CoChat
Sign Up
Cited by 81Network Security and Intrusion DetectionInternet Traffic Analysis and Secure E-votingAdversarial Robustness in Machine Learning

Machine Learning for DDoS Attack Detection in Industry 4.0 CPPSs

Open access
Saghezchi, Firooz B., Mantas, Georgios, Violas, Manuel A., de Oliveira Duarte, A. Manuel, Rodriguez, Jonathan·2022·Electronics
DOI 10.3390/electronics11040602
Open this paper in CoChat — free accountOpen PDF

Abstract

The Fourth Industrial Revolution (Industry 4.0) has transformed factories into smart Cyber-Physical Production Systems (CPPSs), where man, product, and machine are fully interconnected across the whole supply chain. Although this digitalization brings enormous advantages through customized, transparent, and agile manufacturing, it introduces a significant number of new attack vectors—e.g., through vulnerable Internet-of-Things (IoT) nodes—that can be leveraged by attackers to launch sophisticated Distributed Denial-of-Service (DDoS) attacks threatening the availability of the production line, business services, or even the human lives. In this article, we adopt a Machine Learning (ML) approach for network anomaly detection and construct different data-driven models to detect DDoS attacks on Industry 4.0 CPPSs. Existing techniques use data either artificially synthesized or collected from Information Technology (IT) networks or small-scale lab testbeds. To address this limitation, we use network traffic data captured from a real-world semiconductor production factory. We extract 45 bidirectional network flow features and construct several labeled datasets for training and testing ML models. We investigate 11 different supervised, unsupervised, and semi-supervised algorithms and assess their performance through extensive simulations. The results show that, in terms of the detection performance, supervised algorithms outperform both unsupervised and semi-supervised ones. In particular, the Decision Tree model attains an Accuracy of 0.999 while confining the False Positive Rate to 0.001.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.3390/electronics11040602

Cites

45 of 45 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Supervised statistical classifiers tend to achieve high accuracy when ample labeled attack data are available, whereas unsupervised and semi-supervised methods offer better robustness to previously unseen or zero-day attacks at the expense of slightly lower nominal accuracy.

    “Supervised statistical classifiers tend to achieve high accuracy when ample labeled attack data are available [13,15,17,20,23,25,32,34], whereas unsupervised and semi-supervised methods offer better robustness to previously unseen or zero-day attacks at the expense of slightly lower nominal accuracy [17,20,21,25,28,34].”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [20]

    Split into 2 atoms — 1 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

    Experimental — accuracy not yet measured

  • Deep architectures such as DAE, DAGMM, GCNN, and LSTM-based hybrids are mainly beneficial when modeling nonlinear feature interactions or temporal dependencies, but they can be sensitive to preprocessing choices and class imbalance, sometimes exhibiting complementary false-positive/false-negative patterns compared with simpler models.

    “Deep architectures such as DAE, DAGMM, GCNN, and LSTM-based hybrids are mainly beneficial when modeling nonlinear feature interactions or temporal dependencies [13,15,17,21,23,29], but they can be sensitive to preprocessing choices and class imbalance, sometimes exhibiting complementary false-positive/falsenegative patterns compared with simpler models [20,21,28].”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [20]

    Split into 2 atoms — 0 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 1 unverifiable. Expand the claim to see per-atom verdicts.

    Experimental — accuracy not yet measured

  • Classical machine-learning classifiers often perform competitively on high-dimensional statistical feature spaces derived from NSL-KDD, UNSW-NB15, NF-BoT-IoT, IoT-23, and similar benchmarks.

    “Third, in terms of model behavior, the comparison across studies indicates that classical machine-learning classifiers often perform competitively on high-dimensional statistical feature spaces derived from NSL-KDD, UNSW-NB15, NF-BoT-IoT, IoT-23, and similar benchmarks [17,20,23,28,32,34].”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [20]

    The Introduction (p. 2) describes 45 extracted flow features, and the Conclusions (p. 11) report strong DDoS-detection results for decision trees, random forests, and k-nearest neighbors. But the study uses factory traffic and DDoSDB attack data, not feature spaces derived from the named benchmarks; it does not establish a comparison across those datasets. (LLM, conf=0.88)

    Experimental — accuracy not yet measured

  • Statistical network features can be extracted non-invasively from SPAN/TAP ports and scale naturally to large ICS/CPS deployments, providing a low-cost first line of defense.

    “These features can be extracted non-invasively from SPAN/TAP ports and scale naturally to large ICS/CPS deployments, providing a low-cost first line of defense [20,21,32].”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [20]

    Section 3.2 (p. 6) says the authors extracted statistical flow features from PCAP files, supporting the feature-extraction part of the claim. The paper does not establish extraction from SPAN/TAP ports, non-invasive operation, scalability to large deployments, or low cost. (LLM, conf=0.87)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 3

  1. [21]21. IEEE. IEEE Std C37.1-1994-IEEE Standard Definition, Specification and Analysis of Systems Used for Supervisory Control, Data Acquisition, and Automatic Control ; IEEE: Piscataway, NJ, USA, 1994.
  2. [22]22. Zhu, B.; Sastry, S. SCADA-Specific Intrusion Detection/Prevention Systems: A Survey and Taxonomy. In Proceedings of the 1st Workshop on SECURE Control Systems (SCS), Stockholm, Sweden, 12 April 2010; Volume 11, p. 7.
  3. [31]31. Barbosa, R.R.R.; Pras, A. Intrusion Detection in SCADA Networks BT-Mechanisms for Autonomous Management of Networks and Services ; Stiller, B., De Turck, F., Eds.; Springer: Berlin/Heidelberg, Germany, 2010; pp. 163-166.

Cited by

Sorted by citations

Related

Authors
Saghezchi, F. B., Mantas, G., Violas, M. A., de Oliveira Duarte, A. M., & Rodriguez, J.
Affiliations
  • Instituto de Telecomunicações (PT)
  • Instituto de Telecomunicações, University of Aveiro, Campus Universitário de Santiago, 3810-193 Aveiro, Portugal
  • University of Aveiro (PT)
  • Department of Electronics, Telecommunications and Informatics, University of Aveiro, Campus Universitário de Santiago, 3810-193 Aveiro, Portugal
Corresponding author
Saghezchi, Firooz B.
ORCID
Venue
Electronics
Publisher
MDPI AG
Published
2022-02-16
Volume
11
Issue
4
Pages
602
ISSN
2079-9292 (ISSN-L)
DOI
10.3390/electronics11040602
OpenAlex
W4212990994
Cited by
81
References
44
Citations by year
2026: 9 · 2025: 22 · 2024: 19 · 2023: 23 · 2022: 8
FWCI
7.99
Type
journal article
Language
en
Open access
Licence
Locations
  • Electronics (publishedVersion, cc-by)
  • Greenwich Academic Literature Archive (University of Greenwich) (acceptedVersion)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
Funders
H2020 ECSEL (692466 and 783119)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
Keywords
DDoS attack detection, cyber-physical production systems, Industry 4.0, network anomaly detection, Internet of Things security, network traffic features, semiconductor manufacturing, supervised learning, unsupervised learning, semi-supervised learning, decision tree, false positive rate

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review