The DOI matches its Crossref record; 41 of the 43 references it cites were found in a registry or an index.
A Real-Time Anomaly Detection Method for Industrial Control Systems Based on Long-Short Period Deterministic Finite Automaton
Abstract
Anomaly detection has proven effective in detecting cyber-attacks in industrial control systems (ICS). However, most existing anomaly detection methods suffer from low accuracy because they ignore the effects of packet loss and network delay on time features, the sequential nature of transition time, masquerade transitions, and system recovery. Meanwhile, current cyber-physical model (CPM) construction methods struggle to effectively address the state explosion problem and properly balance the removal and retention of low frequency states (LFS). In this article, we propose a novel baseline model for ICS to detect anomalies through learning device-level polling time patterns and system-level CPM. The polling time pattern learning method reduces the effects of packet loss and network delay on time features by extracting only matching packets and replacing outliers. The CPM construction method mitigates state explosion through mixed-event discretization, reduces the effects of network delay on transition/action times through outlier replacement, and captures the sequential nature of transition times with circular permutation sets (CPSets). CPM model optimization uses a post-pruning algorithm to balance the removal and retention of LFSs, and a CPM periodicity detection method that mitigates the effects of network delay to ensure that all industrial process periods are detected. A real-time anomaly detection method with a two-layer defence mechanism is proposed using the baseline model. Experimental results from two lab-scale ICSs with six process-related attacks confirm the effectiveness and superiority of the proposed method. It achieves average F1 scores of 98.81% and accuracy of 99.24%, outperforming the state-of-the-art work by 18.51% and 13.96%, respectively.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“By jointly analyzing polling period and response-time patterns at the network layer together with state-transition sequences at the physical layer on a common time axis, the method detects cyber-physical inconsistencies such as communication delays, packet loss, and command manipulation that disrupt the causal relationship between cyber events and process behavior.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [123]
In the citing paper
“The key contribution is the implementation of a multi-domain model that jointly learns cyber-layer behaviors (communication events, packet polling periods) and physical-layer dynamics (process variables, sensor and actuator values), going beyond conventional single-domain (sensor-centric) approaches.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [123]
In the citing paper
“Using data collected from in-house traffic control and conveyor system testbeds, Lin et al. [123] proposed a Long-Short Period Deterministic Finite Automaton (LSP-DFA)-based cyber-physical integrated anomaly detection scheme.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [123]
In the citing paper
“Specifically, ICS communication logs (Industrial Control Packets, ICP) are generated from controller-specific request/response packets and time-synchronized with register-based sensor and control variables, forming system-level ICP logs.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [123]
In the citing paper
“First, many approaches explicitly synchronize cyber-layer events with physical-layer behavior on a common time axis to detect cyber-physical inconsistencies that single-domain detectors would miss [122-129].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [123]
Citations
Cites
Thorndike, R. L. (1953) · Psychometrika · doi:10.1007/bf02289263 · Cited by 2,264
Testing Statistical Hypotheses
Lehmann, E. L. (1986) · Springer texts in statistics · doi:10.1007/978-1-4757-1923-9 · Cited by 1,904
Pukelsheim, F. (1994) · The American Statistician · doi:10.1080/00031305.1994.10476030 · Cited by 1,280
Sulla determinazione empirica di una legge di distribuzione
Kolmogorov, A. (1933) · Medical Entomology and Zoology · Cited by 1,247
On Convergence Properties of the EM Algorithm for Gaussian Mixtures
Xu, L., & Jordan, M. I. (1996) · Neural Computation · doi:10.1162/neco.1996.8.1.129 · Cited by 763
Deep learning-enabled anomaly detection for IoT systems
Abusitta, A., de Carvalho, G. H. S., Wahab, O. A., Halabi, T., Fung, B. C. M., & Mamoori, S. A. (2023) · Internet of Things · doi:10.1016/j.iot.2022.100656 · Cited by 184
Process Mining for Clinical Processes
Partington, A., Wynn, M. T., Suriadi, S., Ouyang, C., & Karnon, J. D. (2015) · ACM Transactions on Management Information Systems · doi:10.1145/2629446 · Cited by 179
A Review of Anomaly Detection Strategies to Detect Threats to Cyber-Physical Systems
Jeffrey, N., Tan, Q., & Villar, J. R. (2023) · Electronics · doi:10.3390/electronics12153283 · Cited by 160
Precision and Recall for Time SeriesPreprint
Tatbul, N., Lee, T. J., Zdonik, S., Alam, M., & Gottschlich, J. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1803.03639 · Cited by 150
Anomaly detection of industrial control systems based on transfer learning
Wang, W., Wang, Z., Zhou, Z., Deng, H., Zhao, W., Wang, C., & Guo, Y. (2021) · Tsinghua Science & Technology · doi:10.26599/tst.2020.9010041 · Cited by 139
Mejri, N., Lopez-Fuentes, L., Roy, K., Chernakov, P., Ghorbel, E., & Aouada, D. (2024) · Expert Systems with Applications · doi:10.1016/j.eswa.2024.124922 · Cited by 115
Nankya, M., Chataut, R., & Akl, R. (2023) · Sensors · doi:10.3390/s23218840 · Cited by 114
Anomaly detection for industrial control systems using process mining
Myers, D., Suriadi, S., Radke, K., & Foo, E. (2018) · Computers & Security · doi:10.1016/j.cose.2018.06.002 · Cited by 110
S., P., Krithivasan, K., S., P., & Sriram V.S., S. (2020) · IEEE Transactions on Industry Applications · doi:10.1109/tia.2020.2977872 · Cited by 88
Industrial Control System Anomaly Detection and Classification Based on Network Traffic
Jiang, J., & Chen, Y.-T. (2022) · IEEE Access · doi:10.1109/access.2022.3167814 · Cited by 69
Control systems/SCADA forensics, what's the difference?
van der Knijff, R. M. (2014) · Digital Investigation · doi:10.1016/j.diin.2014.06.007 · Cited by 57
A cyber-physical model for SCADA system and its intrusion detection
Sheng, C., Yao, Y. K., Fu, Q., & Yang, W. (2020) · Computer Networks · doi:10.1016/j.comnet.2020.107677 · Cited by 53
Self-citationHuang, D., Shi, X., & Zhang, W. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3007155 · Cited by 50
Self-citationExploiting traffic periodicity in industrial control networks
Barbosa, R. R. R., Sadre, R., & Pras, A. (2016) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2016.02.004 · Cited by 44
Gao, Y., Yin, X., He, Z., & Wang, X. (2022) · Computers & Industrial Engineering · doi:10.1016/j.cie.2022.108936 · Cited by 44
A hybrid behavior- and Bayesian network-based framework for cyber–physical anomaly detection
Faramondi, L., Flammini, F., Guarino, S., & Setola, R. (2023) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2023.108988 · Cited by 39
Graph Attention Network and Informer for Multivariate Time Series Anomaly Detection
Zhao, M., Peng, H., Li, L., & Ren, Y. (2024) · Sensors · doi:10.3390/s24051522 · Cited by 37
Correlation-Based Anomaly Detection in Industrial Control Systems
Jadidi, Z., Pal, S., Hussain, M., & Nguyen Thanh, K. (2023) · Sensors · doi:10.3390/s23031561 · Cited by 35
Akpinar, K. O., & Özçelik, İ. (2020) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2020.3037050 · Cited by 34
Flow based monitoring of ICS communication in the smart grid
Matoušek, P., Ryšavý, O., Grégr, M., & Havlena, V. (2020) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2020.102535 · Cited by 32
Cloud-edge coordinated traffic anomaly detection for industrial cyber-physical systems
Yang, T., Hao, W., Wang, W., & Wang, W. (2023) · Expert Systems with Applications · doi:10.1016/j.eswa.2023.120668 · Cited by 28
Process Discovery for Industrial Control System Cyber Attack Detection
Myers, D. B., Radke, K., Suriadi, S., & Foo, E. (2017) · IFIP advances in information and communication technology · doi:10.1007/978-3-319-58469-0_5 · Cited by 26
Temporal pattern-based malicious activity detection in SCADA systems
Shlomo, A., Kalech, M., & Moskovitch, R. (2020) · Computers & Security · doi:10.1016/j.cose.2020.102153 · Cited by 23
Process-Oriented heterogeneous graph learning in GNN-Based ICS anomalous pattern recognition
Lu, S., Wang, K., Zhang, L., & Wang, B. (2023) · Pattern Recognition · doi:10.1016/j.patcog.2023.109661 · Cited by 23
Saci, A., Al‐Dweik, A., & Shami, A. A. (2021) · IEEE Sensors Journal · doi:10.1109/jsen.2021.3053039 · Cited by 21
A comparative evaluation of novelty detection algorithms for discrete sequences
Domingues, R., Michiardi, P., Barlet, J., & Filippone, M. (2019) · Artificial Intelligence Review · doi:10.1007/s10462-019-09779-4 · Cited by 20
FlowSummary: Summarizing Network Flows for Communication Periodicity Detection
Hubballi, N., & Goyal, D. (2013) · Lecture notes in computer science · doi:10.1007/978-3-642-45062-4_98 · Cited by 14
Bhattacharya, C., & Ray, A. (2021) · Mechanical Systems and Signal Processing · doi:10.1016/j.ymssp.2021.108213 · Cited by 14
Anomaly Detection in Cyclic Communication in OT Protocols
Smolarczyk, M., Plamowski, S., Pawluk, J., & Szczypiorski, K. (2022) · Energies · doi:10.3390/en15041517 · Cited by 13
Time dependent anomaly detection system for smart environment using probabilistic timed automaton
Venkatraman, S., Muthusamy, P., Balusa, B. C., Jayasankar, T., Kavithaa, G., Sekar, K. R., & Bharatiraja, C. (2021) · Journal of Ambient Intelligence and Humanized Computing · doi:10.1007/s12652-020-02769-3 · Cited by 8
RRCNN: Request Response-Based Convolutional Neural Network for ICS Network Traffic Anomaly Detection
Du, Y., Zhang, S., Wan, G., Zhou, D., Lu, J., Huang, Y., Cheng, X., Zhang, Y., & He, P. (2023) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2023.035919 · Cited by 8
Lin, X., Yao, Y., Hu, B., Yang, W., Zhou, X., & Zhang, W. (2024) · Sustainable Energy Grids and Networks · doi:10.1016/j.segan.2024.101325 · Cited by 6
Self-citationSeqCP: A sequence-based algorithm for searching circularly permuted proteins
Chen, C., Huang, Y., Huang, H., Lo, W., & Lyu, P. C. (2022) · Computational and Structural Biotechnology Journal · doi:10.1016/j.csbj.2022.11.024 · Cited by 5
Rethinking the Operation Pattern for Anomaly Detection in Industrial Cyber–Physical Systems
Cheng, Z., Cui, B., & Fu, J. (2023) · Applied Sciences · doi:10.3390/app13053244 · Cited by 3
Wan, M., Hao, M., Li, J., Yao, J., & Song, Y. (2023) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2023.044857 · Cited by 2
Network Anomaly Detection with Stacked Sparse Shrink Autoencoders and Improved XGBoost
Bi, J., Guan, Z., Yuan, H., & Zhang, J. (2023) · Conference proceedings/Conference proceedings - IEEE International Conference on Systems, Man, and Cybernetics · doi:10.1109/smc53992.2023.10394120 · Cited by 2
Research works printed but not linked: 6
- Daneels, What is SCADA?, 1
- Buchanan, 2022, Cyber-Attacks to Industrial Control Systems Since Stuxnet: A Systematic Review
- Delurgio, 1998, Forecasting Principles and Applications
- 10.1109/ICPS48405.2020.9274780 · DOI
- 2024, Modbus penetration testing framework
- 2024, Omronfins dos
Cited by
Sorted by citations
Seo, J. K., Lee, J., Kim, B., Shim, W., & Seo, J. T. (2025) · Electronics · doi:10.3390/electronics15010020 · Cited by 15
Anomaly detection system for Modbus data based on an open source tool
Suchorab, J., Plamowski, S., & Ławryńczuk, M. (2025) · Computers & Security · doi:10.1016/j.cose.2025.104572 · Cited by 5
Yue, Q., Tian, L., Feng, X., Yuan, Z., Wei, S., Xia, J., Chen, B., Song, X., Yao, Y., & Liu, Y. (2026) · Journal of King Saud University - Computer and Information Sciences · doi:10.1007/s44443-026-00690-x · Cited by 1
Self-citationDu, X., Zhou, C., Tian, Y., & Xie, J. (2025) · International Journal of Machine Learning and Cybernetics · doi:10.1007/s13042-025-02700-2
SeqTrident: An Integrated Sequence-Based Web Abnormal Detection System for Enterprises
Fan, H. B., Peng, Y.-H., Wu, Y., Wan, H., & Zhao, X. (2025) · International Conference on Artificial Intelligence, Automation and High Performance Computing (AIAHPC) · doi:10.1109/aiahpc66801.2025.11290597
Metadata
- Authors
- Lin, X., Yao, Y., Hu, B., Yang, W., Zhou, X., Li, G., & Zhang, W.
- Affiliations
- Northeastern University (US)
- State Grid Liaoning Electric Power Company (China) (CN)
- Venue
- IEEE Internet of Things Journal
- Published
- 2025-05
- Volume
- 12
- Issue
- 10
- Pages
- 14599-14621
- ISSN
- 2327-4662 (ISSN-L)
- OpenAlex
- W4406890631
- Cited by
- 9
- References
- 43
- Citations by year
- 2026: 5 · 2025: 4
- FWCI
- 3.80
- Type
- journal article
- Language
- en
- Open access
- closed
- Licence
- Locations
- IEEE Internet of Things Journal (publishedVersion)
- Funders
- Technology Project Funding from the State Grid Corporation of China (5700-202228452A-2-0-ZN)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Artificial Intelligence › Artificial Immune Systems Applications
- Keywords
- anomaly detection, industrial control systems, cyberattack detection, state space explosion, periodicity detection, real-time detection, masquerade attacks
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
