Anomaly Detection based on Robust Spatial-temporal Modeling for Industrial Control Systems
Abstract
Industrial Control Systems (ICS) are increasingly facing the threat of False Data Injection (FDI) attacks. As an emerging intrusion detection scheme for ICS, process-based Intrusion Detection Systems (IDS) can effectively detect the anomalies caused by FDI attacks. Specifically, such IDS establishes anomaly detection model which can describe the normal pattern of industrial processes, then perform real-time anomaly detection on industrial process data. However, this method suffers low detection accuracy due to the complexity and instability of industrial processes. That is, the process data inherently contains sophisticated nonlinear spatial-temporal correlations which are hard to be explicitly described by anomaly detection model. In addition, the noise and disturbance in process data prevent the IDS from distinguishing the real anomaly events. In this paper, we propose an Anomaly Detection approach based on Robust Spatial-temporal Modeling (AD-RoSM). Concretely, to explicitly describe the spatial-temporal correlations within the process data, a neural based state estimation model is proposed by utilizing 1D CNN for temporal modeling and multi-head self attention mechanism for spatial modeling. To perform robust anomaly detection in the presence of noise and disturbance, a composite anomaly discrimination model is designed so that the outputs of the state estimation model can be analyzed with a combination of threshold strategy and entropy-based strategy. We conducted extensive experiments on two benchmark ICS security datasets to demonstrate the effectiveness of our approach.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Li et al. [69] applied a Temporal Graph Convolutional Network (T-GCN) to model complex spatiotemporal correlations among sensors within ICS using SWaT and WADI datasets.
“Using the SWaT and WADI datasets, Li et al. [69] applied a Temporal Graph Convolutional Network (T-GCN) to model complex spatiotemporal correlations among sensors within ICS.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [69]
In many works, a model predicts the next-step sensor or control-signal values and computes prediction residuals, or derives an anomaly score that functions as a probabilistic or density-based residual, so that small but systematic deviations in process dynamics can be detected even when they are not visible at the network layer.
“In many of these works, a model predicts the next-step sensor or control-signal values and computes prediction residuals, or derives an anomaly score that functions as a probabilistic or density-based residual, so that small but systematic deviations in process dynamics can be detected even when they are not visible at the network layer [67,69,70,72,73,75].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [69]
Process data are particularly suitable for attacks that perturb the physical process state while keeping network-level statistics relatively unchanged, such as false data injection, malicious command or parameter manipulation, process-oriented attacks, and stealthy drifts in sensor trajectories.
“First, process data are particularly suitable for attacks that perturb the physical process state while keeping network-level statistics relatively unchanged-such as false data injection, malicious command or parameter manipulation, process-oriented attacks, and stealthy drifts in sensor trajectories [67,69-73,75,76].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [69]
The distribution of datasets shows a strong reliance on SWaT and WADI for benchmarking prediction-residual-based methods, with additional evidence from custom-built avionics, robotics, temperature-control, offshore wind farm, and simulation-based CPS testbeds.
“Finally, the distribution of datasets shows a strong reliance on SWaT and WADI for benchmarking prediction-residual-based methods, with additional evidence from custombuilt avionics, robotics, temperature-control, offshore wind farm, and simulation-based CPS testbeds [67-73,75,76].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [69]
Prediction-residual-oriented methods are powerful for detecting subtle and coordinated process anomalies, including multi-point stealthy attacks that forge SCADA histories or slowly drive the system toward unsafe states.
“Third, in terms of detection capability and failure modes, the results indicate that prediction-residual-oriented methods are powerful for detecting subtle and coordinated process anomalies, including multi-point stealthy attacks that forge SCADA histories or slowly drive the system toward unsafe states [69,72,73,75,76].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [69]
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474 · see citing works
Stuxnet: Dissecting a cyberwarfare weapon
Langner, R. (2011) · IEEE Security & Privacy Magazine · doi:10.1109/msp.2011.67 · Cited by 1,922 · see citing works
Robust Anomaly Detection for Multivariate Time Series through Stochastic Recurrent Neural Network
Su, Y., Zhao, Y., Niu, C., Liu, R., Sun, W., & Pei, D. (2019) · Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining · doi:10.1145/3292500.3330672 · Cited by 1,804 · see citing works
Detecting Spacecraft Anomalies Using LSTMs and Nonparametric Dynamic Thresholding
Hundman, K., Constantinou, V., Laporte, C., Colwell, I., & Soderstrom, T. (2018) · Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining · doi:10.1145/3219819.3219845 · Cited by 1,771 · see citing works
Graph Neural Network-Based Anomaly Detection in Multivariate Time Series
Deng, A., & Hooi, B. (2021) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v35i5.16523 · Cited by 1,413 · see citing works
Guide to Industrial Control Systems (ICS) Security
Stouffer, K., Pillitteri, V., Lightman, S., Abrams, M., & Hahn, A. (2015) · doi:10.6028/nist.sp.800-82r2 · Cited by 1,377 · cited 1× · see citing works
“A typical ICS contains multiple control loops, human interfaces (HMI) and remote diagnostics and maintenance tools built on layered network architectures [22].”
BackgroundMAD-GAN: Multivariate Anomaly Detection for Time Series Data with Generative Adversarial Networks
Li, D., Chen, D., Jin, B., Shi, L., Goh, J., & Ng, S.-K. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-30490-4_56 · Cited by 1,323 · see citing works
Characterization of Surface EMG Signal Based on Fuzzy Entropy
Chen, W., Wang, Z., Xie, H.-B., & Yu, W. (2007) · IEEE Transactions on Neural Systems and Rehabilitation Engineering · doi:10.1109/tnsre.2007.897025 · Cited by 1,107 · see citing works
USAD: UnSupervised Anomaly Detection on Multivariate Time Series
Audibert, J., Michiardi, P., Guyard, F., Marti, S., & Zuluaga, M. A. (2020) · Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining · doi:10.1145/3394486.3403392 · Cited by 1,094 · cited 4× · see citing works
“Figure 6(c) summarizes the obtained results using 5 different head numbers h ∈ [2, 4, 8, 16, 32].”
BackgroundMethodInfluentialMultivariate Time-Series Anomaly Detection via Graph Attention Network
Zhao, H., Wang, Y., Duan, J., Huang, C., Cao, D., Tong, Y., Xu, B., Bai, J., Tong, J., & Zhang, Q. (2020) · Proceedings · doi:10.1109/icdm50108.2020.00093 · Cited by 850 · see citing works
Learning Graph Structures With Transformer for Multivariate Time-Series Anomaly Detection in IoT
Chen, Z., Chen, D., Zhang, X., Yuan, Z., & Cheng, X. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3100509 · Cited by 613 · see citing works
Li, Z., Zhao, Y., Han, J., Su, Y., Jiao, R., Wen, X., & Pei, D. (2021) · Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining · doi:10.1145/3447548.3467075 · Cited by 464 · see citing works
Limiting the Impact of Stealthy Attacks on Industrial Control Systems
Urbina, D. I., Giraldo, J., Cárdenas, Á. A., Tippenhauer, N. O., Valente, J., Faisal, M. A., Ruths, J., Candell, R., & Sandberg, H. (2016) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2976749.2978388 · Cited by 360 · see citing works
Anomaly Detection with Generative Adversarial Networks for Multivariate Time SeriesPreprint
Li, D., Chen, D., Goh, J., & Ng, S.-K. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1809.04758 · Cited by 233 · see citing works
Kravchik, M., & Shabtai, A. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2021.3050101 · Cited by 224 · see citing works
A Systematic Framework to Generate Invariants for Anomaly Detection in Industrial Control Systems
Feng, C., Palleti, V. R., Mathur, A. P., & Chana, D. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23265 · Cited by 129 · see citing works
Feng, C., & Tian, P. (2021) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3447548.3467137 · Cited by 112 · see citing works
Aoudi, W., Iturbe, M., & Almgren, M. (2018) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3243734.3243781 · Cited by 110 · see citing works
Ahmed, C. M., Raman, M. R. G., & Mathur, A. P. (2020) · doi:10.1145/3384941.3409588 · Cited by 68 · see citing works
Mohammadpourfard, M., Sami, A., & Seifi, A. R. (2017) · Expert Systems with Applications · doi:10.1016/j.eswa.2017.05.013 · Cited by 66 · see citing works
Adversarial Regression for Detecting Attacks in Cyber-Physical Systems
Ghafouri, A., Vorobeychik, Y., & Koutsoukos, X. (2018) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2018/524 · Cited by 48 · see citing works
Time-Series Aware Precision and Recall for Anomaly Detection
Hwang, W., Yun, J.-H., Kim, J., & Kim, H. C. (2019) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3357384.3358118 · Cited by 46 · see citing works
Jump-Starting Multivariate Time Series Anomaly Detection for Online Service Systems
Ma, M., Zhang, S., Chen, J., Xu, J., Li, H., Lin, Y., Nie, X., Zhou, B., Wang, Y., & Pei, D. (2021) · Cited by 44 · see citing works
Stealthy Deception Attacks Against SCADA Systems
Kleinmann, A., Amichay, O., Wool, A., Tenenbaum, D., Bar, O., & Lev, L. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-72817-9_7 · Cited by 40 · see citing works
Limitations of state estimation based cyber attack detection schemes in industrial control systems
Ahmed, C. M., Adepu, S., & Mathur, A. P. (2016) · doi:10.1109/scspw.2016.7509557 · Cited by 35 · see citing works
Detecting stealthy attacks on industrial control systems using a permutation entropy-based method
Hu, Y., Li, H., Luan, T. H., Yang, A., Sun, L., Wang, Z., & Wang, R. (2018) · Future Generation Computer Systems · doi:10.1016/j.future.2018.07.027 · Cited by 31 · see citing works
Self-citationUnsupervised Learning for Online Abnormality Detection in Smart Meter Data
Aligholian, A., Farajollahi, M., & Mohsenian‐Rad, H. (2019) · IEEE Power & Energy Society General Meeting (PESGM) · doi:10.1109/pesgm40551.2019.8973564 · Cited by 31 · see citing works
Enhanced Cyber-Physical Security through Deep Learning Techniques.
Carrasco, M. A. M., & Wu, C. (2019) · Cited by 7 · see citing works
Flagged first, then by citations
1 of the 29 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
Deep Neural Networks for Spatial-Temporal Cyber-Physical Systems: A Survey
Musa, A. A., Hussaini, A., Liao, W., Liang, F., & Yu, W. (2023) · Future Internet · doi:10.3390/fi15060199 · Cited by 60 · see citing works
Process-Oriented heterogeneous graph learning in GNN-Based ICS anomalous pattern recognition
Lu, S., Wang, K., Zhang, L., & Wang, B. (2023) · Pattern Recognition · doi:10.1016/j.patcog.2023.109661 · Cited by 23 · see citing works
Seo, J. K., Lee, J., Kim, B., Shim, W., & Seo, J. T. (2025) · Electronics · doi:10.3390/electronics15010020 · Cited by 15 · see citing works
SFACIF: A safety function attack and anomaly industrial condition identified framework
Liu, K., Xie, Y., Chen, Y., Xie, S., Chen, X., Fang, D., & Sun, L. (2024) · Computer Networks · doi:10.1016/j.comnet.2024.110927 · Cited by 3 · see citing works
Self-citation(2022) · IEEE International Conference on Mobile Ad-Hoc and Sensor Systems (MASS) · doi:10.1109/mass56207.2022.00004
SSAD: State Space-Based Anomaly Detection in Industrial Control Systems
Wei, Z., Lv, F., Xiao, L., Chen, X., Lv, S., & Sun, L. (2024) · International Conference on Mobility, Sensing and Networking (MSN) · doi:10.1109/msn63567.2024.00072
Self-citation
- Authors
- Li, S., Liu, J., Pan, Z., Lv, S., Si, S., & Sun, L.
- Affiliations
- Chinese Academy of Sciences (CN)
- Venue
- 2022 IEEE 19th International Conference on Mobile Ad Hoc and Smart Systems (MASS)
- Publisher
- IEEE
- Published
- 2022-10
- Pages
- 355-363
- OpenAlex
- W4312785789
- Cited by
- 6
- References
- 29
- Citations by year
- 2025: 1 · 2024: 2 · 2023: 2 · 2022: 1
- FWCI
- 2.29
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- IEEE International Conference on Mobile Ad-Hoc and Sensor Systems (MASS) (publishedVersion)
- Funders
- National Natural Science Foundation of China (62002342)
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Control and Systems Engineering › Fault Detection and Control Systems
- Keywords
- industrial control systems, false data injection attacks, intrusion detection, anomaly detection, spatio-temporal modeling, 1D convolutional neural network, multi-head self-attention, state estimation, noise robustness, threshold detection
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
