The DOI matches its Crossref record; 14 of the 14 references it cites were found in a registry or an index.
A physical signal-based anomaly detection for industrial terminal
Open accessAbstract
With the development of industry, industrial control systems are widely used in critical infrastructures. As one of the most significant components, the industrial terminals include Programmable Logic Controller, Distributed Control Systems, Remote Terminal Unit, and etc. Attacks against industrial terminals can cause catastrophic damage since they are directly related to business in the field. Unfortunately, traditional protection methods, such as intrusion detection systems and antivirus software, are not applicable to industrial terminals which are resource-constrained. In this paper, we propose an anomaly detection method for industrial controllers based on physical signals. The basic idea is to detect abnormal execution in a industrial terminal through analyzing its physical signals, including system power consumption and CPU usage. To effectively analyze the physical signals, a Transformer-based neural network is trained on the time series dataset to predict the next normal physical signals. The abnormal execution is detected by comparing the predicted signals and actual ones. We evaluate the proposed method on a real world dataset collected from a smart grid terminal, and the results show that the detection accuracy is over 97%.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“First, they deliberately move beyond conventional network and process data to monitor artifacts that are closer to the root cause of cyber-physical compromise-such as PLC control logic structure, acoustic side-channel signals, host-level physical resource usage, and power-consumption traces-thereby covering attack surfaces that packet- or sensor-centric detectors inherently miss [142-146].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [145]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“This makes it possible to detect semantically stealthy or encrypted attacks by flagging violations of these auxiliary consistency relations, even when primary cyber channels are partially hidden or manipulated [142,144-146].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [145]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Third, most approaches are designed as lightweight, mostly unsupervised endpoint monitors that can operate on resource-constrained devices or external side channels without requiring deep modifications to existing control networks, suggesting a practical way to complement network- and process-based IDS in real deployments [142,145,146].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [145]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“During runtime, if the L2 error between predicted and observed signals exceeded a predefined threshold, the terminal was classified as executing anomaly code, experiencing a crash, or operating in an anomalous state.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [145]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Recognizing that resource-constrained industrial devices (PLC, DCS, RTU) cannot host traditional IDS or antivirus solutions, the authors trained a Transformer-based time-series predictor solely on normal operational data to forecast future physical signals.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [145]
Experimental — accuracy not yet measured
The cited source says what the claim attributes to it.
In the citing paper
“In a smart-grid industrial terminal environment, Mei et al. [145] collected fivedimensional physical signals-power consumption, CPU idle time, CPU occupancy rate, interrupt counts, and system call counts-at one-second intervals and proposed a physicalsignal-based anomaly detection approach.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [145]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
August, W. U., Moore, D., Voelker, G. M., & Savage, S. (2004) · IEEE Security & Privacy · doi:10.1109/msp.2004.9 · Cited by 1,519
Enhancing the Locality and Breaking the Memory Bottleneck of Transformer on Time Series ForecastingPreprint
Li, S., Jin, X., Xuan, Y., Zhou, X., Chen, W., Wang, Y.-X., & Yan, X. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1907.00235 · Cited by 1,414
Kushner, D. (2013) · IEEE Spectrum · doi:10.1109/mspec.2013.6471059 · Cited by 638
Lightweight Classification of IoT Malware Based on Image Recognition
Su, J., Vasconcellos, V. D., Prasad, S., Sgandurra, D., Feng, Y., & Sakurai, K. (2018) · IEEE Annual International Computer Software and Applications Conference (COMPSAC) · doi:10.1109/compsac.2018.10315 · Cited by 351
Critical infrastructure protection: Requirements and challenges for the 21st century
Alcaraz, C., & Zeadally, S. (2014) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2014.12.002 · Cited by 340
Industrial Control System Network Intrusion Detection by Telemetry Analysis
Ponomarev, S., & Atkison, T. (2015) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2015.2443793 · Cited by 147
Nazari, A., Sehatbakhsh, N., Alam, M., Zajic, A. G., & Prvulović, M. (2017) · Proceedings - International Symposium on Computer Architecture/Proceedings · doi:10.1145/3079856.3080223 · Cited by 111
Watch Me, but Don't Touch Me! Contactless Control Flow Monitoring via Electromagnetic Emanations
Han, Y., Etigowni, S., Liu, H., Zonouz, S., & Petropulu, A. P. (2017) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3133956.3134081 · Cited by 107
Sun, H., Wang, X., Buyya, R., & Su, J. (2016) · Software Practice and Experience · doi:10.1002/spe.2420 · Cited by 102
On Code Execution Tracking via Power Side-Channel
Liu, Y., Wei, L., Zhou, Z. G., Zhang, K., Xu, W., & Xu, Q. (2016) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2976749.2978299 · Cited by 91
Research works printed but not linked: 9
- Shane S. Clark Benjamin Ransford Amir Rahmati Shane Guineau Jacob M. Sorber Wenyuan Xu and Kevin Fu. 2013. WattsUpDoc: Power Side Channels to Nonintrusively Discover Untargeted Malware on Embedded Medical Devices. In HealthTech. https://api.semanticscholar.org/CorpusID:1304726
- Alexander Gostev. 2012. The Flame: Questions and Answers. Securelist (2012).
- Dave Lee. 2012. Flame: Massive cyber-attack discovered, researchers say. BBC News 5, 28 (2012), 2012.
- Matti Mantere, Ilkka Uusitalo, Mirko Sailio, and Sami Noponen. 2012. Challenges of Machine Learning Based Monitoring for Industrial Control System Networks. 2012 26th International Conference on Advanced Information Networking and Applications Workshops (2012), 968–972. https://api.semanticscholar.org/CorpusID:10450597
- Yong Peng, Chong Xiang, Haihui Gao, Dongqing Chen, andWang Ren. 2015. Industrial Control System Fingerprinting and Anomaly Detection. In Critical Infrastructure Protection. https://api.semanticscholar.org/CorpusID:13624144
- Jill Slay and Michael Miller. 2007. Lessons Learned from the Maroochy Water Breach. In Critical Infrastructure Protection. https://api.semanticscholar.org/CorpusID:2517075
- 10.5555/2206293 · DOI
- Ashish Vaswani Noam M. Shazeer Niki Parmar Jakob Uszkoreit Llion Jones Aidan N. Gomez Lukasz Kaiser and Illia Polosukhin. 2017. Attention is All you Need. In NIPS. https://api.semanticscholar.org/CorpusID:13756489
- Han, Yi, Matthew Chan, Zahra Aref, Nils Ole Tippenhauer and S. Zonouz. “Hiding in Plain Sight? On the Efficacy of Power Side Channel-Based Control Flow Monitoring.” USENIX Security Symposium (2022).
Cited by
Sorted by citations
Seo, J. K., Lee, J., Kim, B., Shim, W., & Seo, J. T. (2025) · Electronics · doi:10.3390/electronics15010020 · Cited by 15
Yu, Z. H., Pei, J., & Zhu, M. (2025) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2025.3621208
Metadata
- Authors
- Mei, W., Liu, W., Chen, J., & Li, K.
- Affiliations
- State Grid Corporation of China (China) (CN)
- NARI Group (China) (CN)
- State Grid Shandong Electric Power Company (China) (CN)
- Venue
- Proceedings of the 2023 7th International Conference on Electronic Information Technology and Computer Engineering
- Publisher
- ACM
- Published
- 2023-10-20
- Pages
- 651-658
- OpenAlex
- W4394898112
- Cited by
- 2
- References
- 13
- Citations by year
- 2025: 2
- FWCI
- 0.60
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- International Conference on Electronic Information Technology and Computer Engineering (EITCE) (publishedVersion)
- Funders
- State Grid Corporation of China (Grand No. 5700-202358294A-1-1-ZN)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Keywords
- anomaly detection, physical signals, power consumption, CPU utilization, transformer models, time series forecasting, smart grid, industrial control systems, resource-constrained devices, cyberattack detection
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
