The DOI matches its Crossref record; 5 of the 5 references it cites were found in a registry or an index.
Graph-Based Anomaly Detection in Industrial Control Systems
Abstract
In Industrial Control Systems (ICS), the number of targeted cyberattacks (APT) on critical infrastructure, such as Stuxnet and Industroyer, is increasing. Particularly concerning are complex attacks exploiting vulnerabilities in network protocols (e.g., Modbus, OPC UA) and affecting physical infrastructure, highlighting the need for enhanced protection methods and network intrusion detection systems (NIDS). Current research actively employs classical machine learning (ML) techniques for developing NIDS.In our research, we developed a model evaluated on the open CIC Modbus 2023 dataset and compared it to traditional ML models. The results demonstrated that our model effectively detects a wide range of modern attacks, achieving an F1-score of 0.98. Unlike sequence-based methods, our graph-based approach identifies meaningful patterns in flow relationships that traditional methods often miss.We also developed an automated digital forensics module using a Saliency map based on reconstruction error. This map helps identify the most critical elements (edges and nodes) of the graph for decision-making. The automation of forensics accelerates attack investigations, providing operators with efficient tools for incident analysis and interpretation.These results highlight the effectiveness of graph-based machine learning methods for enhancing ICS security and open new avenues for future research.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Graph-based models such as APPNP GCNs, heterogeneous GNN autoencoders, and hypergraph Kohonen maps can capture non-Euclidean correlations and higher-order neighborhood structures that are difficult to express with flat feature vectors [51,54,55].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [54]
In the citing paper
“First, by representing hosts, flows, services, and even events as nodes and edges, these methods are particularly suitable for detecting DDoS, reconnaissance, injection, and other multi-stage intrusions that manifest as abnormal communication patterns, rare paths, or sudden expansions in connectivity rather than only local feature changes [51,54,55].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [54]
In the citing paper
“Zeek-derived conn.log files are segmented into 5 min blocks, and flows are grouped by Modbus address, operation type, register count, and request status to form flow nodes. Sender and receiver devices are added as host nodes, constructing a heterogeneous graph with 'host →fl ow → host' directionality. The GNN autoencoder learns embeddings reflecting node/edge types and reconstructs node attributes”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [54]
In the citing paper
“Using the CIC Modbus 2023 dataset, Balaba et al. [54] proposed an unsupervised graphbased anomaly detection method that combines a host-connection heterogeneous graph with a GNN autoencoder.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [54]
In the citing paper
“the surveyed work highlights a trade-off between structural expressiveness and deployment complexity.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [54]
In the citing paper
“Constructing and maintaining communication graphs from live ICS/CPS traffic requires careful aggregation of flow logs, selection of node/edge types, and windowing, which introduce additional design choices and computational overhead at scale [51,54,55].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [54]
Citations
Cites
E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT
Lo, W. W., Layeghy, S., Sarhan, M., Gallagher, M. R., & Portmann, M. (2022) · IEEE/IFIP Network Operations and Management Symposium (NOMS) · doi:10.1109/noms54207.2022.9789878 · Cited by 526
Unveiling the potential of Graph Neural Networks for robust Intrusion Detection
Pujol-Perich, D., Suárez‐Varela, J., Cabellos‐Aparicio, A., & Barlet‐Ros, P. (2022) · ACM SIGMETRICS Performance Evaluation Review · doi:10.1145/3543146.3543171 · Cited by 142
Carrión, R. M., Urda, D., Díaz-Cano, I., & Dorronsoro, B. (2020) · Applied Sciences · doi:10.3390/app10051775 · Cited by 132
Securing Substations with Trust, Risk Posture, and Multi-Agent Systems: A Comprehensive Approach
Boakye-Boateng, K., Ghorbani, A. A., & Lashkari, A. H. (2023) · Conference on Privacy, Security and Trust · doi:10.1109/pst58708.2023.10320154 · Cited by 28
Miao, G., Wu, G., Zhang, Z., Tong, Y., & Lu, B. (2023) · Electronics · doi:10.3390/electronics12132763 · Cited by 8
Research works printed but not linked: 5
- 2024, Threat landscape for industrial automation systems
- 2024 report on the state of the cybersecurity in the union
- 2017, Threat landscape for industrial automation systems in h2
- Amer, 2024, Malicious behavioural detection in scada networks based on analyzing modbus/tcp functions sequences, Tcp Functions Sequences
- Hamilton, 2017, Inductive representation learning on large graphs, Advances in neural information processing systems, 30
Cited by
Sorted by citations
Seo, J. K., Lee, J., Kim, B., Shim, W., & Seo, J. T. (2025) · Electronics · doi:10.3390/electronics15010020 · Cited by 15
Metadata
- Authors
- Balaba, S., Chernyshov, Y., Skorohodov, A., & Komarov, D.
- Affiliations
- Ural Federal University (RU)
- ORCID
- Chernyshov, Yuri
- Venue
- 2025 IEEE Ural-Siberian Conference on Biomedical Engineering, Radioelectronics and Information Technology (USBEREIT)
- Publisher
- IEEE
- Published
- 2025-05-12
- Pages
- 233-236
- OpenAlex
- W4411950284
- Cited by
- 2
- References
- 5
- Citations by year
- 2026: 1 · 2025: 1
- FWCI
- 2.47
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- Ural Symposium on Biomedical Engineering, Radioelectronics and Information Technology (USBEREIT) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Artificial Intelligence › Artificial Immune Systems Applications
- Keywords
- industrial cybersecurity, network intrusion detection, graph anomaly detection, saliency maps, reconstruction error, digital forensics, attack investigation, network protocol vulnerabilities
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
