A cyber-security methodology for a cyber-physical industrial control system testbed
Open accessAbstract
Due to recent increase in deployment of Cyber-Physical Industrial Control Systems in different critical infrastructures, addressing cyber-security challenges of these systems is vital for assuring their reliability and secure operation in presence of malicious cyber attacks. Towards this end, developing a testbed to generate real-time data-sets for critical infrastructure that would be utilized for validation of real-time attack detection algorithms are indeed highly needed. This paper investigates and proposes the design and implementation of a cyber-physical industrial control system testbed where the Tennessee Eastman process is simulated in real-time on a PC and the closed-loop controllers are implemented on the Siemens PLCs. False data injection cyber attacks are injected to the developed testbed through the man-in-the-middle structure where the malicious hackers can in real-time modify the sensor measurements that are sent to the PLCs. Furthermore, various cyber attack detection algorithms are developed and implemented in real-time on the testbed and their performance and capabilities are compared and evaluated.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Reconstruction-error-based methods are particularly effective for detecting sensor/actuator faults, false data injection, command manipulation, and generic injection-type attacks that cause local or global distortions in multivariate process trajectories.
“First, these methods are particularly effective for detecting sensor/actuator faults, false data injection, command manipulation, and generic injection-type attacks that cause local or global distortions in multivariate process trajectories [77,79,81-83,86,87].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [86]
The PCA subsection (page not available in our copy) describes detecting cyber attacks by thresholding the distance between process data and its PCA reconstruction, and discusses global and local deviations. The Cyber Attack Injection section describes false sensor-data injection, but the paper does not establish that reconstruction-error methods are particularly effective across sensor/actuator faults, command manipulation, and generic injection attacks. Its comparative results instead highlight OCSVM and kNN performance. (LLM, conf=0.86)
Experimental — accuracy not yet measuredAutoencoder-like models (AE, VAE, OC-NN) and PCA-based approaches can flag process states that lie outside the learned normal manifold, including zero-day attack scenarios that were not explicitly seen during training.
“By learning a compact representation of normal operating conditions and monitoring reconstruction error or boundary-based anomaly scores, autoencoder-like models (AE, VAE, OC-NN) and PCA-based approaches can flag process states that lie outside the learned normal manifold, including zero-day attack scenarios that were not explicitly seen during training [77,79,81-83,86,87].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [86]
The PCA section (page unavailable) describes using reconstruction distance to flag test points as cyber attacks, and the OCSVM section describes a boundary learned from healthy-operation data. The paper does not establish the claim for AE, VAE, or OC-NN, nor does it specifically address zero-day attacks unseen during training. (LLM, conf=0.88)
Experimental — accuracy not yet measuredSome approaches rely almost exclusively on reconstruction error derived from AE or VAE models trained on normal process data, while others treat boundary distances in one-class neural networks or PCA-residual statistics as functionally equivalent 'reconstruction-like' anomaly measures.
“Some approaches rely almost exclusively on reconstruction error derived from AE or VAE models trained on normal process data [77,79,83], while others treat boundary distances in one-class neural networks or PCA-residual statistics as functionally equivalent 'reconstruction-like' anomaly measures [81,86].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [86]
Split into 2 atoms — 0 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 1 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measuredThis necessitates careful design of feature selection, mode handling, and adaptive thresholding, as well as periodic model updates, to avoid an excessive false-positive burden in real deployments.
“This necessitates careful design of feature selection, mode handling, and adaptive thresholding, as well as periodic model updates, to avoid an excessive false-positive burden in real deployments [77,79,83,86,87].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [86]
The post-processing section (page unavailable in our copy) describes a window-based decision rule intended to reduce false alarms. The kNN section sets a detection threshold from training data, but the paper does not support the attributed recommendations for feature selection, mode handling, adaptive thresholding, or periodic model updates in real deployments. (LLM, conf=0.85)
Experimental — accuracy not yet measuredComparative studies on SWaT and TE data further confirm that reconstruction-error-based detectors often outperform classical statistical methods in capturing complex nonlinear relationships among process variables.
“Comparative studies on SWaT and TE data further confirm that reconstruction-error-based detectors often outperform classical statistical methods in capturing complex nonlinear relationships among process variables [82,86].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [86]
The Introduction and Comparative Testing and Validation Results describe a comparison of anomaly detectors on a Tennessee Eastman testbed, and the paper’s PCA algorithm uses reconstruction error. But the reported promising performers are OCSVM and kNN, not reconstruction-error-based detectors; the cited passages do not establish that such detectors outperform classical statistical methods, and they do not report a SWaT comparison. Page numbers were not available in our copy. (LLM, conf=0.86)
Experimental — accuracy not yet measured
The dataset distribution for reconstruction-error-based anomaly detection studies shows a strong reliance on a limited set of public process benchmarks (SWaT, HAI, BATADAL, and TE) supplemented by a small number of custom-built CAN fieldbus and wind-turbine SCADA datasets.
“Finally, the dataset distribution again reveals a strong reliance on a limited set of public process benchmarks-SWaT, HAI, BATADAL, and TE-supplemented by a small number of custom-built CAN fieldbus and wind-turbine SCADA datasets [77,79,81-83,85-87].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [86]
The Contributions and Dataset sections show that this study used a Tennessee Eastman (TE) process testbed and generated its own data, so it supports TE as an example among the cited studies. It does not establish the claimed distribution across studies or describe its dataset as a public TE benchmark; its reported detection methods are PCA, OCSVM, LOF, kNN, and isolation forest, rather than reconstruction-error-based detection. No page numbers were available in our copy. (LLM, conf=0.84)
Experimental — accuracy not yet measuredNoorizadeh et al. [86] proposed a cybersecurity evaluation methodology that compares multiple data-driven detectors, including PCA, OCSVM, LOF, kNN, and Isolation Forest, using process data from a Tennessee Eastman (TE) chemical-process-based CPS testbed.
“Using process data (sensor and manipulated variables) collected from a Tennessee Eastman (TE) chemical-process-based CPS testbed, Noorizadeh et al. [86] proposed a cybersecurity evaluation methodology that compares multiple data-driven detectors, including PCA, OCSVM, LOF, kNN, and Isolation Forest.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [86]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Scikit-learn: Machine Learning in Python
Pedregosa, F., Varoquaux, G., Gramfort, A., Michel, V., Thirion, B., Grisel, O., Blondel, M., Müller, A., Nothman, J., Louppe, G., et al. (2012) · arXiv · doi:10.48550/arxiv.1201.0490 · Cited by 71,016 · see citing works
Liu, F. T., Ting, K. M., & Zhou, Z.-H. (2008) · 2008 Eighth IEEE International Conference on Data Mining · doi:10.1109/icdm.2008.17 · Cited by 6,601 · see citing works
Estimating the Support of a High-Dimensional Distribution
Schölkopf, B., Platt, J. C., Shawe-Taylor, J., Smola, A. J., & Williamson, R. C. (2001) · Neural Computation · doi:10.1162/089976601750264965 · Cited by 6,168 · see citing works
LOF: identifying density-based local outliers
Breunig, M. M., Kriegel, H.-P., Ng, R. T., & Sander, J. (2000) · ACM SIGMOD Record · doi:10.1145/335191.335388 · Cited by 5,207 · see citing works
A plant-wide industrial process control problem
Downs, J. J., & Vogel, E. F. (1993) · Computers & Chemical Engineering · doi:10.1016/0098-1354(93)80018-i · Cited by 3,348 · see citing works
Isolation-Based Anomaly Detection
Liu, F. T., Ting, K. M., & Zhou, Z. (2012) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/2133360.2133363 · Cited by 2,112 · see citing works
A Comparative Evaluation of Unsupervised Anomaly Detection Algorithms for Multivariate Data
Goldstein, M., & Uchida, S. (2016) · PLOS ONE · doi:10.1371/journal.pone.0152173 · Cited by 1,032 · see citing works
SWaT: a water treatment testbed for research and training on ICS security
Mathur, A. P., & Tippenhauer, N. O. (2016) · International Workshop on Cyber-Physical Systems for Smart Water Networks (CySWater) · doi:10.1109/cyswater.2016.7469060 · Cited by 974 · see citing works
Fast Outlier Detection in High Dimensional Spaces
Angiulli, F., & Pizzuti, C. (2002) · Lecture notes in computer science · doi:10.1007/3-540-45681-3_2 · Cited by 880 · see citing works
A Dataset to Support Research in the Design of Secure Water Treatment Systems
Goh, J., Adepu, S., Junejo, K. N., & Mathur, A. (2017) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-71368-7_8 · Cited by 729 · see citing works
Attacks against process control systems: risk assessment, detection, and response
Cárdenas, A. A., Amin, S., Lin, Z.-S., Huang, Y.-L., Huang, C.-Y., & Sastry, S. (2011) · Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security · doi:10.1145/1966913.1966959 · Cited by 699 · see citing works
A Novel Anomaly Detection Scheme Based on Principal Component Classifier
Shyu, M., Chen, S., Sarinnapakorn, K., & Chang, L. (2003) · Cited by 602 · see citing works
Ahmed, C. M., Palleti, V. R., & Mathur, A. P. (2017) · International Workshop on Cyber-Physical Systems for Smart Water Networks (CySWater) · doi:10.1145/3055366.3055375 · Cited by 574 · see citing works
Revision of the Tennessee Eastman Process Model
Bathelt, A., Ricker, N. L., & Jelali, M. (2015) · IFAC-PapersOnLine · doi:10.1016/j.ifacol.2015.08.199 · Cited by 461 · see citing works
Zhang, F., Kodituwakku, H. A. D. E., Hines, J. W., & Coble, J. B. (2019) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2019.2891261 · Cited by 371 · see citing works
Limiting the Impact of Stealthy Attacks on Industrial Control Systems
Urbina, D. I., Giraldo, J., Cárdenas, Á. A., Tippenhauer, N. O., Valente, J., Faisal, M. A., Ruths, J., Candell, R., & Sandberg, H. (2016) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2976749.2978388 · Cited by 360 · see citing works
SCADA System Testbed for Cybersecurity Research Using Machine Learning Approach
Teixeira, M. A., Salman, T., Zolanvari, M., Jain, R. K., Meskin, N., & Samaka, M. (2018) · Future Internet · doi:10.3390/fi10080076 · Cited by 178 · see citing works
Self-citationA testbed for analyzing security of SCADA control systems (TASSCS)
Mallouhi, M., Al-Nashif, Y., Cox, D., Chadaga, T., & Hariri, S. (2011) · ISGT 2011 · doi:10.1109/isgt.2011.5759169 · Cited by 164 · see citing works
A control system testbed to validate critical infrastructure protection concepts
Morris, T. H., Srivastava, A. K., Reaves, B., Gao, W., Pavurapu, K., & Reddi, R. M. (2011) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2011.06.005 · Cited by 162 · see citing works
Nonlinear modeling and state estimation for the Tennessee Eastman challenge process
Ricker, N. L., & Lee, J. H. (1995) · Computers & Chemical Engineering · doi:10.1016/0098-1354(94)00113-3 · Cited by 144 · see citing works
Distributed Attack Detection in a Water Treatment Plant: Method and Case Study
Adepu, S., & Mathur, A. P. (2018) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2018.2875008 · Cited by 132 · see citing works
A Dual-Isolation-Forests-Based Attack Detection Framework for Industrial Control Systems
Elnour, M., Meskin, N., Khan, K. M., & Jain, R. K. (2020) · IEEE Access · doi:10.1109/access.2020.2975066 · Cited by 117 · see citing works
Self-citationA Survey of Industrial Control System Testbeds
Holm, H., Karresand, M., Vidström, A., & Westring, E. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-26502-5_2 · Cited by 104 · see citing works
An experimental platform for assessing SCADA vulnerabilities and countermeasures in power plants
Fovino, I. N., Masera, M., Guidi, L., & Carpi, G. (2010) · Conference on Human System Interactions · doi:10.1109/hsi.2010.5514494 · Cited by 86 · see citing works
A Dynamic Decision-Making Approach for Intrusion Response in Industrial Control Systems
Li, X., Zhou, C., Tian, Y., & Qin, Y. (2018) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2018.2866445 · Cited by 74 · see citing works
Cyber attack and defense on industry control systems
Lin, C.-T., Wu, S., & Lee, M.-L. (2017) · IEEE Conference on Dependable and Secure Computing (DSC) · doi:10.1109/desec.2017.8073874 · Cited by 68 · see citing works
A clustering-based approach to detect cyber attacks in process control systems
Kiss, I., Genge, B., & Haller, P. (2015) · 2022 IEEE 20th International Conference on Industrial Informatics (INDIN) · doi:10.1109/indin.2015.7281725 · Cited by 61 · see citing works
Krotofil, M., Cárdenas, Á. A., Larsen, J., & Gollmann, D. (2014) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2014.10.003 · Cited by 57 · see citing works
Li, X., Zhou, C., Tian, Y., Xiong, N. N., & Qin, Y. (2017) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2017.2740571 · Cited by 57 · see citing works
RNN-based Early Cyber-Attack Detection for the Tennessee Eastman ProcessPreprint
Filonov, P., Kitashov, F., & Lavrentyev, A. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1709.02232 · Cited by 56 · see citing works
Exploring Security in PROFINET IO
Åkerberg, J., & Björkman, M. (2009) · doi:10.1109/compsac.2009.61 · Cited by 44 · see citing works
Monitoring system reaction in cyber-physical testbed under cyber-attacks
Bernieri, G., Miciolino, E. E., Pascucci, F., & Setola, R. (2017) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2017.02.010 · Cited by 41 · see citing works
Krotofil, M., Cárdenas, Á. A., Manning, B., & Larsen, J. (2014) · Annual Computer Security Applications Conference · doi:10.1145/2664243.2664290 · Cited by 40 · see citing works
The Design of ICS Testbed Based on Emulation, Physical, and Simulation (EPS-ICS Testbed)
Gao, H., Peng, Y., Jia, K., Dai, Z., & Wang, T. (2013) · International Conference on Intelligent Information Hiding and Multimedia Signal Processing (IIH-MSP) · doi:10.1109/iih-msp.2013.111 · Cited by 38 · see citing works
Control of the Tennessee Eastman process using input-output models
Sriniwas, G. R., & Arkun, Y. (1997) · Journal of Process Control · doi:10.1016/s0959-1524(97)00015-2 · Cited by 34 · see citing works
Mishra, V. K., Palleti, V. R., & Mathur, A. P. (2019) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2019.05.001 · Cited by 29 · see citing works
Denial of Service Attack Detection in Case of Tennessee Eastman Challenge Process
Kiss, I., Haller, P., & Bereş, A. (2015) · Procedia Technology · doi:10.1016/j.protcy.2015.02.120 · Cited by 23 · see citing works
A virtual testbed for security management of industrial control systems
Koganti, V. S., Ashrafuzzaman, M., Jillepalli, A. A., & Sheldon, F. T. (2017) · International Conference on Malicious and Unwanted Software · doi:10.1109/malware.2017.8323960 · Cited by 18 · see citing works
Negi, R., Parvin, K., Ghosh, S., Shukla, S. K., & Gahlot, A. (2019) · IEEE International Conference on Industrial Cyber-Physical Systems (ICPS) · doi:10.1109/icphys.2019.8780291 · Cited by 17 · see citing works
No Need to Marry to Change Your Name! Attacking Profinet IO Automation Networks Using DCP
Mehner, S., & König, H. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-22038-9_19 · Cited by 13 · see citing works
Cyber-Physical System Discovery
Winnicki, A., Krotofil, M., & Gollmann, D. (2017) · doi:10.1145/3055186.3055195 · Cited by 8 · see citing works
Timing of Cyber-Physical Attacks on Process Control Systems
Krotofil, M., Cárdenas, Á. A., & Angrishi, K. (2014) · Lecture notes in computer science · doi:10.1007/978-3-662-45355-1_3 · Cited by 1 · see citing works
Flagged first, then by citations
Research works printed but not linked: 5
- Y. Zhao, Z. Nasrullah, and Z. Li, ''PyOD: A Python toolbox for scalable outlier detection,'' J. Mach. Learn. Res., vol. 20, no. 96, pp. 1-7, Jan. 2019.
- M. Krotofil, A. A. Cárdenas, B. Manning, and J. Larsen, ''CPS: Driving cyber-physical systems to unsafe operating conditions by timing DoS attacks on sensor signals,'' in Proc. 30th Annu. Comput. Secur. Appl. Conf. (ACSAC), 2014, pp. 146-155.
- Z.-S. Lin, A. A. Cárdenas, S. Amin, H.-Y. Tsai, Y.-L. Huang, and S. Sastry, ''Security analysis for process control systems,'' in Proc. 16th ACM Conf. Comput. Commun. Secur. (CCS), 2009, pp. 1-13.
- C. M. Ahmed, V. R. Palleti, and A. P. Mathur, ''Wadi: A water distribution testbed for research in the design of secure cyber physical systems,'' in Proc. 3rd Int. Workshop Cyber-Phys. Syst. Smart Water Netw., 2017, pp. 25-28.
- K. M. Ting, ''Confusion matrix,'' in Encyclopedia Machine Learning, C. Sammut and G. I. Webb, Eds. Boston, MA: Springer, 2010, p. 209.
Cited by
Sorted by citations
Krishnaveni, S., Chen, T. M., Sathiyanarayanan, M., & Amutha, B. (2024) · Cluster Computing · doi:10.1007/s10586-024-04320-x · Cited by 44 · see citing works
Seo, J. K., Lee, J., Kim, B., Shim, W., & Seo, J. T. (2025) · Electronics · doi:10.3390/electronics15010020 · Cited by 15 · see citing works
- Authors
- Noorizadeh, M., Shakerpour, M., Meskin, N., Unal, D., & Khorasani, K.
- Affiliations
- Qatar University (QA)
- Concordia University (CA)
- Venue
- IEEE Access
- Published
- 2021
- Volume
- 9
- Pages
- 16239-16253
- ISSN
- 2169-3536 (ISSN-L)
- OpenAlex
- W3123953333
- Cited by
- 48
- References
- 42
- Citations by year
- 2026: 6 · 2025: 12 · 2024: 5 · 2023: 10 · 2022: 10 · 2021: 5
- FWCI
- 3.34
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Locations
- IEEE Access (publishedVersion, cc-by)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Qatar University QSpace (Qatar University) (submittedVersion)
- Funders
- Qatar National Research Fund (a member of the Qatar Foundation) through the National Priorities Research Program (10-0105-17017)
- North Atlantic Treaty Organization (NATO) through the Emerging Security Challenges Division Program
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Engineering › Control and Systems Engineering › Fault Detection and Control Systems
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- Tennessee Eastman process, real-time attack detection, false data injection attacks, man-in-the-middle attacks, Siemens PLC, critical infrastructure security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
