Interdisciplinary framework for cyber-attacks and anomaly detection in industrial control systems using deep learning
Open accessAbstract
The reliability of Industrial Control Systems (ICS) is crucial given their substantial importance in society and business. These systems are susceptible to physical and cyber-attacks, which can seriously affect human life and the economy. Given the growing prevalence of Internet of Things (IoT) technologies and the possibility of cyber warfare, it is essential to prioritize safeguarding Industrial Control Systems (ICS) from cyberattacks. Previous studies revealed an imbalance in the ICS datasets. As a result, models didn't do well in minority classes but did well in majority classes, which made the intrusion detection system (IDS) less useful. The key objective is to provide insights into the normal functioning of the system and the disruptions produced by cyberattacks. In this study, we introduced an interdisciplinary framework that aims to enhance network intrusion detection systems (NIDSs). In this framework, we introduced an IDS via feature selection and feature reduction technique(s) with the attention-driven lightweight deep neural networks: Deep Recurrent Neural Networks (RNN), Deep Long Short-Term Memory (LSTM), and Deep Bi-directional Long Short-Term Memory (Bi-LSTM). Several feature selection techniques exclude features that fail to match the specified criteria. We employed Sparse Principal Component Analysis (SPCA) to extract higher-order features. We conducted experiments on the three datasets: the Secure Water Treatment System (SWaT), the Water Distribution (WADI), and the Gas Heating Loop (GHL). Among the models used in the framework, the attention-driven Deep LSTM model produced better results than the others, revealing lower training and testing times for the three datasets. In terms of precision, recall, F1-score, computational speed, and ability to work with larger datasets and different ICSs, the proposed framework is better than previous methods in detecting cyberattacks. This highlights how useful it is in the real world.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Some sensor-correlation-based models learn temporal correlations and cross-sensor dependencies implicitly using deep RNNs, LSTMs, attention mechanisms, or Transformers applied to multivariate sequences.
“Some models learn temporal correlations and cross-sensor dependencies implicitly using deep RNNs, LSTMs, attention mechanisms, or Transformers applied to multivariate sequences [88,90,93,98,108,110], while others make correlations explicit through graph structures, digital twins, energy-based physics features, or multi-instance representations [94,96,99,101,104,106,107].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [88]
The Methodology > Cyberattack detection method section describes deep RNN and LSTM models for sequential ICS data, and an attention layer that weights time steps in an input with multiple features. It supports the temporal-sequence part of the claim, but does not establish that these models learn cross-sensor dependencies implicitly or describe a Transformer model; no page numbers are available in our copy. (LLM, conf=0.84)
Experimental — accuracy not yet measuredThe dataset distribution for sensor-correlation-based methods shows heavy evaluation on SWaT, WADI, GHL, HAI, TE, and power-system benchmarks (IEEE bus systems), with additional evidence from gas-pipeline, GRFICSv2/Factory I/O, and aNormalies-based testbeds.
“Finally, the dataset distribution indicates that sensor-correlation-based methods are heavily evaluated on SWaT, WADI, GHL, HAI, TE, and power-system benchmarks (IEEE bus systems), with additional evidence from gas-pipeline, GRFICSv2/Factory I/O, and aNormalies-based testbeds [88-96,98-102,104-110].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [88]
Split into 2 atoms — 0 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 1 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474 · see citing works
LeCun, Y., Bengio, Y., & Hinton, G. (2015) · Nature · doi:10.1038/nature14539 · Cited by 84,126 · see citing works
Learning Hierarchical Features for Scene Labeling
Farabet, C., Couprie, C., Najman, L., & LeCun, Y. (2013) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2012.231 · Cited by 2,620 · see citing works
Statistical Learning with Sparsity
Hastie, T. J., Tibshirani, R. J., & Wainwright, M. J. (2015) · Chapman & Hall/CRC eBooks · doi:10.1201/b18401 · Cited by 2,529 · see citing works
MAD-GAN: Multivariate Anomaly Detection for Time Series Data with Generative Adversarial Networks
Li, D., Chen, D., Jin, B., Shi, L., Goh, J., & Ng, S.-K. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-30490-4_56 · Cited by 1,323 · see citing works
Ferrag, M. A., Friha, O., Hamouda, D., Maglaras, L. A., & Janicke, H. (2022) · IEEE Access · doi:10.1109/access.2022.3165809 · Cited by 1,308 · see citing works
A review of feature selection methods with applications
Jović, A., Brkić, K., & Bogunovic, N. (2015) · International Convention on Information and Communication Technology, Electronics and Microelectronics · doi:10.1109/mipro.2015.7160458 · Cited by 1,238 · see citing works
An experimental comparison of performance measures for classification
Ferri, C., Hernández-Orallo, J., & Modroiu, R. (2009) · Pattern Recognition Letters · doi:10.1016/j.patrec.2008.08.010 · Cited by 889 · see citing works
A Modified Principal Component Technique Based on the LASSO
Jolliffe, I. T., Trendafilov, N. T., & Uddin, M. (2003) · Journal of Computational and Graphical Statistics · doi:10.1198/1061860032148 · Cited by 810 · see citing works
A Dataset to Support Research in the Design of Secure Water Treatment Systems
Goh, J., Adepu, S., Junejo, K. N., & Mathur, A. (2017) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-71368-7_8 · Cited by 729 · see citing works
Atzori, M., Cognolato, M., & Müller, H. (2016) · Frontiers in Neurorobotics · doi:10.3389/fnbot.2016.00009 · Cited by 684 · see citing works
Aljawarneh, S. A., Aldwairi, M., & Yassein, M. B. (2017) · Journal of Computational Science · doi:10.1016/j.jocs.2017.03.006 · Cited by 683 · see citing works
Kushner, D. (2013) · IEEE Spectrum · doi:10.1109/mspec.2013.6471059 · Cited by 638 · see citing works
Miao, J., & Niu, L. (2016) · Procedia Computer Science · doi:10.1016/j.procs.2016.07.111 · Cited by 571 · see citing works
Intrusion detection model using fusion of chi-square feature selection and multi class SVM
Thaseen, I. S., & Cherukuri, A. K. (2016) · Journal of King Saud University - Computer and Information Sciences · doi:10.1016/j.jksuci.2015.12.004 · Cited by 471 · see citing works
Detecting Cyber Attacks in Industrial Control Systems Using Convolutional Neural Networks
Kravchik, M., & Shabtai, A. (2018) · Workshop on Cyber-Physical Systems Security and PrivaCy (CPS-SPC) · doi:10.1145/3264888.3264896 · Cited by 393 · see citing works
A robust privacy-preserving federated learning model against model poisoning attacks
Yazdinejad, A., Dehghantanha, A., Karimipour, H., Srivastava, G., & Parizi, R. M. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3420126 · Cited by 380 · cited 2× · see citing works
“These approaches will ensure promising, robust, and resilient security solutions in securing such ICS 35,63,64 settings from advanced cyber-attacks.”
Anomaly Detection for a Water Treatment System Using Unsupervised Machine Learning
Inoue, J., Yamagata, Y., Chen, Y., POSKITT, C. M., & Sun, J. (2017) · IEEE ... International Conference on Data Mining workshops · doi:10.1109/icdmw.2017.149 · Cited by 372 · see citing works
Al-Hawawreh, M. S., Moustafa, N., & Sitnikova, E. (2018) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2018.05.002 · Cited by 336 · see citing works
Toward optimal feature selection using ranking methods and classification algorithms
Novakovic, J., Štrbac, P., & Bulatović, D. (2011) · Yugoslav journal of operations research · doi:10.2298/yjor1101119n · Cited by 269 · see citing works
Kravchik, M., & Shabtai, A. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2021.3050101 · Cited by 224 · see citing works
Intrusion detection in SCADA systems using machine learning techniques
Maglaras, L. A., & Jiang, J. (2014) · Science and Information Conference · doi:10.1109/sai.2014.6918252 · Cited by 188 · see citing works
On SCADA control system command and response injection and intrusion detection
Gao, W., Morris, T. H., Reaves, B., & Richey, D. (2010) · eCrime Researchers Summit (eCrime) · doi:10.1109/ecrime.2010.5706699 · Cited by 187 · see citing works
Behavior-Rule Based Intrusion Detection Systems for Safety Critical Smart Grid Applications
Mitchell, R., & Chen, I.-R. (2013) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2013.2258948 · Cited by 184 · see citing works
Characterizing Cyber-Physical Attacks on Water Distribution Systems
Taormina, R., Galelli, S., Tippenhauer, N. O., Salomons, E., & Ostfeld, A. (2017) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0000749 · Cited by 175 · see citing works
Lin, Q., Adepu, S., Verwer, S., & Mathur, A. P. (2018) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3196494.3196546 · Cited by 157 · see citing works
Saheed, Y. K., Abdulganiyu, O. H., & Tchakoucht, T. A. (2024) · Applied Soft Computing · doi:10.1016/j.asoc.2024.111434 · Cited by 149 · see citing works
Filonov, P., Lavrentyev, A., & Vorontsov, A. (2016) · arXiv · doi:10.48550/arxiv.1612.06676 · Cited by 140 · see citing works
Tsai, C., & Sung, Y.-T. (2020) · Knowledge-Based Systems · doi:10.1016/j.knosys.2020.106097 · Cited by 124 · see citing works
Nader, P., Honeine, P., & Beauseroy, P. (2014) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2014.2330796 · Cited by 122 · see citing works
A Dual-Isolation-Forests-Based Attack Detection Framework for Industrial Control Systems
Elnour, M., Meskin, N., Khan, K. M., & Jain, R. K. (2020) · IEEE Access · doi:10.1109/access.2020.2975066 · Cited by 117 · see citing works
AP2FL: Auditable Privacy-Preserving Federated Learning Framework for Electronics in Healthcare
Yazdinejad, A., Dehghantanha, A., & Srivastava, G. (2024) · IEEE transactions on consumer electronics · doi:10.1109/tce.2023.3318509 · Cited by 117 · see citing works
Yazdinejad, A., Dehghantanha, A., Srivastava, G., Karimipour, H., & Parizi, R. M. (2024) · Journal of Systems Architecture · doi:10.1016/j.sysarc.2024.103088 · Cited by 115 · see citing works
Prasetiyowati, M. I., Maulidevi, N. U., & Surendro, K. (2021) · Journal Of Big Data · doi:10.1186/s40537-021-00472-4 · Cited by 111 · see citing works
Khan, I. A., Keshk, M., Pi, D., Khan, N., Hussain, Y., & Soliman, H. (2022) · Ad Hoc Networks · doi:10.1016/j.adhoc.2022.102930 · Cited by 110 · see citing works
Saheed, Y. K., Omole, A. I., & Sabit, M. O. (2025) · Sensors International · doi:10.1016/j.sintl.2024.100297 · Cited by 88 · see citing works
IADF-CPS: Intelligent Anomaly Detection Framework towards Cyber Physical Systems
Nagarajan, S. M., Devarajan, G. G., Bashir, A. K., Mahapatra, R. P., & Al-Numay, M. S. (2022) · Computer Communications · doi:10.1016/j.comcom.2022.02.022 · Cited by 88 · see citing works
Khan, I. A., Pi, D., Abbas, M. Z., Zia, U., Hussain, Y., & Soliman, H. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2022.3200048 · Cited by 79 · see citing works
MADICS: A Methodology for Anomaly Detection in Industrial Control Systems
Gómez, Á. L. P., Maimó, L. F., Celdrán, A. H., & Clemente, F. J. G. (2020) · Symmetry · doi:10.3390/sym12101583 · Cited by 76 · see citing works
Rule-based intrusion detection system for SCADA networks
Yang, Y., Littler, T., Wang, H. F., et al. (2013) · doi:10.1049/cp.2013.1729 · Cited by 75 · see citing works
Anomaly Detection for Industrial Control Systems Using Sequence-to-Sequence Neural Networks
Kim, J., Yun, J.-H., & Kim, H. C. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-42048-2_1 · Cited by 72 · see citing works
Accurate Modeling of the Siemens S7 SCADA Protocol for Intrusion Detection and Digital Forensics
Kleinmann, A., & Wool, A. (2014) · The journal of digital forensics, security and law · doi:10.15394/jdfsl.2014.1169 · Cited by 69 · see citing works
Intelligent OS X malware threat detection with code inspection
Pajouh, H. H., Dehghantanha, A., Khayami, R., & Choo, K. R. (2017) · Journal of Computer Virology and Hacking Techniques · doi:10.1007/s11416-017-0307-5 · Cited by 65 · see citing works
Shalyga, D., Filonov, P., & Lavrentyev, A. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1807.07282 · Cited by 64 · see citing works
Model-based vehicular prognostics framework using Big Data architecture
Petrillo, A., Picariello, A., Santini, S., et al. (2019) · Computers in Industry · doi:10.1016/j.compind.2019.103177 · Cited by 55 · see citing works
Towards a Systematic Study of the Covert Channel Attacks in Smartphones
Chandra, S., Lin, Z., Kundu, A., & Khan, L. R. (2015) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-319-23829-6_29 · Cited by 46 · see citing works
Clotet, X., Moyano, J. M. D., & León, G. (2018) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2018.08.002 · Cited by 44 · see citing works
OCSVM model combined with K-means recursive clustering for intrusion detection in SCADA systems
Maglaras, L. A., & Jiang, J. (2014) · doi:10.1109/qshine.2014.6928673 · Cited by 43 · see citing works
A Comparison of ICS Datasets for Security Research Based on Attack Paths
Choi, S., Yun, J.-H., & Kim, S.-K. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-05849-4_12 · Cited by 42 · see citing works
Hybrid DeepGCL model for cyber-attacks detection on cyber-physical systems
Alguliyev, R. M., İmamverdiyev, Y., & Sukhostat, L. V. (2021) · Neural Computing and Applications · doi:10.1007/s00521-021-05785-2 · Cited by 34 · see citing works
Cyber-Physical Attack Detection and Recovery Based on RNN in Automotive Brake Systems
Shin, J., Baek, Y., Lee, J., et al. (2018) · Applied Sciences · doi:10.3390/app9010082 · Cited by 24 · see citing works
Denial of Service Attack Detection in Case of Tennessee Eastman Challenge Process
Kiss, I., Haller, P., & Bereş, A. (2015) · Procedia Technology · doi:10.1016/j.protcy.2015.02.120 · Cited by 23 · see citing works
Machine Learning Methods for Industrial Protocol Security Analysis: Issues, Taxonomy, and Directions
Men, J., Lv, Z., Zhou, X., Han, Z., Xian, H., & Song, Y. (2020) · IEEE Access · doi:10.1109/access.2020.2976745 · Cited by 21 · see citing works
Robles-Durazno, A., Moradpoor, N., McWhinnie, J., Russell, G., & Tan, Z. (2021) · Ad Hoc Networks · doi:10.1016/j.adhoc.2021.102590 · Cited by 13 · see citing works
A Literature Survey on High-Dimensional Sparse Principal Component Analysis
Shen, N., & Li, J. (2015) · International Journal of Database Theory and Application · doi:10.14257/ijdta.2015.8.6.06 · Cited by 10 · see citing works
(2021) · Springer eBooks · doi:10.1007/978-3-030-58292-0_230003 · Cited by 1 · see citing works
Flagged first, then by citations
Research works printed but not linked: 3
- [27]Zizzo, G., Hankin, C., Maffeis, S. & Jones, K. Adversarial attacks on time-series intrusion detection for industrial control systems. 10.1109/TrustCom50675.2020.00121/20/$31.00. · DOI
- [42]Gugulothu, N., Malhotra, P., Vig, L. & Shroff, G. Sparse neural networks for anomaly detection in high-dimensional time series. AI4IOT Work. IJCAI 2018. Available: https://www.zurich.ibm.com/AI4IoT/2018/AI4IoT-18_Gugulothu.pdf (2018).
- [55]Turchenko, V. et al. Stanford CS224d: Deep learning for NLP Lecture 4. Sigir, pp. 655–665. Available: https://bit.ly/3EHinqD (2015).
Cited by
Sorted by citations
Seo, J. K., Lee, J., Kim, B., Shim, W., & Seo, J. T. (2025) · Electronics · doi:10.3390/electronics15010020 · Cited by 15 · see citing works
- Authors
- Gulzar, Q., & Mustafa, K.
- Affiliations
- Jamia Millia Islamia (IN)
- Corresponding author
- Gulzar, Qawsar
- Venue
- Scientific Reports
- Published
- 2025-07-22
- Volume
- 15
- Issue
- 1
- Pages
- 26575-26575
- ISSN
- 2045-2322 (ISSN-L)
- PMC
- PMC12284207
- OpenAlex
- W4412551280
- Cited by
- 29
- References
- 56
- Citations by year
- 2026: 25 · 2025: 4
- FWCI
- 12.17
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Locations
- Scientific Reports (publishedVersion, cc-by)
- Europe PMC (PubMed Central) (publishedVersion, cc-by)
- PubMed Central (publishedVersion, cc-by)
- PubMed (publishedVersion)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Funders
- University Grants Commission (200510090572)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Engineering › Biomedical Engineering › Artificial Immune Systems Applications
- Keywords
- industrial control systems, cyberattack detection, anomaly detection, network intrusion detection, LSTM, BiLSTM, sparse principal component analysis, feature selection, class imbalance, SWaT dataset, WADI dataset, Internet of Things security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
