Multi-Feature Hybrid Anomaly Detection in ICS: An Integration of ML, DL, and Statistical Techniques
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Aslam et al. [87] proposed a multi-feature hybrid anomaly detection framework that combines Autoencoder (AE), Isolation Forest (IF), XGBoost, Random Forest, and LSTM, using the SWaT and wind-turbine SCADA datasets.
“Aslam et al. [87] proposed a multi-feature hybrid anomaly detection framework that combines Autoencoder (AE), Isolation Forest (IF), XGBoost, Random Forest, and LSTM, using the SWaT and wind-turbine SCADA datasets.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [87]
This approach mitigates the high false-positive rates and limited spatiotemporal pattern-capturing capability of single statistical, ML, or DL models.
“This approach mitigates the high false-positive rates and limited spatiotemporal patterncapturing capability of single statistical, ML, or DL models.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [87]
Hybrid frameworks such as CNN-LSTM edge detectors and AE + IF + tree-based ensembles fuse reconstruction error with isolation-based scores, temporal features, or event/log information to improve robustness and reduce false positives under realistic operating variability.
“Hybrid frameworks such as CNN-LSTM edge detectors and AE + IF + tree-based ensembles fuse reconstruction error with isolationbased scores, temporal features, or event/log information to improve robustness and reduce false positives under realistic operating variability [85,87].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [87]
The dataset distribution for reconstruction-error-based anomaly detection studies shows a strong reliance on a limited set of public process benchmarks (SWaT, HAI, BATADAL, and TE) supplemented by a small number of custom-built CAN fieldbus and wind-turbine SCADA datasets.
“Finally, the dataset distribution again reveals a strong reliance on a limited set of public process benchmarks-SWaT, HAI, BATADAL, and TE-supplemented by a small number of custom-built CAN fieldbus and wind-turbine SCADA datasets [77,79,81-83,85-87].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [87]
This necessitates careful design of feature selection, mode handling, and adaptive thresholding, as well as periodic model updates, to avoid an excessive false-positive burden in real deployments.
“This necessitates careful design of feature selection, mode handling, and adaptive thresholding, as well as periodic model updates, to avoid an excessive false-positive burden in real deployments [77,79,83,86,87].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [87]
Reconstruction-error-based methods are particularly effective for detecting sensor/actuator faults, false data injection, command manipulation, and generic injection-type attacks that cause local or global distortions in multivariate process trajectories.
“First, these methods are particularly effective for detecting sensor/actuator faults, false data injection, command manipulation, and generic injection-type attacks that cause local or global distortions in multivariate process trajectories [77,79,81-83,86,87].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [87]
Autoencoder-like models (AE, VAE, OC-NN) and PCA-based approaches can flag process states that lie outside the learned normal manifold, including zero-day attack scenarios that were not explicitly seen during training.
“By learning a compact representation of normal operating conditions and monitoring reconstruction error or boundary-based anomaly scores, autoencoder-like models (AE, VAE, OC-NN) and PCA-based approaches can flag process states that lie outside the learned normal manifold, including zero-day attack scenarios that were not explicitly seen during training [77,79,81-83,86,87].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [87]
Cites
XGBoost: A Scalable Tree Boosting System
Chen, T., & Guestrin, C. (2016) · Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining · doi:10.1145/2939672.2939785 · Cited by 54,569 · see citing works
Anomaly Detection in Cyber Physical Systems Using Recurrent Neural Networks
Goh, J., Adepu, S., Tan, M., & Lee, Z. S. (2017) · IEEE International Symposium on High Assurance Systems Engineering (HASE) · doi:10.1109/hase.2017.36 · Cited by 447 · see citing works
Cybersecurity for industrial control systems: A survey
Bhamare, D., Zolanvari, M., Erbad, A., Jain, R., Khan, K., & Meskin, N. (2020) · Computers & Security · doi:10.1016/j.cose.2019.101677 · Cited by 394 · see citing works
Multimodal Industrial Anomaly Detection via Hybrid Fusion
Wang, Y., Peng, J., Zhang, J., Yi, R., Wang, Y., & Wang, C. (2023) · 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr52729.2023.00776 · Cited by 246 · see citing works
Zero-day attack detection: a systematic literature review
Ahmad, R., Alsmadi, I. M., Al-Hamdani, W. A., & Tawalbeh, L. (2023) · Artificial Intelligence Review · doi:10.1007/s10462-023-10437-z · Cited by 207 · see citing works
Zhou, C., Huang, S., Xiong, N. N., Yang, S., Li, H., Qin, Y., & Li, X. (2015) · IEEE Transactions on Systems Man and Cybernetics Systems · doi:10.1109/tsmc.2015.2415763 · Cited by 168 · see citing works
Hao, W., Yang, T., & Yang, Q. (2023) · IEEE Transactions on Automation Science and Engineering · doi:10.1109/tase.2021.3073396 · Cited by 143 · see citing works
CANnolo: An Anomaly Detection System Based on LSTM Autoencoders for Controller Area Network
Longari, S., Valcarcel, D. H. N., Zago, M., Carminati, M., & Zanero, S. (2020) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2020.3038991 · Cited by 137 · see citing works
Anomaly detection in Industrial Control Systems using Logical Analysis of Data
Das, T. K., Adepu, S., & Zhou, J. (2020) · Computers & Security · doi:10.1016/j.cose.2020.101935 · Cited by 124 · see citing works
A Survey of Graph-Based Deep Learning for Anomaly Detection in Distributed Systems
Pazho, A. D., Noghre, G. A., Purkayastha, A. A., Vempati, J., Martin, O., & Tabkhi, H. (2023) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2023.3282898 · Cited by 110 · see citing works
Data clustering-based anomaly detection in industrial control systems
Kiss, I., Genge, B., Haller, P., & Sebestyen, G. (2014) · IEEE International Conference on Intelligent Computer Communication and Processing (ICCP) · doi:10.1109/iccp.2014.6937009 · Cited by 107 · see citing works
HoneyPLC: A Next-Generation Honeypot for Industrial Control Systems
López-Morales, E., Rubio-Medrano, C. E., Doupé, A., Shoshitaishvili, Y., Wang, R., Bao, T., & Ahn, G. (2020) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3372297.3423356 · Cited by 91 · see citing works
A hybrid methodology for anomaly detection in Cyber–Physical Systems
Jeffrey, N., Tan, Q., & Villar, J. R. (2023) · Neurocomputing · doi:10.1016/j.neucom.2023.127068 · Cited by 90 · see citing works
Raman, M. R. G., Ahmed, C. M., & Mathur, A. P. (2021) · Cybersecurity · doi:10.1186/s42400-021-00095-5 · Cited by 80 · see citing works
Anomaly Detection for Industrial Control Systems Using Sequence-to-Sequence Neural Networks
Kim, J., Yun, J.-H., & Kim, H. C. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-42048-2_1 · Cited by 72 · see citing works
DAICS: A Deep Learning Solution for Anomaly Detection in Industrial Control Systems
Abdelaty, M. F., Doriguzzi-Corin, R., & Siracusa, D. (2021) · IEEE Transactions on Emerging Topics in Computing · doi:10.1109/tetc.2021.3073017 · Cited by 65 · see citing works
E-SFD: Explainable Sensor Fault Detection in the ICS Anomaly Detection System
Hwang, C., & Lee, T. (2021) · IEEE Access · doi:10.1109/access.2021.3119573 · Cited by 62 · see citing works
An anomalous sound detection methodology for predictive maintenance
Fiore, E., Ferraro, A., Galli, A., Moscato, V., & Sperlí, G. (2022) · Expert Systems with Applications · doi:10.1016/j.eswa.2022.118324 · Cited by 52 · see citing works
Anomaly Detection in ICS Datasets with Machine Learning Algorithms
Mubarak, S., Habaebi, M. H., Islam, M. R., Rahman, F. D. A., & Tahir, M. (2021) · Computer Systems Science and Engineering · doi:10.32604/csse.2021.014384 · Cited by 37 · see citing works
Deep learning and ensemble methods for anomaly detection in ICS security
Hossain, M. A., Hasan, T., Karovič, V., Abdeljaber, H. A. M., Haque, M. A., Ahmad, S., Zafar, A., Nazeer, J., & Mishra, B. K. (2024) · International Journal of Information Technology · doi:10.1007/s41870-024-02299-7 · Cited by 30 · see citing works
Liu, Q., Jiménez, M., Inda, M. E., Riaz, A., Zirtiloglu, T., Chandrakasan, A. P., Lu, T. K., Traverso, G., Nadeau, P., & Yazicigil, R. T. (2022) · IEEE Journal of Solid-State Circuits · doi:10.1109/jssc.2022.3197465 · Cited by 26 · see citing works
Attributions for ML-based ICS Anomaly Detection: From Theory to Practice
Fung, C., Zeng, E., & Bauer, L. (2024) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2024.23216 · Cited by 19 · see citing works
Implementation of rule-based information systems for integrated manufacturing
Harhalakis, G., Lin, C., Mark, L., & Muro‐Medrano, P. R. (1994) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/69.334880 · Cited by 18 · see citing works
Anomaly Detection of ICS Communication Using Statistical Models
Burgetová, I., Matoušek, P., & Ryšavý, O. (2021) · International Conference on Network and Service Management (CNSM) · doi:10.23919/cnsm52442.2021.9615510 · Cited by 16 · see citing works
GNN-based Advanced Feature Integration for ICS Anomaly Detection
Lu, S., Wang, K., Wei, Y., Liu, H., Fan, Q., & Wang, B. (2023) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3620676 · Cited by 15 · see citing works
Li, J. Z., Deng, X., & Yao, B. (2025) · Expert Systems with Applications · doi:10.1016/j.eswa.2025.126573 · Cited by 14 · see citing works
Anomaly detection for ICS based on deep learning: a use case for aeronautical radar data
de Riberolles, T., Zou, Y., Silvestre, G., Lochin, E., & Song, J. (2022) · Annals of Telecommunications · doi:10.1007/s12243-021-00902-7 · Cited by 13 · see citing works
Targeted Attack Synthesis for Smart Grid Vulnerability Analysis
Maiti, S., Balabhaskara, A., Adhikary, S., Koley, I., & Dey, S. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3623155 · Cited by 12 · see citing works
RRCNN: Request Response-Based Convolutional Neural Network for ICS Network Traffic Anomaly Detection
Du, Y., Zhang, S., Wan, G., Zhou, D., Lu, J., Huang, Y., Cheng, X., Zhang, Y., & He, P. (2023) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2023.035919 · Cited by 8 · see citing works
IMG: Deep Representation Graph Learning for Anomaly Detection in Industrial Control System
Ge, B., Bao, J., Li, B., Mou, X., Zhao, J., & Liu, X. (2024) · Journal of Signal Processing Systems · doi:10.1007/s11265-024-01923-w · Cited by 5 · see citing works
Wind Turbine SCADA Data For Early Fault Detection
Gück, C., Wang, Z., & Kühn, M. (2024) · Kaggle · doi:10.34740/kaggle/dsv/9697165 · Cited by 1 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Seo, J. K., Lee, J., Kim, B., Shim, W., & Seo, J. T. (2025) · Electronics · doi:10.3390/electronics15010020 · Cited by 15 · see citing works
Aslam, M. M., Tufail, A., Ding, Y., Silva, L. C. D., Apong, R. A. A. H. M., & Zuhairi, M. F. (2026) · Technologies · doi:10.3390/technologies14050267 · Cited by 1 · see citing works
Self-citationSoK: Hospital Medical Devices as Industrial Control Systems (ICS) - Exposure and Vulnerability
Bailey, J. M., Yurcik, W. J., Saydjari, O. S., Avelino, R. D. S., Vieira, J. L., Umbelino, P., & Pluta, G. (2025) · Annual Computer Security Applications Conference Workshops (ACSAC Workshops) · doi:10.1109/acsacw69556.2025.00018
Ghosh, M., Meshram, A., Karch, M., Haas, C., Zhang, X., & Singh, M. (2026) · ACM Workshop on Cyber-Physical System Security (CPSS) · doi:10.1145/3775042.3807884
- Authors
- Aslam, M. M., Tufail, A., De Silva, L. C., & Apong, R. A. A. H. M.
- Affiliations
- Universiti Brunei Darussalam (BN)
- School of Digital Science, Universiti Brunei Darussalam, Brunei Darussalam, Bandar, Brunei Darussalam
- ORCID
- Venue
- Proceedings of the 3rd ACM Workshop on Secure and Trustworthy Deep Learning Systems
- Publisher
- ACM
- Published
- 2025-08-24
- Pages
- 43-51
- OpenAlex
- W4413061087
- Cited by
- 4
- References
- 32
- Citations by year
- 2026: 2 · 2025: 2
- FWCI
- 4.21
- Type
- conference paper
- Language
- en
- Open access
- closed
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Physical Sciences › Engineering › Biomedical Engineering › Artificial Immune Systems Applications
- Keywords
- anomaly detection, industrial control systems, hybrid detection, multi-feature fusion, machine learning, deep learning, statistical techniques, cybersecurity
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
