Cyber-Attack Detection and Localization for SCADA system of CPSs
Abstract
Given their mission-critical nature, SCADA systems in Cyber-Physical Systems (CPS) are highly susceptible to cyber-attacks. While abnormal system states can be detected through analyzing streaming data, accurately identifying the precise location of these attacks remains challenging due to the compensatory mechanisms inherent in CPS. In industrial control, the development of high-performance controllers that require minimal data and incur low technical debt is especially appealing. Recently, foundation models have demonstrated their effectiveness in solving various problems with few or no demonstrations, leveraging the rich prior knowledge obtained through pre-training on Internet-scale datasets. Most of these models are based on the Transformer architecture, originally designed for natural language processing (NLP) tasks. However, Transformer-based models struggle to fully capture the spatial correlations embedded in industrial software systems. Previous approaches using Graph Convolution Networks (GCNs) have largely focused on learning static graph structures of CPSs, overlooking the potential variations in dynamic, short-term spatial correlations during the mechanical processes. This paper presents a novel approach to capturing hidden spatial-temporal correlations in large-scale industrial data, offering a fresh perspective on building industrial pre-trained foundation models. Specifically, we introduce a cyber-attack detection and localization framework that incorporates Multi-scale Graph Structure Learning (MGSL) within a multi-stream sequence reconstruction architecture. The approach combines Long Short-Term Memory (LSTM) for temporal information extraction with GCNs to capture spatial correlations across multiple scales, including long-term static and short-term dynamic relationships. Additionally, a self-learning mechanism is employed to facilitate the discovery of long-term static graph structures, while feature similarities are used to identify short-term dynamic structures. The proposed MGSL framework is validated using three publicly available real-world datasets: Secure Water Treatment (SWaT A4&A5) and the BATtle of Attack Detection Algorithm (BATADAL). Experimental results demonstrate the effectiveness of MGSL, outperforming state-of-the-art methods by successfully detecting cyber-attacks, pinpointing impacted areas, and analyzing the target points of detected attacks.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Correlation-based methods are particularly suitable for attacks and faults that selectively perturb a subset of variables while keeping other measurements within nominal ranges, and for scenarios where the key symptom is a collapse or distortion of inter-sensor correlation rather than a large deviation of a single signal.
“This makes them particularly suitable for attacks and faults that selectively perturb a subset of variables while keeping other measurements within nominal ranges, as well as for scenarios where the key symptom is a collapse or distortion of inter-sensor correlation rather than a large deviation of a single signal [94,96,99-101,106-108].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [94]
Other sensor-correlation-based models make correlations explicit through graph structures, digital twins, energy-based physics features, or multi-instance representations.
“while others make correlations explicit through graph structures, digital twins, energy-based physics features, or multi-instance representations [94,96,99,101,104,106,107].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [94]
The dataset distribution for sensor-correlation-based methods shows heavy evaluation on SWaT, WADI, GHL, HAI, TE, and power-system benchmarks (IEEE bus systems), with additional evidence from gas-pipeline, GRFICSv2/Factory I/O, and aNormalies-based testbeds.
“Finally, the dataset distribution indicates that sensor-correlation-based methods are heavily evaluated on SWaT, WADI, GHL, HAI, TE, and power-system benchmarks (IEEE bus systems), with additional evidence from gas-pipeline, GRFICSv2/Factory I/O, and aNormalies-based testbeds [88-96,98-102,104-110].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [94]
Cites
Liu, F. T., Ting, K. M., & Zhou, Z.-H. (2008) · 2008 Eighth IEEE International Conference on Data Mining · doi:10.1109/icdm.2008.17 · Cited by 6,601 · see citing works
Estimating the Support of a High-Dimensional Distribution
Schölkopf, B., Platt, J. C., Shawe-Taylor, J., Smola, A. J., & Williamson, R. C. (2001) · Neural Computation · doi:10.1162/089976601750264965 · Cited by 6,168 · see citing works
Graph Neural Network-Based Anomaly Detection in Multivariate Time Series
Deng, A., & Hooi, B. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i5.16523 · Cited by 1,413 · see citing works
MAD-GAN: Multivariate Anomaly Detection for Time Series Data with Generative Adversarial Networks
Li, D., Chen, D., Jin, B., Shi, L., Goh, J., & Ng, S.-K. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-30490-4_56 · Cited by 1,323 · see citing works
Self-citationCyber-Physical Systems Security—A Survey
Humayed, A., Lin, J., Li, F., & Luo, B. (2017) · IEEE Internet of Things Journal · doi:10.1109/jiot.2017.2703172 · Cited by 1,185 · see citing works
USAD: UnSupervised Anomaly Detection on Multivariate Time Series
Audibert, J., Michiardi, P., Guyard, F., Marti, S., & Zuluaga, M. A. (2020) · Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining · doi:10.1145/3394486.3403392 · Cited by 1,094 · see citing works
SWaT: a water treatment testbed for research and training on ICS security
Mathur, A. P., & Tippenhauer, N. O. (2016) · International Workshop on Cyber-Physical Systems for Smart Water Networks (CySWater) · doi:10.1109/cyswater.2016.7469060 · Cited by 974 · see citing works
Multivariate Time-Series Anomaly Detection via Graph Attention Network
Zhao, H., Wang, Y., Duan, J., Huang, C., Cao, D., Tong, Y., Xu, B., Bai, J., Tong, J., & Zhang, Q. (2020) · Proceedings · doi:10.1109/icdm50108.2020.00093 · Cited by 850 · see citing works
Learning Graph Structures With Transformer for Multivariate Time-Series Anomaly Detection in IoT
Chen, Z., Chen, D., Zhang, X., Yuan, Z., & Cheng, X. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3100509 · Cited by 613 · see citing works
Deep Isolation Forest for Anomaly Detection
Xu, H., Pang, G., Wang, Y., & Wang, Y. (2023) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2023.3270293 · Cited by 603 · see citing works
A Survey of Cyber Attacks on Cyber Physical Systems: Recent Advances and Challenges
Duo, W., Zhou, M., & Abusorrah, A. M. (2022) · IEEE/CAA Journal of Automatica Sinica · doi:10.1109/jas.2022.105548 · Cited by 599 · see citing works
Jin, M., Koh, H. Y., Wen, Q., Zambon, D., Alippi, C., Webb, G. I., King, I., & Pan, S. (2024) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2024.3443141 · Cited by 567 · see citing works
Anomaly Detection Based on Convolutional Recurrent Autoencoder for IoT Time Series
Yin, C., Zhang, S., Wang, J., & Xiong, N. N. (2020) · IEEE Transactions on Systems Man and Cybernetics Systems · doi:10.1109/tsmc.2020.2968516 · Cited by 417 · see citing works
A graph CNN-LSTM neural network for short and long-term traffic forecasting based on trajectory data
Bogaerts, T., Masegosa, A. D., Angarita-Zapata, J. S., Onieva, E., & Hellinckx, P. (2020) · Transportation Research Part C Emerging Technologies · doi:10.1016/j.trc.2020.01.010 · Cited by 373 · see citing works
A Review of Local Outlier Factor Algorithms for Outlier Detection in Big Data Streams
Alghushairy, O., Alsini, R. A. I., Soule, T., & Ma, X. (2020) · Big Data and Cognitive Computing · doi:10.3390/bdcc5010001 · Cited by 349 · see citing works
Heterogeneous Graph Structure Learning for Graph Neural Networks
Zhao, J., Wang, X., Shi, C., Hu, B., Song, G., & Ye, Y. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i5.16600 · Cited by 297 · see citing works
An Evaluation of Anomaly Detection and Diagnosis in Multivariate Time Series
Garg, A., Zhang, W., Samaran, J., Ramasamy, S., & Foo, C.-S. (2021) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2021.3105827 · Cited by 293 · see citing works
Battle of the Attack Detection Algorithms: Disclosing Cyber Attacks on Water Distribution Networks
Taormina, R., Galelli, S., Tippenhauer, N. O., Salomons, E., Ostfeld, A., Eliades, D. G., Aghashahi, M., Sundararajan, R., Pourahmadi, M., Banks, M. K., et al. (2018) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0000969 · Cited by 277 · see citing works
Architecture and security of SCADA systems: A review
Yadav, G., & Paul, K. (2021) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2021.100433 · Cited by 261 · see citing works
Temporal Convolutional Networks for Anomaly Detection in Time Series
He, Y., & Zhao, J. (2019) · Journal of Physics Conference Series · doi:10.1088/1742-6596/1213/4/042050 · Cited by 228 · see citing works
Li, D., Hu, G., & Spanos, C. J. (2016) · Energy and Buildings · doi:10.1016/j.enbuild.2016.07.014 · Cited by 164 · see citing works
Self-citationCalibrated One-Class Classification for Unsupervised Time Series Anomaly Detection
Xu, H., Wang, Y., Jian, S., Liao, Q., Wang, Y., & Pang, G. (2024) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2024.3393996 · Cited by 164 · see citing works
HML-IDS: A Hybrid-Multilevel Anomaly Prediction Approach for Intrusion Detection in SCADA Systems
Khan, I. A., Pi, D., Khan, Z. U., Hussain, Y., & Nawaz, A. (2019) · IEEE Access · doi:10.1109/access.2019.2925838 · Cited by 156 · see citing works
Babayiğit, B., & Abubaker, M. (2023) · IEEE Systems Journal · doi:10.1109/jsyst.2023.3270620 · Cited by 150 · see citing works
Dynamic graph structure learning for multivariate time series forecasting
Li, Z., Zhang, G. W., Yu, J., et al. (2023) · Pattern Recognition · doi:10.1016/j.patcog.2023.109423 · Cited by 147 · see citing works
A Dual-Isolation-Forests-Based Attack Detection Framework for Industrial Control Systems
Elnour, M., Meskin, N., Khan, K. M., & Jain, R. K. (2020) · IEEE Access · doi:10.1109/access.2020.2975066 · Cited by 117 · see citing works
Correlation-Aware Spatial–Temporal Graph Learning for Multivariate Time-Series Anomaly Detection
Zheng, Y., Koh, H. Y., Jin, M., Chi, L., Phan, K. T., Pan, S., Chen, Y. P., & Xiang, W. (2023) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2023.3325667 · Cited by 116 · see citing works
Ahmed, C. M., Zhou, J., & Mathur, A. P. (2018) · Annual Computer Security Applications Conference · doi:10.1145/3274694.3274748 · Cited by 104 · see citing works
Miele, E. S., Bonacina, F., & Corsini, A. (2022) · Energy and AI · doi:10.1016/j.egyai.2022.100145 · Cited by 102 · see citing works
Fault detection and diagnosis for building cooling system with a tree-structured learning method
Li, D., Zhou, Y., Hu, G., et al. (2016) · Energy and Buildings · doi:10.1016/j.enbuild.2016.06.017 · Cited by 97 · see citing works
Self-citationMADICS: A Methodology for Anomaly Detection in Industrial Control Systems
Gómez, Á. L. P., Maimó, L. F., Celdrán, A. H., & Clemente, F. J. G. (2020) · Symmetry · doi:10.3390/sym12101583 · Cited by 76 · see citing works
Hybrid Anomaly Detection via Multihead Dynamic Graph Attention Networks for Multivariate Time Series
Zhou, L., Zeng, Q., & Li, B. (2022) · IEEE Access · doi:10.1109/access.2022.3167640 · Cited by 56 · see citing works
Monitoring industrial control systems via spatio-temporal graph neural networks
Wang, Y., Peng, H., Wang, G., Tang, X., Wang, X., & Liu, C. (2023) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2023.106144 · Cited by 38 · see citing works
Jing-yu, Y., & Yue, Z. (2022) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2022.3216006 · Cited by 37 · see citing works
Adversarial Autoencoder for Unsupervised Time Series Anomaly Detection and Interpretation
Chen, X., Deng, L., Zhao, Y., & Zheng, K. (2023) · Proceedings of the Sixteenth ACM International Conference on Web Search and Data Mining · doi:10.1145/3539597.3570371 · Cited by 36 · see citing works
MAD-SGCN: Multivariate Anomaly Detection with Self-learning Graph Convolutional Networks
Qi, P., Li, D., & Ng, S.-K. (2022) · IEEE International Conference on Data Engineering (ICDE) · doi:10.1109/icde53745.2022.00097 · Cited by 32 · see citing works
Self-citation(2015) · Elsevier eBooks · doi:10.1016/c2013-0-06836-3 · Cited by 18 · see citing works
A Collaborative DNN-Based Low-Latency IDPS for Mission-Critical Smart Factory Networks
Illy, P., & Kaddoum, G. (2023) · IEEE Access · doi:10.1109/access.2023.3311822 · Cited by 17 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Seo, J. K., Lee, J., Kim, B., Shim, W., & Seo, J. T. (2025) · Electronics · doi:10.3390/electronics15010020 · Cited by 15 · see citing works
- Authors
- Li, D., Tang, J., Wu, S., Zheng, Z., & Ng, S.-K.
- Affiliations
- Sun Yat-sen University (CN)
- National University of Singapore (SG)
- Venue
- 2025 IEEE/ACM Second International Conference on AI Foundation Models and Software Engineering (Forge)
- Publisher
- IEEE
- Published
- 2025-04-27
- Pages
- 269-279
- OpenAlex
- W4411950578
- Cited by
- 1
- References
- 38
- Citations by year
- 2025: 1
- FWCI
- 2.18
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- IEEE/ACM International Conference on AI Foundation Models and Software Engineering (FORGE) (publishedVersion)
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Keywords
- cyberattack detection, attack localization, SCADA systems, cyber-physical systems, industrial control systems, graph convolutional networks, LSTM, spatio-temporal correlation, SWaT dataset
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
