Towards Low-Barrier Cybersecurity Research and Education for Industrial Control Systems
Open accessAbstract
The protection of Industrial Control Systems (ICS) that are employed in public critical infrastructures is of utmost importance due to catastrophic physical damages cyberattacks may cause. The research community requires testbeds for validation and comparing various intrusion detection algorithms to protect ICS. However, there exist high barriers to entry for research and education in the ICS cybersecurity domain due to expensive hardware, software, and inherent dangers of manipulating real-world systems. To close the gap, built upon recently developed 3D high-fidelity simulators, we further showcase our integrated framework to automatically launch cyberattacks, collect data, train machine learning models, and evaluate for practical chemical and manufacturing processes. On our testbed, we validate our proposed intrusion detection model called Minimal Threshold and Window SVM (MinTWin SVM) that utilizes unsupervised machine learning via a one-class SVM in combination with a sliding window and classification threshold. Results show that MinTWin SVM minimizes false positives and is responsive to physical process anomalies. Furthermore, we incorporate our framework with ICS cybersecurity education by using our dataset in an undergraduate machine learning course where students gain hands-on experience in practicing machine learning theory with a practical ICS dataset. All of our implementations have been open-sourced.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Other sensor-correlation-based models make correlations explicit through graph structures, digital twins, energy-based physics features, or multi-instance representations.
“while others make correlations explicit through graph structures, digital twins, energy-based physics features, or multi-instance representations [94,96,99,101,104,106,107].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [104]
Cites
Liu, F. T., Ting, K. M., & Zhou, Z.-H. (2008) · 2008 Eighth IEEE International Conference on Data Mining · doi:10.1109/icdm.2008.17 · Cited by 6,601 · see citing works
Estimating the Support of a High-Dimensional Distribution
Schölkopf, B., Platt, J. C., Shawe-Taylor, J., Smola, A. J., & Williamson, R. C. (2001) · Neural Computation · doi:10.1162/089976601750264965 · Cited by 6,168 · see citing works
LOF: identifying density-based local outliers
Breunig, M. M., Kriegel, H.-P., Ng, R. T., & Sander, J. (2000) · Proceedings of the 2000 ACM SIGMOD international conference on Management of data · doi:10.1145/342009.335388 · Cited by 4,149 · see citing works
A Dataset to Support Research in the Design of Secure Water Treatment Systems
Goh, J., Adepu, S., Junejo, K. N., & Mathur, A. (2017) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-71368-7_8 · Cited by 729 · cited 1× · see citing works
“In recent years, physical testbeds have been made available such as SWaT [3] (water treatment system), WADI [8] (water distribution system), EPIC [9] (electric power system), etc.”
MethodAhmed, C. M., Palleti, V. R., & Mathur, A. P. (2017) · International Workshop on Cyber-Physical Systems for Smart Water Networks (CySWater) · doi:10.1145/3055366.3055375 · Cited by 574 · see citing works
Anomaly Detection in Cyber Physical Systems Using Recurrent Neural Networks
Goh, J., Adepu, S., Tan, M., & Lee, Z. S. (2017) · IEEE International Symposium on High Assurance Systems Engineering (HASE) · doi:10.1109/hase.2017.36 · Cited by 447 · see citing works
Lin, Q., Adepu, S., Verwer, S., & Mathur, A. P. (2018) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3196494.3196546 · Cited by 157 · see citing works
Self-citationModel predictive control of a continuous, nonlinear, two-phase reactor
Ricker, N. L. (1993) · Journal of Process Control · doi:10.1016/0959-1524(93)80006-w · Cited by 89 · see citing works
EPIC: An Electric Power Testbed for Research and Training in Cyber Physical Systems Security
Adepu, S., Kandasamy, N. K., & Mathur, A. P. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-12786-2_3 · Cited by 85 · see citing works
Detecting stealthy attacks against industrial control systems based on residual skewness analysis
Hu, Y., Li, H., Yang, H. T., Sun, Y., Sun, L., & Wang, Z. (2019) · EURASIP Journal on Wireless Communications and Networking · doi:10.1186/s13638-019-1389-1 · Cited by 39 · see citing works
Using Datasets from Industrial Control Systems for Cyber Security Research and Education
Lin, Q., Verwer, S., Kooij, R. E., & Mathur, A. P. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-37670-3_10 · Cited by 12 · see citing works
Self-citationPotluri, S., Diedrich, C., Roy Nanduru, S. R., & Vasamshetty, K. (2019) · 2019 IEEE 17th International Conference on Industrial Informatics (INDIN) · doi:10.1109/indin41052.2019.8972171 · Cited by 8 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Seo, J. K., Lee, J., Kim, B., Shim, W., & Seo, J. T. (2025) · Electronics · doi:10.3390/electronics15010020 · Cited by 15 · see citing works
- Authors
- McGuan, C., Yu, C., & Lin, Q.
- Affiliations
- Cleveland State University (US)
- Venue
- 2023 IEEE International Conference on Intelligence and Security Informatics (ISI)
- Publisher
- IEEE
- Published
- 2023-10-02
- Pages
- 1-6
- OpenAlex
- W4388115853
- Cited by
- 3
- References
- 12
- Citations by year
- 2025: 2 · 2024: 1
- FWCI
- 0.91
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- IEEE International Conference on Intelligence and Security Informatics (ISI) (publishedVersion)
- arXiv (Cornell University) (submittedVersion, cc-by-nc-nd)
- arXiv (Cornell University)
- Funders
- National Science Foundation (2028397,2301543)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Keywords
- industrial control systems, ICS cybersecurity, intrusion detection, testbed, one-class support vector machine, sliding window, false positive reduction, chemical process monitoring, manufacturing process monitoring, cybersecurity education, critical infrastructure protection, open source software framework
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
