Adaptive learning anomaly detection and classification model for cyber and physical threats in industrial control systems
Open accessAbstract
Abstract A surge of digital technologies adopted into Industrial Control Systems (ICS) exposes critical infrastructures to increasingly hostile and well‐organised cybercrime. The increased need for flexibility and convenient administration expands the attack surface. Likewise, an insider with authorised access reveals a difficult‐to‐detect attack vector. Because of the range of critical services that ICS provide, disruptions to operations could have devastating consequences making ICS an attractive target for sophisticated threat actors. Hence, the authors introduce a novel anomalous behaviour detection model for ICS data streams from physical plant sensors. A model for one‐class classification is developed, using stream rebalancing followed by adaptive machine learning algorithms coupled with drift detection methods to detect anomalies from physical plant sensor data. The authors’ approach is shown on ICS datasets. Additionally, a use case illustrates the model's applicability to post‐incident investigations as part of a defence‐in‐depth capability in ICS. The experimental results show that the proposed model achieves an overall Matthews Correlation Coefficient score of 0.999 and Cohen's Kappa score of 0.9986 on limited variable single‐type anomalous behaviour per data stream. The results on wide data streams achieve an MCC score of 0.981 and a K score of 0.9808 in the prevalence of multiple types of anomalous instances.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The strong reliance on learned correlation profiles implies that significant operating-mode changes, reconfigurations, or sensor upgrades can cause correlation shifts that resemble attacks, requiring adaptive learning, mode-aware modeling, and careful thresholding to avoid false alarms.
“At the same time, the strong reliance on learned correlation profiles implies that significant operating-mode changes, reconfigurations, or sensor upgrades can cause correlation shifts that resemble attacks, requiring adaptive learning, mode-aware modeling, and careful thresholding to avoid false alarms [91,96,98].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [91]
Split into 2 atoms — 0 confirmed, 2 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measuredBy focusing on joint behavior across multiple sensors and control channels, correlation-based detectors can better separate cyber-physical attacks (which often produce inconsistent or coordinated manipulation patterns) from natural faults (which follow typical failure correlations or fault signatures).
“By focusing on joint behavior across multiple sensors and control channels, correlation-based detectors can better separate cyber-physical attacks, which often produce inconsistent or coordinated manipulation patterns, from natural faults that follow typical failure correlations or fault signatures [91,95,96,100,101].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [91]
Split into 2 atoms — 0 confirmed, 2 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measuredThe dataset distribution for sensor-correlation-based methods shows heavy evaluation on SWaT, WADI, GHL, HAI, TE, and power-system benchmarks (IEEE bus systems), with additional evidence from gas-pipeline, GRFICSv2/Factory I/O, and aNormalies-based testbeds.
“Finally, the dataset distribution indicates that sensor-correlation-based methods are heavily evaluated on SWaT, WADI, GHL, HAI, TE, and power-system benchmarks (IEEE bus systems), with additional evidence from gas-pipeline, GRFICSv2/Factory I/O, and aNormalies-based testbeds [88-96,98-102,104-110].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [91]
Section 4.3 (‘The datasets’) says the paper evaluates the aNomalies and HAI datasets, supporting those examples in the citation group. It does not establish the claimed overall distribution of evaluations for sensor-correlation-based methods or document evaluations on the other named benchmarks. (LLM, conf=0.83)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Testing the null hypothesis of stationarity against the alternative of a unit root
Kwiatkowski, D., Phillips, P. C. B., Schmidt, P., & Shin, Y. (1992) · Journal of Econometrics · doi:10.1016/0304-4076(92)90104-y · Cited by 12,633 · see citing works
Machine learning: Trends, perspectives, and prospects
Jordan, M. I., & Mitchell, T. M. (2015) · Science · doi:10.1126/science.aaa8415 · Cited by 9,955 · see citing works
Ensemble methods in machine learning
Dietterich, T. G. (2000) · Lecture Notes in Computer Science · doi:10.1007/3-540-45014-9_1 · Cited by 8,408 · see citing works
A Design Framework for Instrumenting Analytic Provenance for Problem-Solving Tasks
Yang, L., Morizet‐Mahoudeaux, P., Guénand, A., & Mouloudi, A. (2018) · Advances in intelligent systems and computing · doi:10.1007/978-981-10-8612-0_66 · Cited by 6,595 · see citing works
Chicco, D., & Jurman, G. (2020) · BMC Genomics · doi:10.1186/s12864-019-6413-7 · Cited by 6,143 · see citing works
Understanding Machine Learning: From Theory to Algorithms
Shalev-Shwartz, S., & Ben-David, S. (2014) · doi:10.1017/cbo9781107298019 · Cited by 3,115 · see citing works
Ensemble Methods: Foundations and Algorithms
Zhou, Z.-H. (2012) · doi:10.1201/b12207 · Cited by 2,534 · see citing works
Assessing the accuracy of prediction algorithms for classification: an overview
Baldi, P., Brunak, S., Chauvin, Y., Andersen, C. A. F., & Nielsen, H. (2000) · Bioinformatics · doi:10.1093/bioinformatics/16.5.412 · Cited by 2,111 · see citing works
International Conference on Artificial Neural Networks
Boubacar, H. A., & Lecoeuche, S. (1990) · Neural Networks · doi:10.1016/0893-6080(90)90065-s · Cited by 2,088 · see citing works
Stuxnet: Dissecting a cyberwarfare weapon
Langner, R. (2011) · IEEE Security & Privacy Magazine · doi:10.1109/msp.2011.67 · Cited by 1,922 · see citing works
da Gama, J. M. P., Medas, P., Castillo, G., & Rodrigues, P. P. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-28645-5_29 · Cited by 1,635 · see citing works
A Survey of Predictive Modeling on Imbalanced Domains
Branco, P., Torgo, L., & Ribeiro, R. P. (2017) · ACM Computing Surveys · doi:10.1145/2907070 · Cited by 1,129 · see citing works
Ensemble learning for data stream analysis: A survey
Krawczyk, B., Minku, L. L., Gama, J., Stefanowski, J., & Woźniak, M. (2017) · Information Fusion · doi:10.1016/j.inffus.2017.02.004 · Cited by 1,050 · see citing works
Adaptive random forests for evolving data stream classification
Gomes, H. M., Bifet, A., Read, J., Barddal, J. P., Enembreck, F., Pfharinger, B., Holmes, G., & Abdessalem, T. (2017) · Machine Learning · doi:10.1007/s10994-017-5642-8 · Cited by 836 · see citing works
Kuncheva, L. I. (2014) · Wiley eBooks · doi:10.1002/9781118914564 · Cited by 670 · see citing works
2019 International Joint Conference on Neural Networks (IJCNN)
(2019) · doi:10.1109/ijcnn46175.2019 · Cited by 646 · see citing works
Adaptive Learning from Evolving Data Streams
Bifet, A., & Gavaldà, R. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-03915-7_22 · Cited by 497 · see citing works
Online and Non-Parametric Drift Detection Methods Based on Hoeffding’s Bounds
Blanco, I. I. F., del Campo-Ávila, J., Ramos-Jiménez, G., Morales-Bueno, R., Díaz, A. A. O., & Caballero-Mota, Y. (2014) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2014.2345382 · Cited by 470 · see citing works
Exponentially weighted moving average charts for detecting concept drift
Ross, G. J., Adams, N. M., Tasoulis, D. K., & Hand, D. J. (2011) · Pattern Recognition Letters · doi:10.1016/j.patrec.2011.08.019 · Cited by 405 · see citing works
Advanced Persistent threats and how to monitor and deter them
Tankard, C. (2011) · Network Security · doi:10.1016/s1353-4858(11)70086-1 · Cited by 393 · see citing works
The Cybersecurity Landscape in Industrial Control Systems
McLaughlin, S., Konstantinou, C., Wang, X., Davi, L., Sadeghi, A.-R., Maniatakos, M., & Karri, R. (2016) · Proceedings of the IEEE · doi:10.1109/jproc.2015.2512235 · Cited by 391 · see citing works
On the effectiveness of machine and deep learning for cyber security
Apruzzese, G., Colajanni, M., Ferretti, L., Guido, A., & Marchetti, M. (2018) · doi:10.23919/cycon.2018.8405026 · Cited by 358 · see citing works
Why Cohen’s Kappa should be avoided as performance measure in classification
Delgado, R., & Tibau, X.-A. (2019) · PLOS ONE · doi:10.1371/journal.pone.0222916 · Cited by 324 · see citing works
Ding, Z., & Fei, M. (2013) · IFAC Proceedings Volumes · doi:10.3182/20130902-3-cn-3020.00044 · Cited by 324 · see citing works
Detection of advanced persistent threat using machine-learning correlation analysis
Ghafir, I., Hammoudeh, M. A. A., Přenosil, V., Han, L., Hegarty, R., Rabie, K. M., & Aparicio‐Navarro, F. J. (2018) · Future Generation Computer Systems · doi:10.1016/j.future.2018.06.055 · Cited by 290 · see citing works
Industrial Control Systems: Cyberattack trends and countermeasures
Alladi, T., Chamola, V., & Zeadally, S. (2020) · Computer Communications · doi:10.1016/j.comcom.2020.03.007 · Cited by 268 · see citing works
KNN Classifier with Self Adjusting Memory for Heterogeneous Concept Drift
Losing, V., Hammer, B., & Wersing, H. (2016) · Proceedings · doi:10.1109/icdm.2016.0040 · Cited by 251 · see citing works
Skopik, F., Settanni, G., & Fiedler, R. (2016) · Computers & Security · doi:10.1016/j.cose.2016.04.003 · Cited by 246 · see citing works
Evaluation of Machine Learning Algorithms for Anomaly Detection
Elmrabit, N., Zhou, F., Li, F., & Zhou, H. (2020) · International Conference on Cyber Security and Protection of Digital Services (Cyber Security) · doi:10.1109/cybersecurity49315.2020.9138871 · Cited by 223 · see citing works
A Review of Cybersecurity Incidents in the Water Sector
Hassanzadeh, A., Rasekh, A., Galelli, S., Aghashahi, M., Taormina, R., Ostfeld, A., & Banks, M. K. (2020) · Journal of Environmental Engineering · doi:10.1061/(asce)ee.1943-7870.0001686 · Cited by 195 · see citing works
Fast anomaly detection for streaming data
Tan, S. C., Ting, K. M., & Liu, F. (2011) · FedUni ResearchOnline (Federation University Australia) · doi:10.5591/978-1-57735-516-8/ijcai11-254 · Cited by 193 · see citing works
Cybersecurity in industrial control systems: Issues, technologies, and challenges
Asghar, M. R., Hu, Q., & Zeadally, S. (2019) · Computer Networks · doi:10.1016/j.comnet.2019.106946 · Cited by 172 · see citing works
A Review of Anomaly Detection Strategies to Detect Threats to Cyber-Physical Systems
Jeffrey, N., Tan, Q., & Villar, J. R. (2023) · Electronics · doi:10.3390/electronics12153283 · Cited by 160 · see citing works
Distributed Ledger Technologies in Supply Chain Security Management: A Comprehensive Survey
Asante, M., Epiphaniou, G., Maple, C. R., Al‐Khateeb, H., Bottarelli, M., & Ghafoor, K. Z. (2021) · IEEE Transactions on Engineering Management · doi:10.1109/tem.2021.3053655 · Cited by 158 · see citing works
Self-citationLin, Q., Adepu, S., Verwer, S., & Mathur, A. P. (2018) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3196494.3196546 · Cited by 157 · see citing works
Anomaly Detection for Insider Threats Using Unsupervised Ensembles
Le, D. C., & Zincir-Heywood, N. (2021) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2021.3071928 · Cited by 147 · see citing works
Proceedings of the 12th international joint conference on Artificial intelligence - Volume 1
Mylopoulos, J., & Reiter, R. (1991) · Cited by 136 · see citing works
Evaluation methods and decision theory for classification of streaming data with temporal dependence
Žliobaitė, I., Bifet, A., Read, J., Pfahringer, B., & Holmes, G. (2014) · Machine Learning · doi:10.1007/s10994-014-5441-4 · Cited by 127 · see citing works
12th USENIX Workshop on Cyber Security Experimentation and Test (CSET '19).
Petérson, P. A., & Jansen, R. (2019) · Cited by 112 · see citing works
A Hardware-in-the-Loop Water Distribution Testbed Dataset for Cyber-Physical Security Testing
Faramondi, L., Flammini, F., Guarino, S., & Setola, R. (2021) · IEEE Access · doi:10.1109/access.2021.3109465 · Cited by 104 · see citing works
Pitfalls in Benchmarking Data Stream Classification and How to Avoid Them
Bifet, A., Read, J., Žliobaitė, I., Pfahringer, B., & Holmes, G. (2013) · Lecture notes in computer science · doi:10.1007/978-3-642-40988-2_30 · Cited by 87 · see citing works
IoT-Forensics Meets Privacy: Towards Cooperative Digital Investigations
Nieto, A., Rı́os, R., & López, J. (2018) · Sensors · doi:10.3390/s18020492 · Cited by 86 · see citing works
Cyber-attack detection in SCADA systems using temporal pattern recognition techniques
Kalech, M. (2019) · Computers & Security · doi:10.1016/j.cose.2019.03.007 · Cited by 82 · see citing works
Cyber Physical Systems Security: A Brief Survey
Shafi, Q. M. (2012) · International Conference on Computational Science and Its Applications · doi:10.1109/iccsa.2012.36 · Cited by 80 · see citing works
Cyber Resilience and Incident Response in Smart Cities: A Systematic Literature Review
Ahmadi‐Assalemi, G., Al‐Khateeb, H., Epiphaniou, G., & Maple, C. R. (2020) · Smart Cities · doi:10.3390/smartcities3030046 · Cited by 78 · see citing works
Self-citationDetecting cyberattacks in industrial control systems using online learning algorithms
Li, G., Shen, Y., Zhao, P., Lu, X., Liu, J., Liu, Y., & Hoi, S. C. H. (2019) · Neurocomputing · doi:10.1016/j.neucom.2019.07.031 · Cited by 74 · see citing works
Bakalos, N., Voulodimos, A. S., Doulamis, N. D., Doulamis, A. D., Ostfeld, A., Salomons, E., Caubet, J., Jimenez, V., & Li, P. (2019) · IEEE Signal Processing Magazine · doi:10.1109/msp.2018.2885359 · Cited by 73 · see citing works
Blockchain for Modern Digital Forensics: The Chain-of-Custody as a Distributed Ledger
Al‐Khateeb, H., Epiphaniou, G., & Daly, H. (2019) · Advanced sciences and technologies for security applications · doi:10.1007/978-3-030-11289-9_7 · Cited by 73 · see citing works
Self-citationApplying Hoeffding Adaptive Trees for Real-Time Cyber-Power Event and Intrusion Classification
Adhikari, U., Morris, T. H., & Pan, S. (2017) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2017.2647778 · Cited by 70 · see citing works
Digital Witness: Safeguarding Digital Evidence by Using Secure Architectures in Personal Devices
Nieto, A., Román, R., & López, J. (2016) · IEEE Network · doi:10.1109/mnet.2016.1600087nm · Cited by 62 · see citing works
Alimi, O. A., Ouahada, K., Abu-Mahfouz, A. M. I., Rimer, S., & Alimi, K. O. A. (2021) · Sustainability · doi:10.3390/su13179597 · Cited by 58 · see citing works
Anomaly Detection for Data Streams Based on Isolation Forest Using Scikit-Multiflow
Togbe, M. U., Barry, M., Boly, A., Chabchoub, Y., Chiky, R., Montiel, J., & Tran, V.-T. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-58811-3_2 · Cited by 54 · see citing works
ICS-BlockOpS: Blockchain for operational data security in industrial control system
Maw, A., Adepu, S., & Mathur, A. P. (2019) · Pervasive and Mobile Computing · doi:10.1016/j.pmcj.2019.101048 · Cited by 53 · see citing works
A Spiking One-Class Anomaly Detection Framework for Cyber-Security on Industrial Control Systems
Demertzis, K., Iliadis, L., & Spartalis, S. (2017) · Communications in computer and information science · doi:10.1007/978-3-319-65172-9_11 · Cited by 52 · see citing works
Martindale, N., Ismail, M., & Talbert, D. A. (2020) · Information · doi:10.3390/info11060315 · Cited by 49 · see citing works
Dataset of anomalies and malicious acts in a cyber-physical subsystem
Laso, P. M., Brosset, D., & Puentes, J. (2017) · Data in Brief · doi:10.1016/j.dib.2017.07.038 · Cited by 48 · see citing works
Attacks on the Industrial Internet of Things – Development of a multi-layer Taxonomy
Berger, S., Bürger, O., & Röglinger, M. (2020) · Computers & Security · doi:10.1016/j.cose.2020.101790 · Cited by 47 · see citing works
Classifier Concept Drift Detection and the Illusion of Progress
Bifet, A. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-59060-8_64 · Cited by 45 · see citing works
Adaptive Random Forests with Resampling for Imbalanced data Streams
Ferreira, L. E. B., Gomes, H. M., Bifet, A., & Oliveira, L. (2019) · IEEE International Joint Conference on Neural Network · doi:10.1109/ijcnn.2019.8852027 · Cited by 45 · see citing works
Event stream processing for improved situational awareness in the smart grid
Dahal, N., Abuomar, O. “., King, R., & Madani, V. (2015) · Expert Systems with Applications · doi:10.1016/j.eswa.2015.05.003 · Cited by 44 · see citing works
Abdulsalam, H. M., Skillicorn, D. B., & Martin, P. (2007) · Proceedings - International Database Engineering and Applications Symposium · doi:10.1109/ideas.2007.4318108 · Cited by 41 · see citing works
CD-MOA: Change Detection Framework for Massive Online Analysis
Bifet, A., Read, J., Pfahringer, B., Holmes, G., & Žliobaitė, I. (2013) · Lecture notes in computer science · doi:10.1007/978-3-642-41398-8_9 · Cited by 40 · see citing works
Attack Tree Analysis for Insider Threats on the IoT Using Isabelle
Kammüller, F., Nurse, J. R. C., & Probst, C. W. (2016) · Lecture notes in computer science · doi:10.1007/978-3-319-39381-0_21 · Cited by 36 · see citing works
Cyber Security Risk Assessment on Industry 4.0 using ICS testbed with AI and Cloud
Matsuda, W., Fujimoto, M., Aoyama, T., & Mitsunaga, T. (2019) · IEEE Conference on Application, Information and Network Security (AINS) · doi:10.1109/ains47559.2019.8968698 · Cited by 35 · see citing works
Incident Analysis & Digital Forensics in SCADA and Industrial Control Systems
Spyridopoulos, T., May, J. H. R., & Tryfonas, T. (2013) · doi:10.1049/cp.2013.1720 · Cited by 34 · see citing works
Ahmadi-Assalemi, G., Al-Khateeb, H., Epiphaniou, G., & Aggoun, A. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2022.3144127 · Cited by 34 · see citing works
Self-citationAhmadi‐Assalemi, G., Al‐Khateeb, H., Epiphaniou, G., Cosson, J., Jahankhani, H., & Pillai, P. (2019) · International Conference on Global Security, Safety, and Sustainability · doi:10.1109/icgs3.2019.8688297 · Cited by 34 · see citing works
Self-citationIdentifying data streams anomalies by evolving spiking restricted Boltzmann machines
Xing, L., Demertzis, K., & Yang, J. (2019) · Neural Computing and Applications · doi:10.1007/s00521-019-04288-5 · Cited by 34 · see citing works
Classifying Evolving Data Streams Using Dynamic Streaming Random Forests
Abdulsalam, H. M., Skillicorn, D. B., & Martin, P. (2008) · Lecture notes in computer science · doi:10.1007/978-3-540-85654-2_54 · Cited by 33 · see citing works
Generative AI and Cognitive Computing-Driven Intrusion Detection System in Industrial CPS
Islam, S., Javeed, D., Saeed, M. S., Kumar, P., Jolfaei, A., & Islam, A. K. M. N. (2024) · Cognitive Computation · doi:10.1007/s12559-024-10309-w · Cited by 33 · see citing works
Forensic readiness of smart buildings: Preconditions for subsequent cybersecurity tests
Bajramović, E., Waedt, K., Ciriello, A., & Gupta, D. (2016) · IEEE International Smart Cities Conference (ISC2) · doi:10.1109/isc2.2016.7580754 · Cited by 31 · see citing works
Digital Witness and Privacy in IoT: Anonymous Witnessing Approach
Nieto, A., Rı́os, R., & López, J. (2017) · doi:10.1109/trustcom/bigdatase/icess.2017.295 · Cited by 26 · see citing works
Representing Industrial Data Streams in Digital Twins using Semantic Labeling
Zehnder, P., & Riemer, D. (2018) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata.2018.8622400 · Cited by 23 · see citing works
A Survey of Incremental Deep Learning for Defect Detection in Manufacturing
Mohandas, R., Southern, M., O’Connell, E., & Hayes, M. J. (2024) · Big Data and Cognitive Computing · doi:10.3390/bdcc8010007 · Cited by 23 · see citing works
Incremental Rebalancing Learning on Evolving Data Streams
Bernardo, A., Valle, E. D., & Bifet, A. (2020) · IEEE ... International Conference on Data Mining workshops · doi:10.1109/icdmw51313.2020.00121 · Cited by 19 · see citing works
MOLESTRA: A Multi-Task Learning Approach for Real-Time Big Data Analytics
Demertzis, K., Iliadis, L. A., & Anezakis, V.-D. (2018) · doi:10.1109/inista.2018.8466306 · Cited by 19 · see citing works
Vance, T. R., & Vance, A. (2019) · International Scientific-Practical Conference Problems of Infocommunications Science and Technology · doi:10.1109/picst47496.2019.9061242 · Cited by 19 · see citing works
Design and assessment of an Orthogonal Defense Mechanism for a water treatment facility
Shrivastava, S., Adepu, S., & Mathur, A. P. (2018) · Robotics and Autonomous Systems · doi:10.1016/j.robot.2017.12.005 · Cited by 18 · see citing works
Cyber-Physical Systems Security
Gollmann, D., & Krotofil, M. (2016) · Lecture notes in computer science · doi:10.1007/978-3-662-49301-4_14 · Cited by 17 · see citing works
A new model approach of electrical cyber physical systems considering cyber security
Wang, Y., & Yan, G. (2018) · IEEJ Transactions on Electrical and Electronic Engineering · doi:10.1002/tee.22798 · Cited by 15 · see citing works
A Dynamic Ensemble Learning Framework for Data Stream Analysis and Real-Time Threat Detection
Demertzis, K., Iliadis, L. A., & Anezakis, V.-D. (2018) · Lecture notes in computer science · doi:10.1007/978-3-030-01418-6_66 · Cited by 14 · see citing works
Settanni, G., Shovgenya, Y., Skopik, F., Graf, R., Wurzenberger, M., & Fiedler, R. (2016) · Conference on Privacy, Security and Trust · doi:10.1109/pst.2016.7906940 · Cited by 13 · see citing works
Proceedings of the Third Central European Cybersecurity Conference
(2019) · doi:10.1145/3360664 · Cited by 12 · see citing works
Feature Scoring using Tree-Based Ensembles for Evolving Data Streams
Gomes, H. M., de Mello, R. F., Pfahringer, B., & Bifet, A. (2019) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata47090.2019.9006366 · Cited by 11 · see citing works
Nixon, C. J., Sedky, M., & Hassan, M. (2020) · International Conference on Cloud and Big Data Computing (ICCBDC) · doi:10.1145/3416921.3416937 · Cited by 11 · see citing works
Cyber-Typhon: An Online Multi-task Anomaly Detection Framework
Demertzis, K., Iliadis, L. S., Kikiras, P., & Tziritas, N. (2019) · IFIP advances in information and communication technology · doi:10.1007/978-3-030-19823-7_2 · Cited by 9 · see citing works
Empirical Comparison of Machine Learning Algorithms for Mitigating Power Systems Intrusion Attacks
Alimi, O. A., Ouahada, K., Abu-Mahfouz, A. M. I., et al. (2020) · International Symposium on Networks, Computers and Communications (ISNCC) · doi:10.1109/isncc49221.2020.9297340 · Cited by 6 · see citing works
On the Feasibility of Secure Logging for Industrial Control Systems Using Blockchain
Schorradt, S., Bajramović, E., & Freiling, F. (2019) · European Interdisciplinary Cybersecurity Conference (EICC) · doi:10.1145/3360664.3360668 · Cited by 4 · see citing works
Flagged first, then by citations
Research works printed but not linked: 5
- Schrecker, S., et al.: Industrial Internet of Things Volume G4: Security Framework, pp. 1-173. Ind. Internet Consort (2016). https://www. iiconsortium.org/pdf/IIC_PUB_G4_V1.00_PB.pdf. [Online],Accessed 28 December 2020 Available:
- Morgan Kaufmann Publishers Inc., Seattle (2001). https://doi.org/10.5555/1642194.1642224 · DOI
- Bifet, A., et al.: MOA: massive online analysis, a framework for stream classification and clustering. In: Proceedings of the First Workshop on Applications of Pattern Analysis, Proceedings of Machine Learning Research, pp. 44--50. PMLR (2010). https://proceedings.mlr.press/ v11/bifet10a.html. Accessed: 23 08 2021
- Guarino, L, S.F.; Setola, R.; Flammini, F.: A hardware-in-the-loop water distribution testbed (WDT) dataset for cyber-physical security testing, (2021), https://doi.org/10.21227/rbvf-2h90 · DOI
- Shin, H.-K., et al.: {HAI} 1.0: HIL-based augmented {ICS} security dataset. In: 13th {USENIX} Workshop on Cyber Security Experi- mentation and Test ({CSET} 20) (2019). https://github.com/ icsdataset/hai. Accessed: 15 03 2021
Cited by
Sorted by citations
Seo, J. K., Lee, J., Kim, B., Shim, W., & Seo, J. T. (2025) · Electronics · doi:10.3390/electronics15010020 · Cited by 15 · see citing works
Bhattacharya, S., Greidanus, M. D. R., Gupta, S., Sur, D., Mazumder, S. K., & Govindarasu, M. (2025) · IEEE Journal of Emerging and Selected Topics in Industrial Electronics · doi:10.1109/jestie.2025.3589164 · Cited by 4 · see citing works
Ou, Y., Huang, S., Wang, F., Zhou, K., & Shu, Y. (2025) · International Conference on Electronic Information Engineering and Computer Communication (EIECC) · doi:10.1109/eiecc67963.2025.11409666 · Cited by 1 · see citing works
A, A. K., & Sangeetha, S. (2025) · International Conference on IoT Based Control Networks and Intelligent Systems (ICICNIS) · doi:10.1109/icicnis66685.2025.11315627
Guest Editorial: Artificial Intelligence and Industrial Cyber‐Physical Security
Saxena, N., Choi, B. J., Choo, K. R., & Dehghantanha, A. (2026) · IET Cyber-Physical Systems Theory & Applications · doi:10.1049/cps2.70052
Reservoir Computing Based Anomaly Detection in Industrial Control Systems
Slonopas, A., Olbrych, E., Corley, M., & Strahan, J. (2026) · IEEE International Conference on AI and Data Analytics (ICAD) · doi:10.1109/icad69378.2026.11608670
Shoukat, M. Z., Yan, Y., Su, Z., Umer, M., Alnowaiser, K., & Cascone, L. (2026) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2026.111402
Al-Hija’a, A. A., Szekeres, B. J., & Andó, M. (2026) · The International Journal of Advanced Manufacturing Technology · doi:10.1007/s00170-026-18904-x
Pérez-Pérez, E.-J. (2026) · Eng—Advances in Engineering · doi:10.3390/eng7100564
Adaptive Cyber Defense for Industrial Control Systems Using Machine Learning
Babu, R. K., Jayram, L., & Narayana, V. V. (2026) · International Conference on Networks, Computers and Communications (ICNCCom) · doi:10.1109/icnccom69117.2026.11736207
- Authors
- Ahmadi‐Assalemi, G., Al‐Khateeb, H., Benson, V., Adamyk, B., & Ammi, M.
- Affiliations
- Aston University (GB)
- Naif Arab University for Security Sciences (SA)
- Corresponding author
- Al‐Khateeb, Haider
- Venue
- IET Cyber-Physical Systems: Theory & Applications
- Published
- 2025-01
- Volume
- 10
- Issue
- 1
- ISSN
- 2398-3396 (ISSN-L)
- OpenAlex
- W4407584683
- Cited by
- 10
- References
- 77
- Citations by year
- 2026: 6 · 2025: 4
- FWCI
- 3.98
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- IET Cyber-Physical Systems Theory & Applications (publishedVersion, cc-by)
- Aston Publications Explorer (Aston University) (submittedVersion)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Control and Systems Engineering › Fault Detection and Control Systems
- Keywords
- industrial control systems, anomaly detection, cyber-physical threats, insider threats, one-class classification, adaptive machine learning, concept drift detection, sensor data streams, defense-in-depth, critical infrastructure security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
