A traffic anomaly detection approach based on unsupervised learning for industrial cyber–physical system
Open accessIntegrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Yang et al.'s anomaly detection is performed by setting confidence intervals on reconstruction error distributions derived from normal traffic and flagging packets that exceed the threshold.
“Anomaly detection is performed by setting confidence intervals on reconstruction error distributions derived from normal traffic and flagging packets that exceed the threshold.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [50]
Yang et al.'s approach filters TCP/UDP packets, transforms payloads into ASCII strings, applies an unsupervised LSTM-based word segmentation model to divide payloads into semantically meaningful token sequences, and processes segmented payloads using BECN, an autoencoder combining BERT with a 1D-CNN module.
“TCP/UDP packets are first filtered, and payloads are transformed into ASCII strings. An unsupervised LSTM-based word segmentation model is applied to divide payloads into semantically meaningful token sequences, mitigating distortions introduced by statistical segmentation. These segmented payloads are then processed using BECN, an autoencoder combining BERT with a 1D-CNN module, which jointly”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [50]
Content-based payload models require access to full payloads-which may be encrypted or obfuscated in some deployments-and tend to be sensitive to benign changes in command formats, firmware versions, or application updates, especially when they are trained on a single custom dataset.
“At the same time, these contentbased models require access to full payloads-which may be encrypted or obfuscated in some deployments-and tend to be sensitive to benign changes in command formats, firmware versions, or application updates, especially when they are trained on a single custom dataset [50].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [50]
Payload feature-based anomaly detection remains relatively underexplored compared with statistical, time-series, and protocol-structured approaches in the ICS/CPS literature.
“Overall, Payload feature-based anomaly detection remains relatively underexplored compared with statistical, time-series, and protocol-structured approaches in the ICS/CPS literature [50].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [50]
Yang et al. [50] proposed an unsupervised payload-sequence anomaly detection approach using the Cyber-Physical Attack Dataset (CPAD).
“Using the Cyber-Physical Attack Dataset (CPAD), Yang et al. [50] proposed an unsupervised payload-sequence anomaly detection approach.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [50]
Cites
International Conference on Artificial Neural Networks
Boubacar, H. A., & Lecoeuche, S. (1990) · Neural Networks · doi:10.1016/0893-6080(90)90065-s · Cited by 2,088 · see citing works
A survey on security control and attack detection for industrial cyber-physical systems
Ding, D., Han, Q., Xiang, Y., Ge, X., & Zhang, X. (2017) · Neurocomputing · doi:10.1016/j.neucom.2017.10.009 · Cited by 947 · see citing works
A C-LSTM Neural Network for Text ClassificationPreprint
Zhou, C., Sun, C., Liu, Z., & Lau, F. C. M. (2015) · arXiv (Cornell University) · doi:10.48550/arxiv.1511.08630 · Cited by 666 · see citing works
Introduction to Industrial Control Networks
Galloway, B., & Hancke, G. P. (2012) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2012.071812.00124 · Cited by 550 · see citing works
The importance of the loss function in option valuation
Christoffersen, P., & Jacobs, K. (2003) · Journal of Financial Economics · doi:10.1016/j.jfineco.2003.02.001 · Cited by 394 · see citing works
The Cybersecurity Landscape in Industrial Control Systems
McLaughlin, S., Konstantinou, C., Wang, X., Davi, L., Sadeghi, A.-R., Maniatakos, M., & Karri, R. (2016) · Proceedings of the IEEE · doi:10.1109/jproc.2015.2512235 · Cited by 391 · see citing works
How to Generate a Good Word Embedding
Lai, S., Liu, K., He, S., & Zhao, J. (2016) · IEEE Intelligent Systems · doi:10.1109/mis.2016.45 · Cited by 342 · see citing works
McPAD: A multiple classifier system for accurate payload-based anomaly detection
Roberto Perdisci, A., Ariu, D., Fogla, P., Giacinto, G., & Lee, W. (2008) · Computer Networks · doi:10.1016/j.comnet.2008.11.011 · Cited by 269 · see citing works
CNN and RNN based payload classification methods for attack detection
Liu, H., Lang, B., Liu, M., & Yan, H. (2018) · Knowledge-Based Systems · doi:10.1016/j.knosys.2018.08.036 · Cited by 211 · see citing works
Hao, W., Yang, T., & Yang, Q. (2023) · IEEE Transactions on Automation Science and Engineering · doi:10.1109/tase.2021.3073396 · Cited by 143 · see citing works
Self-citationInternet of Things Cyber Attacks Detection using Machine Learning
Alsamiri, J. M., & Alsubhi, K. (2019) · International Journal of Advanced Computer Science and Applications · doi:10.14569/ijacsa.2019.0101280 · Cited by 139 · see citing works
Detection of SQL injection based on artificial neural network
Tang, P., Qiu, W., Huang, Z., et al. (2020) · Knowledge-Based Systems · doi:10.1016/j.knosys.2020.105528 · Cited by 123 · see citing works
Nearest cluster-based intrusion detection through convolutional neural networks
Andresini, G., Appice, A., & Malerba, D. (2021) · Knowledge-Based Systems · doi:10.1016/j.knosys.2021.106798 · Cited by 115 · see citing works
Wang, W., Guyet, T., Quiniou, R., Cordier, M.-O., Masséglia, F., & Zhang, X. (2014) · Knowledge-Based Systems · doi:10.1016/j.knosys.2014.06.018 · Cited by 103 · see citing works
Self-citationOCPAD: One class Naive Bayes classifier for payload based anomaly detection
Swarnkar, M., & Hubballi, N. (2016) · Expert Systems with Applications · doi:10.1016/j.eswa.2016.07.036 · Cited by 98 · see citing works
KASIM, Ö. (2020) · Computer Networks · doi:10.1016/j.comnet.2020.107390 · Cited by 98 · see citing works
APAD: Autoencoder-based Payload Anomaly Detection for industrial IoE
Kim, S.-J., Jo, W., & Shon, T. (2019) · Applied Soft Computing · doi:10.1016/j.asoc.2019.106017 · Cited by 91 · see citing works
Statistics with confidence—Confidence intervals and statistical guidelines
Wastell, D. G. (1991) · Journal of Dentistry · doi:10.1016/0300-5712(91)90131-h · Cited by 90 · see citing works
S., P., Krithivasan, K., S., P., & Sriram V.S., S. (2020) · IEEE Transactions on Industry Applications · doi:10.1109/tia.2020.2977872 · Cited by 88 · see citing works
RePIDS: A multi tier Real-time Payload-based Intrusion Detection System
Jamdagni, A., Tan, Z., He, X., et al. (2012) · Computer Networks · doi:10.1016/j.comnet.2012.10.002 · Cited by 78 · see citing works
Deep anomaly detection in packet payload
Liu, J., Song, X., Zhou, Y., Peng, X., Zhang, Y., Liu, P., Wu, D. O., & Zhu, C. (2021) · Neurocomputing · doi:10.1016/j.neucom.2021.01.146 · Cited by 65 · see citing works
Self-citationNetwork intrusion detection using equality constrained-optimization-based extreme learning machines
Cheng-ru, W., Xu, R.-F., Lee, S.-J., et al. (2018) · Knowledge-Based Systems · doi:10.1016/j.knosys.2018.02.015 · Cited by 62 · see citing works
(2008) · Elsevier eBooks · doi:10.1016/b978-1-59749-208-9.x0001-9 · Cited by 55 · see citing works
GraphXSS: An efficient XSS payload detection approach based on graph convolutional network
Liu, Z., Fang, Y., Huang, C., & Han, J. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102597 · Cited by 48 · see citing works
Handbook of Big Data and IoT Security
(2019) · Springer eBooks · doi:10.1007/978-3-030-10543-3 · Cited by 44 · see citing works
Network traffic analysis over clustering-based collective anomaly detection
Wang, C., Zhou, H., Hao, Z., Hu, S., Li, J., Zhang, X., Jiang, B., & Chen, X. (2022) · Computer Networks · doi:10.1016/j.comnet.2022.108760 · Cited by 44 · see citing works
A Novel Intrusion Detection System for RPL-Based Cyber–Physical Systems
Sharma, M., Elmiligi, H., & Gebali, F. (2021) · Canadian Journal of Electrical and Computer Engineering · doi:10.1109/icjece.2021.3053231 · Cited by 36 · see citing works
FARIMA model‐based communication traffic anomaly detection in intelligent electric power substations
Yang, Q., Hao, W., Ge, L., et al. (2018) · IET Cyber-Physical Systems Theory & Applications · doi:10.1049/iet-cps.2018.5052 · Cited by 35 · see citing works
Self-citationIndustrial Cyber–Physical System Defense Resource Allocation Using Distributed Anomaly Detection
Hao, W., Yao, P., Yang, T., & Yang, Q. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3088337 · Cited by 31 · see citing works
Self-citationA new scada dataset for intrusion detection research
Turnipseed, I. P. (n.d.) · ProQuest Demo Repository · Cited by 29 · see citing works
Traffic Anomaly Detection Model Using K-Means and Active Learning Method
Liao, N., & Li, X. (2022) · International Journal of Fuzzy Systems · doi:10.1007/s40815-022-01269-0 · Cited by 24 · see citing works
Hao, W., Yang, Q., Li, Z., et al. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2022.3210946 · Cited by 24 · see citing works
Self-citationTCP/IP Attacks, Defenses and Security Tools
Alqahtani, A. H., & Iftikhar, M. (2013) · Cited by 21 · see citing works
Research on lightweight anomaly detection of multimedia traffic in edge computing
Zhao, X., Huang, G., Jin, J., Gao, L. C., & Li, M. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102463 · Cited by 19 · see citing works
Advances on Broad-Band Wireless Computing, Communication and Applications
(2019) · Lecture notes in networks and systems · doi:10.1007/978-3-030-33506-9 · Cited by 18 · see citing works
Kumar, V., & Sendhilkumar, S. (2022) · Expert Systems with Applications · doi:10.1016/j.eswa.2022.118517 · Cited by 18 · see citing works
Wang, C., Guan, X., Qin, T., Wang, P., Tao, J., Meng, Y., & Liu, J. (2020) · Knowledge-Based Systems · doi:10.1016/j.knosys.2020.106192 · Cited by 11 · see citing works
Chinese Word Segmentation Based on Deep Learning
Wang, M., Li, X., Wei, Z., et al. (2018) · International Conference on Machine Learning and Computing (ICMLC) · doi:10.1145/3195106.3195135 · Cited by 9 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Seo, J. K., Lee, J., Kim, B., Shim, W., & Seo, J. T. (2025) · Electronics · doi:10.3390/electronics15010020 · Cited by 15 · see citing works
- Authors
- Yang, T., Jiang, Z., Liu, P., Yang, Q., & Wang, W.
- Affiliations
- Zhejiang University (CN)
- Corresponding author
- Yang, Tao
- Yang, Qiang
- Venue
- Knowledge-Based Systems
- Publisher
- Elsevier BV
- Published
- 2023-11
- Volume
- 279
- Pages
- 110949
- ISSN
- 0950-7051 (ISSN-L)
- OpenAlex
- W4386424801
- Cited by
- 21
- References
- 38
- Citations by year
- 2026: 9 · 2025: 7 · 2024: 4 · 2023: 1
- FWCI
- 2.33
- Type
- journal article
- Language
- en
- Open access
- green
- doi.org
- Licence
- Locations
- Knowledge-Based Systems (publishedVersion)
- SSRN Electronic Journal (acceptedVersion)
- Funders
- Zhejiang University
- Fundamental Research Funds for the Central Universities
- National Natural Science Foundation of China (52177119)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- traffic anomaly detection, industrial cyber-physical systems, unsupervised learning, word segmentation, autoencoder, LSTM, BERT, 1D convolutional neural network, class imbalance, cyber-physical attacks, network traffic analysis
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
