Cited by 75Network Security and Intrusion DetectionArtificial Immune Systems ApplicationsMachine Learning and ELM

Stacked one-class broad learning system for intrusion detection in industry 4.0

Yang, Kaixiang, Shi, Yifan, Yu, Zhiwen, Yang, Qinmin, Sangaiah, Arun Kumar, Zeng, Huanqiang·2023·IEEE Transactions on Industrial Informatics

Abstract

With the vigorous development of Industry 4.0, industrial Big Data has turned into the core element of the Industrial Internet of Things. As one of the most fundamental and indispensable components in industrial cyber-physical systems (CPS), intelligent anomaly detection is still an essential and challenging issue. However, with the development of the network, there may exist unknown types of attacks, which are difficult to collect. Facing one-class industrial intrusion detection scenario that the collected training data only includes normal state, the one-class broad learning system (OCBLS) and the stacked OCBLS (ST-OCBLS) algorithms are developed. Benefiting from the characteristics of BLS, our proposed approaches retain the advantage of efficient training process. Moreover, the high-level hidden features of the network traffic data can be learned through the progressive encoding and decoding mechanism in ST-OCBLS. Extensive comparative experiments on several real-world intrusion detection tasks are carried out to demonstrate that our proposed methods have competitive performance and high efficiency in the face of complex network data and diversified types of intrusions. Overall, this article provides a new alternative solution for network intrusion detection in Industry 4.0.

Integrity signals

Registry

Crossref · 10.1109/tii.2022.3157727

Cites

40 of 40 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

This paper’s full text isn’t openly available, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • In communication-centric attack scenarios, coarse-grained traffic statistics and entropy measures are sufficient to expose abnormal behavior without requiring deep protocol parsing.

    “In these scenarios, coarse-grained traffic statistics and entropy measures are sufficient to expose abnormal behavior without requiring deep protocol parsing [13,21,28,32].”
  • Deep architectures such as DAE, DAGMM, GCNN, and LSTM-based hybrids are mainly beneficial when modeling nonlinear feature interactions or temporal dependencies, but they can be sensitive to preprocessing choices and class imbalance, sometimes exhibiting complementary false-positive/false-negative patterns compared with simpler models.

    “Deep architectures such as DAE, DAGMM, GCNN, and LSTM-based hybrids are mainly beneficial when modeling nonlinear feature interactions or temporal dependencies [13,15,17,21,23,29], but they can be sensitive to preprocessing choices and class imbalance, sometimes exhibiting complementary false-positive/falsenegative patterns compared with simpler models [20,21,28].”
  • Classical machine-learning classifiers often perform competitively on high-dimensional statistical feature spaces derived from NSL-KDD, UNSW-NB15, NF-BoT-IoT, IoT-23, and similar benchmarks.

    “Third, in terms of model behavior, the comparison across studies indicates that classical machine-learning classifiers often perform competitively on high-dimensional statistical feature spaces derived from NSL-KDD, UNSW-NB15, NF-BoT-IoT, IoT-23, and similar benchmarks [17,20,23,28,32,34].”
  • Supervised statistical classifiers tend to achieve high accuracy when ample labeled attack data are available, whereas unsupervised and semi-supervised methods offer better robustness to previously unseen or zero-day attacks at the expense of slightly lower nominal accuracy.

    “Supervised statistical classifiers tend to achieve high accuracy when ample labeled attack data are available [13,15,17,20,23,25,32,34], whereas unsupervised and semi-supervised methods offer better robustness to previously unseen or zero-day attacks at the expense of slightly lower nominal accuracy [17,20,21,25,28,34].”

Cites

Flagged first, then by citations

1 of the 41 references couldn’t be matched to a known paper.

Cited by

Sorted by citations

Authors
Yang, K., Shi, Y., Yu, Z., Yang, Q., Sangaiah, A. K., & Zeng, H.
Affiliations
  • Zhejiang University (CN)
  • Huaqiao University (CN)
  • South China University of Technology (CN)
  • Vellore Institute of Technology University (IN)
Venue
IEEE Transactions on Industrial Informatics
Published
2023-01
Volume
19
Issue
1
Pages
251-260
ISSN
  • 1551-3203 (ISSN-L)
  • 1941-0050
OpenAlex
W4226198717
Cited by
75
References
41
Citations by year
2026: 8 · 2025: 20 · 2024: 26 · 2023: 19 · 2022: 2
FWCI
7.43
Type
journal article
Language
en
Open access
closed
Locations
IEEE Transactions on Industrial Informatics (publishedVersion)
Funders
  • National Natural Science Foundation of China (62106224, U21A20478, U21B2029)
  • Scientific Research Funds of Huaqiao University
  • Key-Area Research and Development Program of Guangdong Province (2018B010107002)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Engineering › Biomedical Engineering › Artificial Immune Systems Applications
  • Physical Sciences › Computer Science › Artificial Intelligence › Machine Learning and ELM
Keywords
intrusion detection, anomaly detection, Industry 4.0, Industrial Internet of Things, industrial cyber-physical systems, network traffic data, unknown attack detection, industrial big data

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review