${l_p}$-norms in One-Class Classification for Intrusion Detection in SCADA Systems
Abstract
The massive use of information and communication technologies in supervisory control and data acquisition (SCADA) systems opens new ways for carrying out cyberattacks against critical infrastructures relying on SCADA networks. The various vulnerabilities in these systems and the heterogeneity of cyberattacks make the task extremely difficult for traditional intrusion detection systems (IDS). Modeling cyberattacks has become nearly impossible and their potential consequences may be very severe. The primary objective of this work is to detect malicious intrusions once they have already bypassed traditional IDS and firewalls. This paper investigates the use of machine learning for intrusion detection in SCADA systems using one-class classification algorithms. Two approaches of one-class classification are investigated: 1) the support vector data description (SVDD); and 2) the kernel principle component analysis. The impact of the considered metric is examined in detail with the study of lp-norms in radial basis function (RBF) kernels. A heuristic is proposed to find an optimal choice of the bandwidth parameter in these kernels. Tests are conducted on real data with several types of cyberattacks.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Cites
Neural Networks: A Comprehensive Foundation
Haykin, S. (1998) · Cited by 30,070 · see citing works
UCI Machine Learning Repository
Asuncion, A. (2007) · Medical Entomology and Zoology · Cited by 24,190 · see citing works
Normalized cuts and image segmentation
Shi, J., & Malik, J. (2000) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/34.868688 · Cited by 15,842 · see citing works
Nonlinear Component Analysis as a Kernel Eigenvalue Problem
Schölkopf, B., Smola, A. J., & Müller, K. (1998) · Neural Computation · doi:10.1162/089976698300017467 · Cited by 8,121 · see citing works
Kernel Methods for Pattern Analysis
Shawe-Taylor, J. S., & Cristianini, N. (2004) · Cambridge University Press eBooks · doi:10.1017/cbo9780511809682 · Cited by 6,610 · see citing works
Estimating the Support of a High-Dimensional Distribution
Schölkopf, B., Platt, J. C., Shawe-Taylor, J., Smola, A. J., & Williamson, R. C. (2001) · Neural Computation · doi:10.1162/089976601750264965 · Cited by 6,168 · see citing works
Missing Value Estimation Methods for DNA Microarrays
Troyanskaya, O., Cantor, M., Sherlock, G., Brown, P., Hastie, T., Tibshirani, R., Botstein, D., & Altman, R. B. (2001) · Bioinformatics · doi:10.1093/bioinformatics/17.6.520 · Cited by 4,230 · see citing works
Support Vector Data Description
Tax, D. M. J., & Duin, R. P. W. (2003) · Machine Learning · doi:10.1023/b:mach.0000008084.60811.49 · Cited by 3,553 · see citing works
Practical selection of SVM parameters and noise estimation for SVM regression
Cherkassky, V., & Ma, Y. (2003) · Neural Networks · doi:10.1016/s0893-6080(03)00169-2 · Cited by 2,034 · see citing works
Stuxnet: Dissecting a cyberwarfare weapon
Langner, R. (2011) · IEEE Security & Privacy Magazine · doi:10.1109/msp.2011.67 · Cited by 1,922 · see citing works
Kernel methods in machine learning
Hofmann, T., Schölkopf, B., & Smola, A. J. (2008) · The Annals of Statistics · doi:10.1214/009053607000000677 · Cited by 1,758 · see citing works
A Generalized Representer Theorem
Schölkopf, B., Herbrich, R., & Smola, A. J. (2001) · Lecture notes in computer science · doi:10.1007/3-540-44581-1_27 · Cited by 1,610 · see citing works
KERNEL METHODS IN MACHINE LEARNING
Hofmann, T., Schölkopf, B., & Smola, A. J. (2008) · Cited by 1,408 · see citing works
An analysis of four missing data treatment methods for supervised learning
Batista, G., & Monard, M. C. (2003) · Applied Artificial Intelligence · doi:10.1080/713827181 · Cited by 898 · see citing works
Kernel PCA for novelty detection
Hoffmann, H. (2006) · Pattern Recognition · doi:10.1016/j.patcog.2006.07.009 · Cited by 776 · see citing works
Lessons Learned from the Maroochy Water Breach
Slay, J., & Miller, M. (2007) · Critical Infrastructure Protection · doi:10.1007/978-0-387-75462-8_6 · Cited by 721 · see citing works
Attacks against process control systems: risk assessment, detection, and response
Cárdenas, A. A., Amin, S., Lin, Z.-S., Huang, Y.-L., Huang, C.-Y., & Sastry, S. (2011) · Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security · doi:10.1145/1966913.1966959 · Cited by 699 · see citing works
Vulnerability Assessment of Cybersecurity for SCADA Systems
Ten, C.-W., Liu, C.-C., & Manimaran, G. (2008) · IEEE Transactions on Power Systems · doi:10.1109/tpwrs.2008.2002298 · Cited by 583 · see citing works
Chen, T. M., & Abu-Nimeh, S. (2011) · Computer · doi:10.1109/mc.2011.115 · Cited by 398 · see citing works
Vert, J., Tsuda, K., & Schölkopf, B. (2004) · The MIT Press eBooks · doi:10.7551/mitpress/4057.003.0004 · Cited by 386 · see citing works
A Survey of Recent Trends in One Class Classification
Khan, S. S., & Madden, M. G. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-17080-5_21 · Cited by 348 · see citing works
Data domain description using support vectors.
Tax, D. M. J., & Duin, R. P. W. (1999) · Cited by 276 · see citing works
A Multidimensional Critical State Analysis for Detecting Intrusions in SCADA Systems
Carcano, A., Coletta, A., Guglielmi, M., Masera, M., Nai Fovino, I., & Trombetta, A. (2011) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2010.2099234 · Cited by 259 · see citing works
Luengo, J., García, S., & Herrera, F. (2011) · Knowledge and Information Systems · doi:10.1007/s10115-011-0424-2 · Cited by 241 · see citing works
Towards Missing Data Imputation: A Study of Fuzzy K-means Clustering Method
Li, D., Deogun, J. S., Spaulding, W. D., & Shuart, B. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-25929-9_70 · Cited by 220 · see citing works
Synthesizing Statistical Knowledge from Incomplete Mixed-Mode Data
Wong, A. K. C., & Chiu, D. (1987) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.1987.4767986 · Cited by 192 · see citing works
A Meta-Learning Method to Select the Kernel Width in Support Vector Regression
Soares, C., Brazdil, P., & Kuba, P. (2004) · Machine Learning · doi:10.1023/b:mach.0000015879.28004.9b · Cited by 187 · see citing works
Data mining and the impact of missing data
Brown, M. L., & Kros, J. F. (2003) · Industrial Management & Data Systems · doi:10.1108/02635570310497657 · Cited by 181 · see citing works
A control system testbed to validate critical infrastructure protection concepts
Morris, T. H., Srivastava, A. K., Reaves, B., Gao, W., Pavurapu, K., & Reddi, R. M. (2011) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2011.06.005 · Cited by 162 · see citing works
Online Kernel Principal Component Analysis: A Reduced-Order Model
Honeiné, P. (2011) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2011.270 · Cited by 114 · see citing works
Critical State-Based Filtering System for Securing SCADA Network Protocols
Nai Fovino, I., Coletta, A., Carcano, A., & Masera, M. (2012) · IEEE Transactions on Industrial Electronics · doi:10.1109/tie.2011.2181132 · Cited by 108 · see citing works
Luengo, J., García, S., & Herrera, F. (2009) · Neural Networks · doi:10.1016/j.neunet.2009.11.014 · Cited by 101 · see citing works
Safeguarding SCADA Systems with Anomaly Detection
Bigham, J., Gamez, D., & Lü, N. (2003) · Lecture notes in computer science · doi:10.1007/978-3-540-45215-7_14 · Cited by 94 · see citing works
An experimental platform for assessing SCADA vulnerabilities and countermeasures in power plants
Fovino, I. N., Masera, M., Guidi, L., & Carpi, G. (2010) · Conference on Human System Interactions · doi:10.1109/hsi.2010.5514494 · Cited by 86 · see citing works
A testbed for SCADA control system cybersecurity research and pedagogy
Morris, T., Vaughn, R., & Dandass, Y. S. (2011) · Proceedings of the Seventh Annual Workshop on Cyber Security and Information Intelligence Research · doi:10.1145/2179298.2179327 · Cited by 76 · cited 1× · see citing works
“Morris et al. investigated in [23] and [24] the vulnerabilities of functional control systems.”
BackgroundSome Properties of the Gaussian Kernel for One Class Learning
Evangelista, P. F., Embrechts, M. J., & Szymanski, B. K. (2007) · Lecture notes in computer science · doi:10.1007/978-3-540-74690-4_28 · Cited by 72 · see citing works
Mazhelis, O. (2007) · Revue Africaine de la Recherche en Informatique et Mathématiques Appliquées · doi:10.46298/arima.1877 · Cited by 71 · see citing works
Intrusion Detection and Event Monitoring in SCADA Networks
Oman, P., & Phillips, M. (2007) · IFIP International Federation for Information Processing · doi:10.1007/978-0-387-75462-8_12 · Cited by 62 · see citing works
Adaptive Kalman Filtering for anomaly detection in software appliances
Knorn, F., & Leith, D. J. (2008) · IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) · doi:10.1109/infocom.2008.4544581 · Cited by 62 · see citing works
EWMA Forecast of Normal System Activity for Computer Intrusion Detection
Ye, N., Chen, Q., & Borror, C. M. (2004) · IEEE Transactions on Reliability · doi:10.1109/tr.2004.837705 · Cited by 58 · see citing works
Urias, V., Van Leeuwen, B., & Richardson, B. (2012) · MILCOM 2012 - 2012 IEEE Military Communications Conference · doi:10.1109/milcom.2012.6415818 · Cited by 56 · see citing works
Anomaly Intrusion Detection Approach Using Hybrid MLP/CNN Neural Network
Yu, Y., Wei, Y., Gao, F., & Yu, G. (2006) · International Conference on Intelligent Systems Design and Applications (ISDA) · doi:10.1109/isda.2006.253765 · Cited by 54 · see citing works
Handling Missing Attribute Values in Preterm Birth Data Sets
Grzymala‐Busse, J. W., Goodwin, L., Grzymała-Busse, W. J., & Zheng, X. (2005) · Lecture notes in computer science · doi:10.1007/11548706_36 · Cited by 54 · see citing works
Creating a European SCADA Security Testbed
Christiansson, H., & Luiijf, H. A. M. (2007) · Springer eBooks · doi:10.1007/978-0-387-75462-8_17 · Cited by 52 · see citing works
Stouffer, K. A., Falco, J., & Scarfone, K. A. (2011) · doi:10.6028/nist.sp.800.82 · Cited by 50 · see citing works
Secure "selecticast" for collaborative intrusion detection systems
Gross, P. N. (2004) · doi:10.1049/ic:20040382 · Cited by 48 · see citing works
On simple one-class classification methods
Noumir, Z., Honeiné, P., & Richard, C. (2012) · IEEE International Symposium on Information Theory (ISIT) · doi:10.1109/isit.2012.6283685 · Cited by 39 · see citing works
Support-Vector-Based Hyperspectral Anomaly Detection Using Optimized Kernel Parameters
Gurram, P. K., & Kwon, H. (2011) · IEEE Geoscience and Remote Sensing Letters · doi:10.1109/lgrs.2011.2155030 · Cited by 39 · see citing works
Multiclass classification machines with the complexity of a single binary classifier
Honeiné, P., Noumir, Z., & Richard, C. (2012) · Signal Processing · doi:10.1016/j.sigpro.2012.11.009 · Cited by 31 · see citing works
Kernel Whitening for One-Class Classification
Tax, D. M. J., & Juszczak, P. (2002) · Lecture notes in computer science · doi:10.1007/3-540-45665-1_4 · Cited by 29 · see citing works
Mahalanobis-based one-class classification
Nader, P., Honeiné, P., & Beauseroy, P. (2014) · Machine learning for signal processing ... · doi:10.1109/mlsp.2014.6958934 · Cited by 26 · see citing works
Neural Network Ensembles for Intrusion Detection
Golovko, V. A., Kachurka, P., & Vaitsekhovich, L. (2007) · doi:10.1109/idaacs.2007.4488487 · Cited by 16 · see citing works
Intrusion Detection in SCADA Systems Using One-Class Classification
Nader, P., Honeiné, P., & Beauseroy, P. (2013) · HAL · Cited by 15 · see citing works
Online One-Class Machines Based On The Coherence Criterion
Honeiné, P., Noumir, Z., & Richard, C. (2012) · INFM-OAR (INFN Catania) · doi:10.5281/zenodo.52082 · Cited by 12 · see citing works
Ghadiri, A., & Ghadiri, N. (2011) · Annual Communication Networks and Services Research Conference (CNSR) · doi:10.1109/cnsr.2011.26 · Cited by 12 · see citing works
Strategies for principal component analysis in wireless sensor networks
Ghadban, N., Honeiné, P., Francis, C., Mourad-Chehade, F., & Farah, J. (2014) · IEEE Sensor Array and Multichannel Signal Processing Workshop (SAM) · doi:10.1109/sam.2014.6882383 · Cited by 11 · see citing works
Visual Object Recognition Through One-Class Learning
Wang, Q., Lopes, L. S., & Tax, D. M. J. (2004) · Lecture notes in computer science · doi:10.1007/978-3-540-30125-7_58 · Cited by 10 · see citing works
An anomaly detection architecture based on a data-adaptive density estimation
Veracini, T., Matteoli, S., Diani, M., & Corsini, G. U. (2011) · Workshop on Hyperspectral Image and Signal Processing: Evolution in Remote Sensing · doi:10.1109/whispers.2011.6080919 · Cited by 9 · see citing works
Quesada (2001) · doi:10.1175/1520-0442(2001)014
Flagged first, then by citations
Cited by
Sorted by citations
Anomaly Detection in Cyber Physical Systems Using Recurrent Neural Networks
Goh, J., Adepu, S., Tan, M., & Lee, Z. S. (2017) · IEEE International Symposium on High Assurance Systems Engineering (HASE) · doi:10.1109/hase.2017.36 · Cited by 447 · see citing works
Data-Driven Monitoring and Safety Control of Industrial Cyber-Physical Systems: Basics and Beyond
Jiang, Y., Yin, S., & Kaynak, O. (2018) · IEEE Access · doi:10.1109/access.2018.2866403 · Cited by 263 · see citing works
Multi-level Anomaly Detection in Industrial Control Systems via Package Signatures and LSTM Networks
Feng, C., Li, T., & Chana, D. (2017) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn.2017.34 · Cited by 240 · see citing works
Detection of power grid disturbances and cyber-attacks based on machine learning
Wang, D., Wang, X., Zhang, Y., & Jin, L. (2019) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2019.02.008 · Cited by 212 · see citing works
Hương, T. T., Bac, T. P., Long, D. M., Luong, T. D., Dan, N. M., Quang, L. A., Cong, L. T., Thang, B. D., & Tran, K. P. (2021) · Computers in Industry · doi:10.1016/j.compind.2021.103509 · Cited by 196 · see citing works
Pan, S., Morris, T., & Adhikari, U. (2015) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2015.2420951 · Cited by 180 · see citing works
Umer, M., Junejo, K. N., Jilani, M. T., & Mathur, A. P. (2022) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2022.100516 · Cited by 172 · see citing works
Assessing and augmenting SCADA cyber security: A survey of techniques
Nazir, S., Patel, S., & Patel, D. (2017) · Computers & Security · doi:10.1016/j.cose.2017.06.010 · Cited by 167 · see citing works
“Nader et al. [100] propose to detect malicious intrusions through machine learning after they have bypassed IDS.”
BackgroundAn Integrated Framework for Privacy-Preserving Based Anomaly Detection for Cyber-Physical Systems
Keshk, M., Sitnikova, E., Moustafa, N., Hu, J., & Khalil, I. (2019) · IEEE Transactions on Sustainable Computing · doi:10.1109/tsusc.2019.2906657 · Cited by 165 · see citing works
A Survey of Security in SCADA Networks: Current Issues and Future Challenges
Ghosh, S., & Sampalli, S. (2019) · IEEE Access · doi:10.1109/access.2019.2926441 · Cited by 154 · see citing works
HML-IDS: A Hybrid-Multilevel Anomaly Prediction Approach for Intrusion Detection in SCADA Systems
Khan, I. A., Pi, D., Khan, Z. U., Hussain, Y., & Nawaz, A. (2019) · IEEE Access · doi:10.1109/access.2019.2925838 · Cited by 156 · see citing works
Berghout, T., Benbouzid, M., & Muyeen, S. M. (2022) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2022.100547 · Cited by 136 · see citing works
Fault-Attention Generative Probabilistic Adversarial Autoencoder for Machine Anomaly Detection
Wu, J., Zhao, Z., Sun, C., Yan, R., & Chen, X. (2020) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2020.2976752 · Cited by 137 · see citing works
On the Generation of Anomaly Detection Datasets in Industrial Control Systems
Gómez, Á. L. P., Maimó, L. F., Celdrán, A. H., Clemente, F. J. G., Sarmiento, C. C., Masa, C. D. C., & Nistal, R. M. (2019) · IEEE Access · doi:10.1109/access.2019.2958284 · Cited by 120 · see citing works
A Dual-Isolation-Forests-Based Attack Detection Framework for Industrial Control Systems
Elnour, M., Meskin, N., Khan, K. M., & Jain, R. K. (2020) · IEEE Access · doi:10.1109/access.2020.2975066 · Cited by 117 · see citing works
Behaviour-Based Attack Detection and Classification in Cyber Physical Systems Using Machine Learning
Junejo, K. N., & Goh, J. (2016) · doi:10.1145/2899015.2899016 · Cited by 114 · see citing works
Intrusion Detection of Industrial Internet-of-Things Based on Reconstructed Graph Neural Networks
Zhang, Y., Yang, C., Huang, K., & Li, Y. (2022) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2022.3184975 · Cited by 112 · see citing works
Aoudi, W., Iturbe, M., & Almgren, M. (2018) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3243734.3243781 · Cited by 110 · see citing works
Khan, I. A., Keshk, M., Pi, D., Khan, N., Hussain, Y., & Soliman, H. (2022) · Ad Hoc Networks · doi:10.1016/j.adhoc.2022.102930 · Cited by 110 · see citing works
Security of SCADA systems against cyber–physical attacks
van Long, Fillatre, L., Nikiforov, I. V., & Willett, P. (2017) · IEEE Aerospace and Electronic Systems Magazine · doi:10.1109/maes.2017.160047 · Cited by 102 · see citing works
Chen, J., Gao, X., Deng, R., He, Y., Fang, C., & Cheng, P. (2020) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2020.3037500 · Cited by 94 · see citing works
Polat, H., Türkoğlu, M., Polat, O., & Şengür, A. (2022) · Expert Systems with Applications · doi:10.1016/j.eswa.2022.116748 · Cited by 86 · see citing works
Stacked one-class broad learning system for intrusion detection in industry 4.0
Yang, K., Shi, Y., Yu, Z., Yang, Q., Sangaiah, A. K., & Zeng, H. (2023) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2022.3157727 · Cited by 75 · see citing works
False sequential logic attack on SCADA system and its physical impact analysis
Li, W., Xie, L., Deng, Z., & Wang, Z. (2016) · Computers & Security · doi:10.1016/j.cose.2016.01.001 · Cited by 71 · see citing works
A Taxonomy of Supervised Learning for IDSs in SCADA Environments
Suaboot, J., Fahad, A., Tari, Z., Grundy, J., Mahmood, A. N., Almalawi, A., Zomaya, A. Y., & Drira, K. (2020) · ACM Computing Surveys · doi:10.1145/3379499 · Cited by 68 · see citing works
Ali, B. S., Ullah, I., Shloul, T. A., Khan, I. A., Khan, I. M., Ghadi, Y. Y., Abdusalomov, A. B., Nasimov, R., Ouahada, K., & Hamam, H. (2023) · The Journal of Supercomputing · doi:10.1007/s11227-023-05764-5 · Cited by 67 · see citing works
Ayodeji, A., Liu, Y.-K., Chao, N., & Yang, L.-Q. (2020) · Nuclear Engineering and Technology · doi:10.1016/j.net.2020.05.012 · Cited by 66 · see citing works
Wan, M., Shang, W., & Zeng, P. (2017) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2017.2730581 · Cited by 59 · see citing works
Alimi, O. A., Ouahada, K., Abu-Mahfouz, A. M. I., Rimer, S., & Alimi, K. O. A. (2021) · Sustainability · doi:10.3390/su13179597 · Cited by 58 · see citing works
Yin, S., Yang, C., Zhang, J., & Jiang, Y. (2016) · IEEE Transactions on Industrial Electronics · doi:10.1109/tie.2016.2607683 · Cited by 54 · see citing works
Ling, J., Zhu, Z., Luo, Y., & Wang, H. H. (2021) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2021.107049 · Cited by 52 · see citing works
Performance Evaluation and Modeling of an Industrial Application-Layer Firewall
Cheminod, M., Durante, L., Seno, L., & Valenzano, A. (2018) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2018.2802903 · Cited by 48 · see citing works
Industrial Anomaly Detection and Attack Classification Method Based on Convolutional Neural Network
Lai, Y., Zhang, J., & Liu, Z. (2019) · Security and Communication Networks · doi:10.1155/2019/8124254 · Cited by 46 · see citing works
Optimal Schedule of Secure Transmissions for Remote State Estimation Against Eavesdropping
Wang, L., Cao, X., Sun, B., Zhang, H., & Sun, C. (2020) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2020.2995385 · Cited by 45 · see citing works
A three-tiered intrusion detection system for industrial control systems
Anthi, E., Williams, L., Burnap, P., & Jones, K. (2021) · Journal of Cybersecurity · doi:10.1093/cybsec/tyab006 · Cited by 39 · see citing works
Wolsing, K., Wagner, E., Saillard, A., & Henze, M. (2022) · International Symposium on Research in Attacks, Intrusions and Defenses (RAID) · doi:10.1145/3545948.3545968 · Cited by 38 · see citing works
Weighted support vector data description based on chaotic bat algorithm
Hamidzadeh, J., Sadeghi, R., & Namaei, N. (2017) · Applied Soft Computing · doi:10.1016/j.asoc.2017.07.038 · Cited by 37 · see citing works
Detection of cyberattacks in a water distribution system using machine learning techniques
Nader, P., Honeiné, P., & Beauseroy, P. (2016) · International Conference on Digital Information Processing and Communications · doi:10.1109/icdipc.2016.7470786 · Cited by 34 · see citing works
Khan, W., Ishrat, M., Khan, A. N., Arif, M., Shaikh, A. A., Khubrani, M. M., Alam, S., Shuaib, M., & John, R. (2024) · IEEE Access · doi:10.1109/access.2024.3398555 · Cited by 33 · see citing works
A hypergraph based Kohonen map for detecting intrusions over cyber–physical systems traffic
Jagtap, S. S., V. S., S. S., & V., S. (2021) · Future Generation Computer Systems · doi:10.1016/j.future.2021.02.001 · Cited by 29 · see citing works
Lu, X., Fan, B., & Huang, M. (2015) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2015.2422614 · Cited by 29 · see citing works
Learning Based Anomaly Detection in Critical Cyber-Physical Systems
Mozaffari, F. S., Karimipour, H., & Parizi, R. M. (2020) · Springer eBooks · doi:10.1007/978-3-030-45541-5_6 · Cited by 29 · see citing works
Liu, J., Yin, L., Hu, Y., Lv, S., & Sun, L. (2018) · IEEE International Performance, Computing, and Communications Conference · doi:10.1109/pccc.2018.8710993 · Cited by 28 · see citing works
SIDS: State-based intrusion detection for stage-based cyber physical systems
Khalili, A., Sami, A., Khozaei, A., & Pouresmaeeli, S. (2018) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2018.06.003 · Cited by 28 · see citing works
Characteristic insights on industrial cyber security and popular defense mechanisms
Wan, M., Li, J., Liu, Y., Zhao, J., & Wang, J. (2021) · China Communications · doi:10.23919/jcc.2021.01.012 · Cited by 28 · see citing works
Robust localized cyber-attack detection for key equipment in nuclear power plants
Zhang, F., & Coble, J. B. (2020) · Progress in Nuclear Energy · doi:10.1016/j.pnucene.2020.103446 · Cited by 26 · see citing works
Choubineh, A., Wood, D. A., & Choubineh, Z. (2020) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2020.100357 · Cited by 26 · see citing works
Mahalanobis-based one-class classification
Nader, P., Honeiné, P., & Beauseroy, P. (2014) · Machine learning for signal processing ... · doi:10.1109/mlsp.2014.6958934 · Cited by 26 · see citing works
Gulzar, Q., & Mustafa, K. (2025) · Scientific Reports · doi:10.1038/s41598-025-89650-5 · Cited by 29 · see citing works
Autoencoder Based Anomaly Detection for SCADA Networks
Nazir, S., Patel, S. D., & Patel, D. A. (2021) · International Journal of Artificial Intelligence and Machine Learning · doi:10.4018/ijaiml.20210701.oa6 · Cited by 24 · see citing works
Mithra: Anomaly Detection as an Oracle for Cyberphysical Systems
Afzal, A., Goues, C. L., & Timperley, C. (2021) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2021.3120680 · Cited by 20 · see citing works
Data driven approach to attack detection in a cyber-physical smart grid system
Waghmare, S., Kazi, F., & Singh, N. (2017) · Indian Control Conference · doi:10.1109/indiancc.2017.7846487 · Cited by 23 · see citing works
Khan, I. A., Pi, D., Yue, P., Li, B., Khan, Z. U., Hussain, Y., & Nawaz, A. (2019) · Electronics Letters · doi:10.1049/el.2019.3008 · Cited by 23 · see citing works
D’Angelo, G., & Palmieri, F. (2021) · International Journal of Intelligent Systems · doi:10.1002/int.22581 · Cited by 23 · see citing works
Evaluation of Machine Learning Algorithms for Detection of Malicious Traffic in SCADA Network
Rajesh, L., & Satyanarayana, P. (2021) · Journal of Electrical Engineering and Technology · doi:10.1007/s42835-021-00931-1 · Cited by 21 · see citing works
Security Issues on Industrial Internet of Things: Overview and Challenges
Wang, M., Yu, S., Sun, H., & Zhang, B. (2023) · Computers · doi:10.3390/computers12120256 · Cited by 20 · see citing works
Elnour, M., Meskin, N., & Khan, K. M. (2020) · IEEE Conference on Control Technology and Applications (CCTA) · doi:10.1109/ccta41146.2020.9206394 · Cited by 19 · see citing works
CaCo: Attributed Network Anomaly Detection via Canonical Correlation Analysis
Wang, R., Zhang, F., Huang, X., Tian, C., Xi, L., & Fan, H. (2023) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2023.3266406 · Cited by 19 · see citing works
Domain-Based Fuzzing for Supervised Learning of Anomaly Detection in Cyber-Physical Systems
Wijaya, H., Aniche, M. F., & Mathur, A. P. (2020) · doi:10.1145/3387940.3391486 · Cited by 19 · see citing works
CAN Bus Messages Abnormal Detection Using Improved SVDD in Internet of Vehicles
Li, X., Zhang, H., Miao, Y., Ma, S., Ma, J., Liu, X., & Choo, K. R. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3098221 · Cited by 18 · see citing works
An efficient hybrid SVDD/clustering approach for anomaly-based intrusion detection
Kenaza, T., Bennaceur, K., & Labed, A. (2018) · ACM Symposium on Applied Computing · doi:10.1145/3167132.3167180 · Cited by 16 · see citing works
Liu, X., Ai, F., Bo, L., Pu, K., Luo, H., & Wei, D. (2020) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2020.2996674 · Cited by 15 · see citing works
Panda, A. R., Mishra, D., & Ratha, H. K. (2016) · Journal of Industrial Information Integration · doi:10.1016/j.jii.2016.07.001 · Cited by 15 · see citing works
Intrusion Detection in SCADA System: A Survey
Zeng, P.-R., & Zhou, P. (2018) · Communications in computer and information science · doi:10.1007/978-981-13-2384-3_32 · Cited by 15 · see citing works
ReAL: A New ResNet-ALSTM Based Intrusion Detection System for the Internet of Energy
Song, J., Li, B., Wu, Y., Shi, Y., & Li, A. (2020) · Conference on Local Computer Networks · doi:10.1109/lcn48667.2020.9314858 · Cited by 15 · see citing works
The Nuts and Bolts of Deploying Process-Level IDS in Industrial Control Systems
Almgren, M., Aoudi, W., Gustafsson, R., Krahl, R., & Lindhé, A. (2018) · Annual Industrial Control System Security Workshop (ICSS) · doi:10.1145/3295453.3295456 · Cited by 14 · see citing works
Guest Editorial Modeling, Simulation, and Application of Cyber-Physical Energy Systems
Widl, E., Pálenský, P., Siano, P., & Rehtanz, C. (2014) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2014.2359800 · Cited by 14 · see citing works
A Review on Malware Analysis for IoT and Android System
Yadav, C. S., & Gupta, S. (2022) · SN Computer Science · doi:10.1007/s42979-022-01543-w · Cited by 13 · see citing works
A Novel LWCSO-PKM-Based Feature Optimization and Classification of Attack Types in SCADA Network
Sadhasivan, D. K., & Balasubramanian, K. (2017) · Arabian Journal for Science and Engineering · doi:10.1007/s13369-017-2524-0 · Cited by 13 · see citing works
Lan, M., Luo, J., Chai, S., Chai, R., Zhang, C., & Zhang, B. (2020) · Chinese Control Conference (CCC) · doi:10.23919/ccc50068.2020.9188872 · Cited by 13 · see citing works
Anomaly detection for ICS based on deep learning: a use case for aeronautical radar data
de Riberolles, T., Zou, Y., Silvestre, G., Lochin, E., & Song, J. (2022) · Annals of Telecommunications · doi:10.1007/s12243-021-00902-7 · Cited by 13 · see citing works
Using machine learning to detect network intrusions in industrial control systems: a survey
Termanini, A., Al‐Abri, D., Bourdoucen, H., & Maashri, A. A. (2024) · International Journal of Information Security · doi:10.1007/s10207-024-00916-x · Cited by 12 · see citing works
Classifying Categories of SCADA Attacks in a Big Data Framework
Paramkusem, K. M., & Aygün, R. S. (2018) · Annals of Data Science · doi:10.1007/s40745-018-0141-8 · Cited by 12 · see citing works
Tama, B. A., Lee, S. Y., & Lee, S. (2022) · Archives of Computational Methods in Engineering · doi:10.1007/s11831-022-09767-y · Cited by 13 · see citing works
Air Leakage Detection of Pneumatic Train Door Subsystems Using Open Set Recognition
Sun, X., Ling, K. V., Sin, K.-K., & Liu, Y. (2021) · IEEE Transactions on Instrumentation and Measurement · doi:10.1109/tim.2021.3096267 · Cited by 11 · see citing works
Instruction Detection in SCADA/Modbus Network Based on Machine Learning
Qu, H., Qin, J., Liu, W., & Chen, H. (2018) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-319-73447-7_48 · Cited by 11 · see citing works
Khan, W., Ishrat, M., Ahmed, M. N., Abidin, S., Husain, M., Izhar, M., Zamani, A. T., Hussain, M. R., & Ali, A. (2025) · IEEE Access · doi:10.1109/access.2025.3544260 · Cited by 10 · see citing works
EPASAD: ellipsoid decision boundary based Process-Aware Stealthy Attack Detector
Maurya, V., Agarwal, R., Kumar, S., & Shukla, S. K. (2023) · Cybersecurity · doi:10.1186/s42400-023-00162-z · Cited by 10 · see citing works
A modified densenet approach with nearmiss for anomaly detection in industrial control systems
Ayas, S., & Ayas, M. Ş. (2021) · Multimedia Tools and Applications · doi:10.1007/s11042-021-11618-0 · Cited by 9 · see citing works
Application of velocity adaptive shuffled frog leaping bat algorithm in ICS intrusion detection
Li, J., Wang, H., & Yan, B. (2017) · Chinese Control and Decision Conference (CCDC) · doi:10.1109/ccdc.2017.7979135 · Cited by 9 · see citing works
A Quantum-Based Signcryption for Supervisory Control and Data Acquisition (SCADA) Networks
Ghosh, S., Zaman, M., Plourde, B., & Sampalli, S. (2022) · Symmetry · doi:10.3390/sym14081625 · Cited by 8 · see citing works
Maurya, V., & Shukla, S. K. (2024) · Computers in Industry · doi:10.1016/j.compind.2024.104147 · Cited by 6 · see citing works
Detecting deception attacks in cyber‐physical linear parameter varying systems with packet loss
Golabi, A., Erradi, A., Tantawy, A., & Shaban, K. B. (2022) · International Journal of Adaptive Control and Signal Processing · doi:10.1002/acs.3543 · Cited by 6 · see citing works
One-Class Classification Using ℓp-Norm Multiple Kernel Fisher Null Approach
Arashloo, S. R. (2023) · IEEE Transactions on Image Processing · doi:10.1109/tip.2023.3255102 · Cited by 6 · see citing works
Anomaly Detection for Industrial Control Networks Based on Improved One-Class Support Vector Machine
Qu, H., Zhou, J., Qin, J., & Tian, X. (2020) · International Journal of Pattern Recognition and Artificial Intelligence · doi:10.1142/s0218001421500129 · Cited by 6 · see citing works
Wang, Z., Zhao, B., & Blum, R. S. (2021) · Studies in systems, decision and control · doi:10.1007/978-3-030-67361-1_9 · Cited by 6 · see citing works
Nuclear power plant cybersecurity
Zhang, F. (2020) · Elsevier eBooks · doi:10.1016/b978-0-12-818190-4.00021-8 · Cited by 5 · see citing works
Robust One-Class Kernel Spectral Regression
Rahimzadeh, S., & Kittler, J. (2020) · Open Research (University of Surrey) · doi:10.1109/tnnls.2020.2979823 · Cited by 17 · see citing works
A threat recognition solution of edge data security in industrial internet
Li, Q., Long, H., Xu, Z., Hou, J., & Cai, J. (2022) · World Wide Web · doi:10.1007/s11280-022-01054-x · Cited by 4 · see citing works
Detecting False Data Injection Attacks in Linear Parameter Varying Cyber-Physical Systems
Golabi, A., Erradi, A., Tantawy, A., & Shaban, K. B. (2019) · doi:10.1109/cset.2019.8904913 · Cited by 4 · see citing works
SSO-IF: An Outlier Detection Approach for Intrusion Detection in SCADA Systems
Chaithanya, P. S., Priyanga, S., Pravinraj, S., & Sriram, V. S. S. (2020) · Lecture notes in networks and systems · doi:10.1007/978-981-15-0146-3_89 · Cited by 4 · see citing works
Application of Optimized Bidirectional Generative Adversarial Network in ICS Intrusion Detection
Liu, H., Zhou, Z., & Zhang, M. (2020) · Chinese Control and Decision Conference (CCDC) · doi:10.1109/ccdc49329.2020.9164558 · Cited by 4 · see citing works
A Semi-Supervised Approach for Detection of SCADA Attacks in Gas Pipeline Control Systems
Joshi, C., Khochare, J., Rathod, J., & Kazi, F. (2020) · IEEE-HYDCON · doi:10.1109/hydcon48903.2020.9242676 · Cited by 4 · see citing works
A Survey on SCADA Security and Honeypot in Industrial Control System
Lu, K., Liu, I., Sun, M., & Li, J.-S. (2018) · Advances in intelligent systems and computing · doi:10.1007/978-3-319-99007-1_56 · Cited by 4 · see citing works
Presekal, A., Semertzis, I., Goyel, H., Pálenský, P., & Stefanov, A. I. (2025) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2025.3611345 · Cited by 3 · see citing works
Towards a Framework for Analyzing Cyber Attacks Impact Against Smart Power Grid on SCADA System
Akhtar, T., & Gupta, B. B. (2018) · International Conference on Communications and Signal Processing (ICCSP) · doi:10.1109/iccsp.2018.8524195 · Cited by 3 · see citing works
ℓ -Norm Support Vector Data Description
Arashloo, S. R. (2022) · Pattern Recognition · doi:10.1016/j.patcog.2022.108930 · Cited by 3 · see citing works
The comparison network model for cyber anomaly detection
Qu, H., Qin, J., & Chen, H. (2019) · Intelligent Data Analysis · doi:10.3233/ida-184391 · Cited by 3 · see citing works
One-Class Kernel Spectral RegressionPreprint
Arashloo, S. R., & Kittler, J. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1807.01085 · Cited by 3 · see citing works
RemOD: Operational Drift-Adaptive Intrusion Detection
Maurya, V., Rani, N., & Shukla, S. K. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-22829-2_17 · Cited by 2 · see citing works
- Authors
- Nader, P., Honeine, P., & Beauseroy, P.
- Affiliations
- Centre National de la Recherche Scientifique (FR)
- ORCID
- Beauseroy, Pierre
- Venue
- IEEE Transactions on Industrial Informatics
- Published
- 2014-11
- Volume
- 10
- Issue
- 4
- Pages
- 2308-2317
- ISSN
- 1551-3203 (ISSN-L)
- 1941-0050
- OpenAlex
- W2087432251
- Cited by
- 122
- References
- 59
- Citations by year
- 2026: 2 · 2025: 7 · 2024: 3 · 2023: 6 · 2022: 17 · 2021: 17 · 2020: 22 · 2019: 11 · 2018: 13 · 2017: 10 · 2016: 7 · 2015: 5 · 2014: 2
- FWCI
- 8.92
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- IEEE Transactions on Industrial Informatics (publishedVersion)
- HAL (submittedVersion)
- Funders
- Mississippi State University
- Université Saint-Esprit de Kaslik
- Agence Nationale de la Recherche
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Biomedical Engineering › Artificial Immune Systems Applications
- Keywords
- intrusion detection, SCADA systems, one-class classification, Lp norms, support vector data description, kernel principal component analysis, Gaussian kernel, industrial cybersecurity
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
