3140245 · Cited by 27 · see citing works
Using of Time Characteristics in Data Flow for Traffic Classification
Piskac, P., & Novotný, J. (2011) · Autonomous Infrastructure, Management and Security · doi:10.1007/978-3-642-21484-4_21 · Cited by 22 · see citing works
Flow-Based Compromise Detection: Lessons Learned
Hofstede, R., Pras, A., Sperotto, A., et al. (2018) · IEEE Security & Privacy · doi:10.1109/msp.2018.1331021 · Cited by 18 · see citing works
Recent Advances in Machine Learning-based Anomaly Detection for Industrial Control Networks
Wang, Q., Chen, H. H., Li, Y., & Vucetic, B. S. (2019) · International Conference on Industrial Artificial Intelligence (IAI) · doi:10.1109/iciai.2019.8850828 · Cited by 18 · see citing works
Flow-based anomaly detection using semisupervised learning
Jadidi, Z., Muthukkumarasamy, V., Sithirasenan, E., & Singh, K. (2015) · International Conference on Signal Processing and Communication Systems · doi:10.1109/icspcs.2015.7391760 · Cited by 13 · see citing works
Self-citationHussain, M., Foo, E., & Suriadi, S. (2019) · International Conference on Frontiers of Information Technology (FIT) · doi:10.1109/fit47737.2019.00037 · Cited by 12 · see citing works
Self-citationHaylett, G., Jadidi, Z., & Thanh, K. N. (2021) · IFIP advances in information and communication technology · doi:10.1007/978-3-030-79150-6_29 · Cited by 10 · see citing works
Self-citationIntelligent Sampling Using an Optimized Neural Network
Jadidi, Z., Muthukkumarasamy, V., Sithirasenan, E., & Singh, K. (2016) · Journal of Networks · doi:10.4304/jnw.11.01.16-27 · Cited by 7 · see citing works
Self-citationTraffic Characteristic Map-based Intrusion Detection Model for Industrial Internet.
Dong, R., Wu, D.-F., Zhang, Q., & Zhang, T. (2018) · Cited by 7 · see citing works
Neural Net-Based Anomaly Detection System in Substation Networks
Kreimel, P., & Tavolato, P. (2019) · Electronic workshops in computing · doi:10.14236/ewic/icscsr19.6 · Cited by 6 · see citing works
Exploiting System Model for Securing CPS: the Anomaly Based IDS Perspective
Colelli, R., Panzieri, S., & Pascucci, F. (2018) · IEEE International Conference on Emerging Technologies and Factory Automation (ETFA) · doi:10.1109/etfa.2018.8502495 · Cited by 5 · see citing works
Flow-based Anomaly Detection in High-Speed Networks
Jadidi, Z. (2016) · Griffith Research Online · doi:10.25904/1912/1145 · Cited by 1 · see citing works
Self-citation
Flagged first, then by citations
Cited by
Sorted by citations
Anomaly detection for a water treatment system based on one-class neural network
Aboah Boateng, E., Bruce, J. W., & Talbert, D. A. (2022) · IEEE Access · doi:10.1109/access.2022.3218624 · Cited by 44 · see citing works
Correlation-Based Anomaly Detection in Industrial Control Systems
Jadidi, Z., Pal, S., Hussain, M., & Nguyen Thanh, K. (2023) · Sensors · doi:10.3390/s23031561 · Cited by 35 · see citing works
Self-citationAnalysis of Log Files to Enable Smart-Troubleshooting in Industry 4.0: A Systematic Mapping Study
Partovian, S., Bucaioni, A., Flammini, F., & Thornadtsson, J. (2024) · IEEE Access · doi:10.1109/access.2023.3342365 · Cited by 16 · see citing works
Seo, J. K., Lee, J., Kim, B., Shim, W., & Seo, J. T. (2025) · Electronics · doi:10.3390/electronics15010020 · Cited by 15 · see citing works
Cyber Security Resilience in Industrial Control Systems using Defence-in-Depth and Zero Trust
Jadidi, Z., Pal, S., Li, Q., & Foo, E. (2023) · 2023 16th International Conference on Sensing Technology (ICST) · doi:10.1109/icst59744.2023.10460853 · Cited by 2 · see citing works
Self-citation
- Authors
- Jadidi, Z., Foo, E., Hussain, M., & Fidge, C.
- Affiliations
- Queensland University of Technology (AU)
- Griffith University (AU)
- Corresponding author
- Jadidi, Zahra
- Venue
- The International Journal of Advanced Manufacturing Technology
- Published
- 2021-09-30
- Volume
- 118
- Issue
- 7-8
- Pages
- 2467-2479
- ISSN
- 0268-3768 (ISSN-L)
- 1433-3015
- OpenAlex
- W3202224668
- Cited by
- 31
- References
- 48
- Citations by year
- 2026: 5 · 2025: 9 · 2024: 3 · 2023: 8 · 2022: 6
- FWCI
- 1.91
- Type
- journal article
- Language
- en
- Open access
- green
- hdl.handle.net
- Licence
- Locations
- The International Journal of Advanced Manufacturing Technology (publishedVersion)
- QUT ePrints (Queensland University of Technology) (submittedVersion)
- Griffith Research Online (submittedVersion, other-oa)
- Funders
- Australian Cybersecurity Cooperative Research Centre
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Engineering › Biomedical Engineering › Artificial Immune Systems Applications
- Keywords
- industrial control systems, denial-of-service attacks, NetFlow, anomaly detection, unsupervised clustering, unsupervised anomaly detection, Modbus, SWaT dataset, factory automation
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
