PIL-MDRS: Physical Intrusion Localization Based on Multidevice Reflection Signals in ICS

Zhang et al. [85] designed a lightweight CNN-LSTM-based hybrid detector for edge gateways in smart-grid substations and distribution boards that simultaneously ingests process sensor time-series and local event/alarm logs.

“For edge gateways in smart-grid substations and distribution boards, Zhang et al. [85] designed a lightweight CNN-LSTM-based hybrid detector that simultaneously ingests process sensor time-series (e.g., voltage, current) and local event/alarm logs.”

This design allows the system to detect anomalies in hybrid data with millisecond-level latency under resource constraints, while preserving basic safety functions even during network failures or attacks on central servers.

“This design allows the system to detect anomalies in hybrid data with millisecond-level latency under resource constraints, while preserving basic safety functions even during network failures or attacks on central servers.”

They applied knowledge distillation and 8-bit quantization to reduce model size and computational load, enabling deployment at the edge.

“They further applied knowledge distillation and 8-bit quantization to reduce model size and computational load, enabling deployment at the edge.”

The dataset distribution for reconstruction-error-based anomaly detection studies shows a strong reliance on a limited set of public process benchmarks (SWaT, HAI, BATADAL, and TE) supplemented by a small number of custom-built CAN fieldbus and wind-turbine SCADA datasets.

“Finally, the dataset distribution again reveals a strong reliance on a limited set of public process benchmarks-SWaT, HAI, BATADAL, and TE-supplemented by a small number of custom-built CAN fieldbus and wind-turbine SCADA datasets [77,79,81-83,85-87].”

Hybrid frameworks such as CNN-LSTM edge detectors and AE + IF + tree-based ensembles fuse reconstruction error with isolation-based scores, temporal features, or event/log information to improve robustness and reduce false positives under realistic operating variability.

“Hybrid frameworks such as CNN-LSTM edge detectors and AE + IF + tree-based ensembles fuse reconstruction error with isolationbased scores, temporal features, or event/log information to improve robustness and reduce false positives under realistic operating variability [85,87].”

Lightweight and quantized AE/CNN-LSTM models deployed at edge gateways can provide millisecond-level anomaly scoring while offloading complex diagnosis and attack-type classification to the cloud, enabling hierarchical detection in resource-constrained CPS environments.

“Lightweight and quantized AE/CNN-LSTM models deployed at edge gateways can provide millisecond-level anomaly scoring while offloading complex diagnosis and attack-type classification to the cloud, enabling hierarchical detection in resourceconstrained CPS environments [83,85].”