Explainable Anomaly Detection Based on Operational Sequences in Industrial Control Systems
Open accessAbstract
Traditionally, industrial control systems (ICS) are closed structures that rely on specialized hardware and software with proprietary control protocols. However, with the advancement of technology and the digitalization of ICS, the attack space available to malicious actors has significantly expanded. Anomaly detection systems, initially implemented for detecting device faults or failures, have increasingly become the focus of research aimed at identifying attack patterns as cyberattack techniques become more sophisticated and intelligent. Many anomaly detection algorithms based on deep learning models have good performance but often involve complex neural network structures, creating a black-box issue where users cannot interpret the decisions made by the models. The black-box issue hinders the adoption of artificial intelligence (AI) systems that can ensure efficient and secure operation in ICS environments. Various attempts have been made to address the black box issue but limited to identifying the features that caused the anomaly. In detecting target anomalies in industrial control system operational data, it is important not only to identify feature importance, but also to consider correlations between variables, and to provide intuitive explanations to enhance the understanding of operators. To satisfy these major values, this paper proposes a method for explainable anomaly detection for ICS.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Some sensor-correlation-based models learn temporal correlations and cross-sensor dependencies implicitly using deep RNNs, LSTMs, attention mechanisms, or Transformers applied to multivariate sequences.
“Some models learn temporal correlations and cross-sensor dependencies implicitly using deep RNNs, LSTMs, attention mechanisms, or Transformers applied to multivariate sequences [88,90,93,98,108,110], while others make correlations explicit through graph structures, digital twins, energy-based physics features, or multi-instance representations [94,96,99,101,104,106,107].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [98]
The strong reliance on learned correlation profiles implies that significant operating-mode changes, reconfigurations, or sensor upgrades can cause correlation shifts that resemble attacks, requiring adaptive learning, mode-aware modeling, and careful thresholding to avoid false alarms.
“At the same time, the strong reliance on learned correlation profiles implies that significant operating-mode changes, reconfigurations, or sensor upgrades can cause correlation shifts that resemble attacks, requiring adaptive learning, mode-aware modeling, and careful thresholding to avoid false alarms [91,96,98].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [98]
The dataset distribution for sensor-correlation-based methods shows heavy evaluation on SWaT, WADI, GHL, HAI, TE, and power-system benchmarks (IEEE bus systems), with additional evidence from gas-pipeline, GRFICSv2/Factory I/O, and aNormalies-based testbeds.
“Finally, the dataset distribution indicates that sensor-correlation-based methods are heavily evaluated on SWaT, WADI, GHL, HAI, TE, and power-system benchmarks (IEEE bus systems), with additional evidence from gas-pipeline, GRFICSv2/Factory I/O, and aNormalies-based testbeds [88-96,98-102,104-110].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [98]
Cites
Machlev, R., Heistrene, L., Perl, M., Levy, K. Y., Belikov, J., Mannor, S., & Levron, Y. (2022) · Energy and AI · doi:10.1016/j.egyai.2022.100169 · Cited by 552 · see citing works
Li, Z., Zhao, Y., Han, J., Su, Y., Jiao, R., Wen, X., & Pei, D. (2021) · Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining · doi:10.1145/3447548.3467075 · Cited by 464 · see citing works
Practical Approach to Asynchronous Multivariate Time Series Anomaly Detection and Localization
Abdulaal, A., Liu, Z., & Lancewicki, T. (2021) · Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining · doi:10.1145/3447548.3467174 · Cited by 423 · see citing works
Time series shapelets: a novel technique that allows accurate, interpretable and fast classification
Ye, L., & Keogh, E. (2011) · Data Mining and Knowledge Discovery · doi:10.1007/s10618-010-0179-5 · Cited by 406 · see citing works
DARPA 's explainable AI ( XAI ) program: A retrospective
Gunning, D., Vorm, E. S., Wang, Y., & Turek, M. (2021) · Applied AI Letters · doi:10.1002/ail2.61 · Cited by 262 · see citing works
Zheng, X., & Yang, X. (2019) · IEEE Transactions on Automatic Control · doi:10.1109/tac.2019.2929067 · Cited by 217 · see citing works
Kang, H., & Kang, P. (2024) · Knowledge-Based Systems · doi:10.1016/j.knosys.2024.111507 · Cited by 174 · see citing works
ShapeNet: A Shapelet-Neural Network Approach for Multivariate Time Series Classification
Li, G., Choi, B., Xu, J., S Bhowmick, S., Chun, K.-P., & Wong, G. L.-H. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i9.17018 · Cited by 169 · see citing works
Federated Learning-Based Explainable Anomaly Detection for Industrial Control Systems
Hương, T. T., Bac, T. P., Ha, K. N., Việt, N. H., Hoang, N. X., Hung, N. T., & Tran, K. P. (2022) · IEEE Access · doi:10.1109/access.2022.3173288 · Cited by 126 · see citing works
Multivariate Abnormal Detection for Industrial Control Systems Using 1D CNN and GRU
Xie, X., Wang, B., Wan, T., & Tang, W. (2020) · IEEE Access · doi:10.1109/access.2020.2993335 · Cited by 91 · see citing works
E-SFD: Explainable Sensor Fault Detection in the ICS Anomaly Detection System
Hwang, C., & Lee, T. (2021) · IEEE Access · doi:10.1109/access.2021.3119573 · Cited by 62 · see citing works
DARPA’s Explainable AI (XAI) program: A retrospective
Gunning, D., Vorm, E., Wang, Y., & Turek, M. (2021) · doi:10.22541/au.163699841.19031727/v1 · Cited by 60 · see citing works
An explainable multi-modal model for advanced cyber-attack detection in industrial control systems
Bahadoripour, S., Karimipour, H., Jahromi, A. N., & Islam, A. (2024) · Internet of Things · doi:10.1016/j.iot.2024.101092 · Cited by 59 · see citing works
Vávra, J., Hromada, M., Lukáš, L., & Dworzecki, J. (2021) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2021.100446 · Cited by 50 · see citing works
Anomaly Detection for Industrial Control Systems Using K-Means and Convolutional Autoencoder
Chang, C.-P., Hsu, W.-C., & Liao, I. (2019) · International Conference on Software, Telecommunications and Computer Networks (SoftCOM) · doi:10.23919/softcom.2019.8903886 · Cited by 47 · see citing works
Monitoring industrial control systems via spatio-temporal graph neural networks
Wang, Y., Peng, H., Wang, G., Tang, X., Wang, X., & Liu, C. (2023) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2023.106144 · Cited by 38 · see citing works
ICS anomaly detection based on sensor patterns and actuator rules in spatiotemporal dependency
Cai, J., Wei, Z., & Luo, J. (2024) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2024.3393528 · Cited by 38 · see citing works
Applying of Generative Adversarial Networks for Anomaly Detection in Industrial Control Systems
Alabugin, S. K., & Sokolov, A. N. (2020) · Global Smart Industry Conference (GloSIC) · doi:10.1109/glosic50886.2020.9267878 · Cited by 33 · see citing works
Process-Oriented heterogeneous graph learning in GNN-Based ICS anomalous pattern recognition
Lu, S., Wang, K., Zhang, L., & Wang, B. (2023) · Pattern Recognition · doi:10.1016/j.patcog.2023.109661 · Cited by 23 · see citing works
Anomaly Detection and Analysis in Nuclear Power Plants
Chaudhary, A., Han, J., Kim, S. K., Kim, A., & Choi, S. (2024) · Electronics · doi:10.3390/electronics13224428 · Cited by 18 · see citing works
Machine Learning Methods for Anomaly Detection in Industrial Control Systems
Tai, J., Alsmadi, I. M., Zhang, Y., & Qiao, F. (2020) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata50022.2020.9378018 · Cited by 10 · see citing works
Shapelet-Based Sensor Fault Detection and Human-Centered Explanations in Industrial Control System
Lim, S., Kim, J., & Lee, T. (2023) · IEEE Access · doi:10.1109/access.2023.3339500 · Cited by 7 · see citing works
Self-citationWaXAI: Explainable Anomaly Detection in Industrial Control Systems and Water Systems
Mathuros, K., Venugopalan, S., & Adepu, S. (2024) · ACM Workshop on Cyber-Physical System Security (CPSS) · doi:10.1145/3626205.3659147 · Cited by 7 · see citing works
AR-Pro: Counterfactual Explanations for Anomaly Repair with Formal Properties
Ji, X., Xue, A., Wong, E., Sokolsky, O. V., & Lee, I. (2024) · neural information processing systems · doi:10.52202/079017-0514 · Cited by 6 · see citing works
Liu, Q., Chen, W., & Dinavahi, V. (2023) · IEEE Transactions on Instrumentation and Measurement · doi:10.1109/tim.2023.3336447 · Cited by 5 · see citing works
Amer, E., Al‐rimy, B. A. S., El–Sappagh, S., Almalki, S. A., & Alghamdi, T. A. (2024) · International Mobile, Intelligent, and Ubiquitous Computing Conference (MIUCC) · doi:10.1109/miucc62295.2024.10783503 · Cited by 5 · see citing works
Abnormal Detection for Industrial Control Systems Using Ensemble Recurrent Neural Networks Model
Kim, H., & Kim, Y. (2021) · Information Security and Cryptology · doi:10.13089/jkiisc.2021.31.3.401 · Cited by 2 · see citing works
A Deep Learning Approach for Anomaly Detection for Industrial Control Systems
Giracca, D. M., Pires, F. L., Barán, B., & Jara, E. A. M. (2024) · Latin American Computer Conference (CLEI) · doi:10.1109/clei64178.2024.10700451 · Cited by 1 · see citing works
Pairwise Anomaly Detection for Industrial Control Systems
Birihanu, E., Asroubi, S., & Lendák, I. (2024) · IEEE International Symposium on Intelligent Systems and Informatics (SISY) · doi:10.1109/sisy62279.2024.10737508 · Cited by 1 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Seo, J. K., Lee, J., Kim, B., Shim, W., & Seo, J. T. (2025) · Electronics · doi:10.3390/electronics15010020 · Cited by 15 · see citing works
Athooyaa, M., Prabantara, S. K., Hidayat, D. A., Shaikh, S. S., & Arfriandi, A. (2025) · Jurnal Riset Informatika dan Teknologi Informasi · doi:10.58776/jriti.v3i2.232
Li, Z., Sun, L., Ma, J., Huo, Y., & Xu, Y. (2026) · International Journal of Pattern Recognition and Artificial Intelligence · doi:10.1142/s0218001426590019
SoK: Hospital Medical Devices as Industrial Control Systems (ICS) - Exposure and Vulnerability
Bailey, J. M., Yurcik, W. J., Saydjari, O. S., Avelino, R. D. S., Vieira, J. L., Umbelino, P., & Pluta, G. (2025) · Annual Computer Security Applications Conference Workshops (ACSAC Workshops) · doi:10.1109/acsacw69556.2025.00018
Delibaşoğlu, İ., Chakraborty, S., Heintz, F., Brodin, F. W., & Darnell, A. (2026) · Journal of Intelligent Manufacturing · doi:10.1007/s10845-026-02836-0
Alsubai, S., Almadhor, A. S., & Hejaili, A. A. (2026) · Concurrency and Computation Practice and Experience · doi:10.1002/cpe.70854
Al-Hija’a, A. A., Szekeres, B. J., & Andó, M. (2026) · The International Journal of Advanced Manufacturing Technology · doi:10.1007/s00170-026-18904-x
Jha, A. C., & Kushwaha, D. (2026) · International Conference on Computational Intelligence Systems and Devices (ICCISD) · doi:10.1109/iccisd69924.2026.11731918
- Authors
- Kim, K.-K., Kim, J.-S., & Euom, I.-C.
- Affiliations
- Chonnam National University (KR)
- Venue
- IEEE Access
- Published
- 2025
- Volume
- 13
- Pages
- 66170-66187
- ISSN
- 2169-3536 (ISSN-L)
- OpenAlex
- W4409426358
- Cited by
- 7
- References
- 28
- Citations by year
- 2026: 5 · 2025: 2
- FWCI
- 2.96
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Locations
- IEEE Access (publishedVersion, cc-by)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Funders
- Institute for Information and Communications Technology Promotion (2025-RS-2022-00156287)
- Nuclear Safety and Security Commission (2106061)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Control and Systems Engineering › Fault Detection and Control Systems
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Keywords
- explainable anomaly detection, industrial control systems, operation sequence, cyberattack detection, black box problem, feature importance, variable correlation, interpretability, deep learning, ICS security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
