CoChat
Sign Up
Cited by 5Network Security and Intrusion DetectionSmart Grid Security and ResilienceArtificial Immune Systems Applications

The DOI matches its Crossref record; 32 of the 32 references it cites were found in a registry or an index.

RHAD: A Reinforced Heterogeneous Anomaly Detector for Robust Industrial Control System Security

Open access
Han, Xiaopeng, Niu, Yukun, Cao, Zhigang, Zhou, Ding, Liu, Bo·2025·Electronics
DOI 10.3390/electronics14122440
Open this paper in CoChat — free accountOpen PDF

Abstract

Industrial Control Systems (ICS) are increasingly targeted by sophisticated and evolving cyberattacks, while conventional static defense mechanisms and isolated intrusion detection models often lack the robustness required to cope with such dynamic threats. To overcome these limitations, we propose RHAD (Reinforced Heterogeneous Anomaly Detector), a resilient and adaptive anomaly detection framework specifically designed for ICS environments. RHAD combines a heterogeneous ensemble of detection models with a confidence-aware scheduling mechanism guided by reinforcement learning (RL), alongside a time-decaying sliding window voting strategy to enhance detection accuracy and temporal robustness. The proposed architecture establishes a modular collaborative framework that enables dynamic and fine-grained protection for industrial network traffic. At its core, the RL-based scheduler leverages the Proximal Policy Optimization (PPO) algorithm to dynamically assign model weights and orchestrate container-level executor replacement in real time, driven by network state observations and runtime performance feedback. We evaluate RHAD using two publicly available ICS datasets—SCADA and WDT—achieving 99.19% accuracy with an F1-score of 0.989 on SCADA, and 98.35% accuracy with an F1-score of 0.987 on WDT. These results significantly outperform state-of-the-art deep learning baselines, confirming RHAD’s robustness under class imbalance conditions. Thus, RHAD provides a promising foundation for resilient ICS security and shows strong potential for broader deployment in cyber-physical systems.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.3390/electronics14122440

Cites

32 of 32 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Han et al. [132] used SCADA and WDT (Water Distribution Testbed) datasets, and RHAD fuses network traffic, control commands, and sensor measurements to learn interdependent anomaly patterns across cyber-physical layers.

    “Using SCADA and WDT (Water Distribution Testbed) datasets, RHAD fuses network traffic, control commands, and sensor measurements to learn interdependent anomaly patterns across cyber-physical layers.”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [132]

    Section 3.2 confirms that RHAD was evaluated on SCADA and Water Distribution Testbed (WDT) datasets. Section 2.2 describes combining raw traffic with statistical features, while Section 2.1 describes fusion of model outputs. The paper does not establish that RHAD specifically fuses network traffic, control commands, and sensor measurements to learn interdependent patterns across cyber-physical layers. Page numbers were not provided in our copy. (LLM, conf=0.86)

    Experimental — accuracy not yet measured

  • Some hybrid data fusion works couple fused anomaly scores with higher-level decision modules-such as attack-stage modeling, ATT&CK-based threat mapping, or reinforcement learning-based model selection-so that hybrid data directly drives mitigation policies and adaptive defense strategies in real time.

    “Third, some works couple fused anomaly scores with higher-level decision modules-such as attack-stage modeling, ATT&CK-based threat mapping, or reinforcement learning-based model selection-so that hybrid data directly drives mitigation policies and adaptive defense strategies in real time [128,131,132].”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [132]

    Split into 2 atoms — 0 confirmed, 2 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

    Experimental — accuracy not yet measured

  • Han et al. [132]'s framework combines multiple detection models-FlowTransformer, LSTM-AE, CNNAttention, Random Forest, SVM-in parallel and employs a PPO-based reinforcement-learning scheduler to dynamically adjust model-specific weights and reliabilities, with final decisions derived via temporal-weighted voting.

    “The framework combines multiple detection models-FlowTransformer, LSTM-AE, CNNAttention, Random Forest, SVM-in parallel and employs a PPO-based reinforcementlearning scheduler to dynamically adjust model-specific weights and reliabilities, with final decisions derived via temporal-weighted voting.”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [132]

    Sections 2.3 and 2.4 support PPO-based adjustment of model weights and confidence- and time-weighted voting; Section 4.1 says RHAD runs heterogeneous models in parallel. But Section 4.1 presents FlowTransformer, LSTM-AE, CANet, RF, and SVM as comparison baselines, not explicitly as the five models combined in RHAD. The paper calls the attention model CANet rather than CNNAttention. (LLM, conf=0.85)

    Experimental — accuracy not yet measured

  • Han et al. [132] proposed RHAD (Reinforced Heterogeneous Anomaly Detector), a reinforcement-learning-based anomaly detection framework that integrates heterogeneous multi-domain data to enhance ICS security robustness.

    “Han et al. [132] proposed RHAD (Reinforced Heterogeneous Anomaly Detector), a reinforcement-learning-based anomaly detection framework that integrates heterogeneous multi-domain data to enhance ICS security robustness.”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [132]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Flagged first, then by citations

Research works printed but not linked: 1

  1. Case, 2016, Analysis of the cyber attack on the Ukrainian power grid, Electr. Inf. Shar. Anal. Cent. (E-ISAC), 388, 3

Cited by

Sorted by citations

Related

Metadata

Authors
Han, X., Niu, Y., Cao, Z., Zhou, D., & Liu, B.
Affiliations
Purple Mountain Laboratories (CN)
Corresponding author
  • Cao, Zhigang
  • Zhou, Ding
ORCID
Venue
Electronics
Publisher
MDPI AG
Published
2025-06-16
Volume
14
Issue
12
Pages
2440
ISSN
2079-9292 (ISSN-L)
DOI
10.3390/electronics14122440
OpenAlex
W4411353006
Cited by
5
References
32
Citations by year
2026: 4 · 2025: 1
FWCI
2.11
Type
journal article
Language
en
Open access
Licence
Locations
Electronics (publishedVersion, cc-by)
Funders
  • National Key R&D Program of China (2022YFB3104300, BK20240292)
  • Jiangsu Provincial Natural Science Foundation of China (2022YFB3104300, BK20240292)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
  • Physical Sciences › Computer Science › Artificial Intelligence › Artificial Immune Systems Applications
Keywords
industrial cybersecurity, anomaly detection, reinforcement learning, heterogeneous ensemble, proximal policy optimization, SCADA, class imbalance, cyber-physical systems

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review