A Multi-Component Deep Learning Approach for Cyber Attack Detection in Critical Infrastructure SCADA Systems

A Multi-Component Deep Learning Approach for Cyber Attack Detection in Critical Infrastructure SCADA Systems | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Article A Multi-Component Deep Learning Approach for Cyber Attack Detection in Critical Infrastructure SCADA Systems Onur polat, Sümeyya BULUT This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-8628547/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract Industrial control networks based on Supervisory Control and Data Acquisition (SCADA) systems used in critical infrastructure systems require reliable, scalable, and generalisable attack detection mechanisms in the face of increasing cyber threats. However, a large portion of the datasets commonly used in the literature are based on general-purpose network traffic and do not adequately reflect the cyclical, deterministic, and process-oriented communication structure of industrial protocols such as Modbus/TCP. In this study, a completely isolated virtual SCADA environment was designed to address this limitation. A SCADA-specific, multi-class attack dataset called SCADANet has been created, containing nine different attack scenarios generated concurrently with legitimate network traffic. In this context, a hybrid deep learning architecture consisting of parallel dilated Convolutional Neural Network (CNN) structures, Residual-SE blocks, and Long Short-Term Memory (LSTM) layers, capable of modelling multi-scale spatial patterns and temporal dependencies together, has been recommended. To examine the generalisability of the proposed approach, the developed model was tested on both the SCADANet dataset and the WUSTL-IIoT-2021 dataset, which is widely used in the literature. Experimental results show that the proposed architecture achieves high accuracy and macro F1-score on both datasets, particularly demonstrating a significant increase in sensitivity in minority attack classes. Furthermore, the ablation study conducted reveals that each component in the architecture contributes meaningfully and complementarily to the overall performance. The findings demonstrate that the proposed deep learning-based approach can effectively model traffic characteristics specific to SCADA systems and exhibits stable attack detection performance across different data sources. In this respect, the study makes important methodological and experimental contributions to the literature on cyber attack detection in SCADA-based critical infrastructure systems. Physical sciences/Engineering Physical sciences/Mathematics and computing SCADA Security Anomaly Detection Critical Infrastructure Systems Hybrid Deep Learning Cyber Attack Detection Figures Figure 1 Figure 2 Figure 3 Figure 4 Figure 5 Figure 6 1. Introduction 1.1. The Importance of Critical Infrastructure Systems in Cyber Security Systems with critical infrastructure such as energy, healthcare, transportation, and financial services are essential and necessary for the natural flow of life. A large portion of such systems are managed using Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS) technologies [ 1 , 2 ]. There are numerous sensors and IoT devices within the system (Fig. 1 ). These types of devices create a data flow traffic that enables data exchange within the system. Data is collected in systems such as SCADA and ICS, and control processes are carried out. The ability to manage systems remotely creates a natural cybersecurity requirement within the system. To ensure the continuity of the services provided by critical infrastructure, the system must be protected against external attacks [ 3 ]. The devices within these critical infrastructure systems are highly interconnected. An attack on the system could potentially affect the entire system. A vulnerability in the system does not only cause a malfunction in the system. External factors connected to the system may also suffer damage [ 4 ]. For example, an attack on the electricity grid could halt electricity production. This would negatively affect hospitals, industrial enterprises, public services, traffic services, and many other processes that require electricity. The process can cause chaos, economic losses, and negatively impact the natural life cycle [ 5 ]. At the forefront of these threats are Denial of Service (DoS) attacks and Advanced Persistent Threats (APT). These attacks occur quite frequently, slowing down or obstructing the operation of the system [ 5 , 6 ]. 1.2. Cyber Threats Targeting SCADA Systems Cyber security is extremely important for critical infrastructure that includes SCADA and IDS systems. Detecting attacks on this infrastructure is more complex and difficult than detecting attacks on traditional environments [ 7 ]. Industrial systems lack inherent security features such as Modbus/TCP, encryption, authentication, and integrity checks. This makes such systems vulnerable to various attacks [ 8 ]. Security flaws in the system are seen as an opportunity by attackers, who inject commands that negatively impact communication flows [ 2 ]. Attacks are evolving daily, posing serious threats to the system. Advanced attack techniques such as Flood Attacks, Wrong Command Injection, and DoS attacks pose serious threats to industrial systems such as SCADA. In flood attacks, attackers corrupt Modbus/TCP packets to prevent the controller from interpreting commands or to cause unsafe scenarios [ 8 ]. In false command injection attacks, attackers attempt to inject commands by hiding behind repetitive responses from the SCADA operator. This can cause significant damage [ 2 ]. While traditional DoS attacks focus on disrupting the service on the system, protocol-specific DoS attacks focus on security vulnerabilities in Modbus/TCP protocols in order to disrupt communication [ 9 ]. The diversification of protocol-specific attacks highlights the necessity of significant detection mechanisms on SCADA traffic. 1.3. Challenges in Attack Detection in Critical Systems Attack and anomaly detection in systems such as SCADA and IDS presents various challenges. Examples include the need for real-time operation, low tolerance for false alarms, unbalanced data sets, detection of covert attacks, and the cost associated with high false alarm rates [ 10 ]. Delays in the system during an attack can cause significant interruptions. This situation can bring the system to a partial or complete standstill [ 11 ]. SCADA and IDS systems have low tolerance for false alarms due to their infrastructure. High false alarm rates can cause unnecessary interruptions. This leads to a waste of resources. In an environment where a SCADA system is present, data is unstable and multidimensional. This makes detecting unauthorised access difficult. Furthermore, the cost of false alarms in the system can lead to unnecessary interventions. A system with ineffective intrusion detection must balance detection accuracy with the cost implications of false alarms [ 12 , 13 ]. 1.4. Limitations of Traditional IDS Approaches Various detection and mitigation strategies exist for such attacks on systems. Examples include anomaly detection systems, Intrusion Detection Systems (IDS), and cryptographic systems. Approaches that monitor Modbus/TCP operations can detect abnormal traffic in anomaly detection. They can also respond quickly to DoS and command injection attacks [ 14 ]. Cryptographic systems can ensure that Modbus/TCP communications are sent with end-to-end confidentiality using encryption algorithms such as ASCON. IDS systems, on the other hand, adopt an anomaly detection-based approach [ 7 , 15 ]. Although various methods have been developed to detect cyber threats in systems, it is a very challenging process. Traditional Intrusion Detection Systems (IDS) are an important issue in network security. However, they are inadequate against advanced cyber threats. Signature-based detection systems, rule-based detection systems, and statistical methods in this type of detection system often fail to provide sufficient performance. Advanced techniques based on artificial intelligence and deep learning must be incorporated to address these limitations. Signature-based threats require signature-based IDs for detection. Predefined signatures are needed to detect threats. Previously encountered and documented attacks can be identified. These attacks demonstrate the system's ineffectiveness against zero-day attacks and new types of attacks that do not match existing signatures. Signature-based protection requires the system to be constantly updated. This creates a vulnerability in delayed update processes and implies limitations for this type of attack [ 16 ]. Attackers model these known attacks and circumvent them by making slight changes to render the system ineffective [ 17 ]. Rule-based systems act according to predefined rules and present an approach against threats. This creates a system that is vulnerable to complex and advanced attacks. Furthermore, networks expand day by day. In rule-based systems, new rules continue to increase for expanding networks. This situation causes a decrease in the scalability and performance of the network [ 18 ]. In statistical methods, there is fundamental network behaviour. Even if the network is well defined, it struggles in the face of evolving threats. It performs poorly against evolving threats. Consequently, it may misinterpret normal behaviour in network traffic. The false positive rate increases and may cause false negatives [ 19 ]. Statistical approaches lack contextual understanding in distinguishing between benign and malicious network traffic. Therefore, the likelihood of misclassification is higher [ 20 ]. 1.5. The Rise of Deep Learning-Based Approaches Traditional methods used in threat detection and attack identification within cybersecurity systems are proving inadequate in the face of increasing complexity. The search for more effective ways to detect attacks has led to studies focusing on deep learning and artificial neural network-based approaches, which have demonstrated success. Convolutional Neural Networks (CNN), Recurrent Neural Networks (RNN), Long Short-Term Memory (LSTM) networks, and hybrid deep learning (DL) models demonstrate more resilient approaches against emerging threats. The adaptability of these models, their high accuracy, and their ability to process various data types contribute significantly to the field of cybersecurity. These methods are prominent in processes such as unauthorised access detection, malware detection, and anomaly detection. Against cybersecurity threats, patterns in data packets can be identified using CNN architectures. This has enabled the creation of a detection system framework that can be adapted to network traffic [ 21 ]. This approach has been seen to achieve over 98% performance in network traffic with both binary and multi-class classification capabilities [ 22 ]. It is noted that CNNs effectively analyse network traffic modelling by leveraging the spatiality of the data [ 23 ]. Methods such as RNN and LSTM are highly effective in analysing data arranged in sequences. They are ideal methods for detecting attacks in unauthorised access detection systems for network traffic [ 24 , 25 ]. LSTMs have been shown to perform well in detecting cyber threats, achieving over 96% accuracy. Studies have also shown that they are superior to CNN in some cases [ 26 , 27 ]. Various hybrid methods combining techniques such as CNN and LSTM are used in the field of cyber security. Combining the strengths of CNN and LSTM yields high accuracy. They are more effective in detecting threats by processing spatial and temporal data. Accuracy rates above 98% in multi-classification studies using hybrid models demonstrate the importance of these methods [ 28 ]. 1.6. Motivation and Contributions of This Study There is a growing need for real-time systems with low false alarms in networks with SCADA and IDS-based critical infrastructure. Traditional security systems are inadequate against evolving attacks. Attackers embedding attacks within normal traffic flows and class imbalance in data sets further increase the need to research more effective methods. Advanced methods such as deep learning ensure not only high accuracy but also high sensitivity in classes with data imbalance. Therefore, new and effective deep learning models to be developed will be highly valuable for protecting such systems. This study proposes a SCADANet dataset that realistically represents different attack scenarios specific to SCADA. Furthermore, a hybrid deep learning architecture capable of modelling multi-scale and time dependencies well in attacks has been proposed. This work aims to contribute to the literature and fill an important gap. The contributions of this study can be summarised as follows: SCADA-specific SCADANet dataset A virtual environment has been created within a completely isolated environment with a SCADA-based structure. In this environment, Modbus/TCP and ICMP/HTTP, which are present in background traffic, have been generated together. The attack scenario has been generated concurrently and embedded within the normal network traffic flow. The dataset consists of normal traffic data and a dataset comprising 9 attacks (SYN/ACK/UDP/ICMP/HTTP Flood, SQLi, Port Scan, Vuln Scan, OS Scan). Flow richness Multi-layered attributes were extracted for raw packets on the network. JA4+-based fingerprint features capable of distinguishing attacks with particularly low volume in network traffic were obtained. Novel hybrid architecture Parallel dilated Conv1D was used to extract short- and long-range features in the SCADA system. A Residuan-SE block was added to increase representational power. A hybrid method that also learns time dependencies using LSTM was presented. A balanced approach to imbalanced data classes Despite data imbalance, a two-stage optimisation was applied using Focal Loss and class weights. This has ensured increased sensitivity in minority classes. Conductivity The proposed hybrid method was applied both to the created dataset and to the WUSTL-IIoT-2021 dataset [ 29 ], which is frequently used in the literature. This demonstrates that the hybrid method is not dependent on the dataset and is conductive. Robust evaluation metrics The training and test data in the dataset used in the study were evaluated using 5-fold cross-validation and accuracy, macro/weighted precision, recall, and F1 metrics. Furthermore, errors were detailed using confusion matrices. Model ablation study Results obtained when Dilated CNN, LSTM, and Res-SE were removed are presented, demonstrating the performance of the hybrid model. 2. Literature Review 2.1. Cyber Attacks Targeting SCADA and Industrial Control Systems Attacks against SCADA and IDS systems are increasing day by day. These attacks target different points within such systems. Each type of attack has its own target. Reconnaissance attacks gather information about the SCADA system and map its architectural structure. Weak points in the architecture are identified by scanning with network tools [ 30 ]. In command and measurement injection attacks, commands are sent to manipulate the system. These deceptive commands cause adverse behaviour in the system and can lead to physical damage and system interruptions. DoS attacks flood the system with unnecessary data traffic. This causes disruption to the services running on the system. They aim to render the system unusable due to protocol weaknesses [ 31 ]. Malicious software attacks attempt to gain unauthorised access. Once access is gained, data is stolen or used to interrupt operations [ 32 ]. Hijacking and blackout attacks focus on taking control of the system and shutting it down completely. Traditional IDS systems exploit protocol-based vulnerabilities [ 33 ]. Replay and fragmentation attacks focus on capturing data packets. These packets are resent, causing process interruptions [ 34 , 35 ]. Such attacks on the world cause various damages. Some of these attacks are summarised in Table 1 . Table 1 Some attacks on SCADA and ICS systems and their effects Name of Attack Target Attack Centre Year Country /Region Impact Stuxnet [ 36 ] SCADA/ICS Iran's Natanz Nuclear Facility 2010 Iran Physical damage and disruption of operations in centrifuges through manipulation of PLC/SCADA systems BlackEnergy (2015 Ukraine Power Grid) [ 37 ] SCADA/ICS Ukrainian Electricity Grid (transmission/distribution) 2015 Ukraine Power outages (affecting approximately 230,000 users) caused the remote SCADA system to shut down. Triton / Trisis [ 38 ] SCADA/ICS Triconex SIS in a petrochemical plant in the Middle East 2017 Middle East (Arabia) Security was disabled by targeting the SIS logic. Havex (Backdoor.Oldrea) [ 39 ] SCADA/ICS European energy companies 2013–2014 Europe (primarily the energy sector) Information gathered for reconnaissance—sabotage in ICS/OPC environments Dragonfly (Energetic Bear) [ 40 ] SCADA/ICS European & US energy companies 2010 Global (critical infrastructure/energy) Supply chain + spearphishing + drive-by to infiltrate and explore the system IDS Evasion via Fragroute [ 41 ] IDS General IDS systems 1998 / 2002 — Misinterpretation of traffic by IDS due to packet fragmentation/rewriting, etc., detection prevention Snort IDS Evasion [ 41 ] IDS Networks using Snort 1998+ — Due to differences such as reassembly/fragmentation, Snort risks missing some scenarios (if there is no correct pre-processor/normaliser). Shamoon [ 42 ] SCADA (indirect) Saudi Aramco (IT network; OT integrations may be affected) 2012 Saudi Arabia Widespread wiper effect; reports indicate that approximately 30,000 computers were affected. Attacks on SCADA and ICS systems, which cause physical and operational damage, are detailed in Table 1 . The extent of the damage these attacks cause to countries and people is evident. 2.2. Traditional SCADA Attack Detection Methods Attacks on SCADA and IDS systems cause significant physical and operational damage to the system. Various methods and approaches have been developed to prevent these attacks. Efforts to prevent and detect attacks on systems are documented in the literature as traditional detection methods, machine learning methods, deep learning-based methods, and hybrid methods. Among these methods, traditional attack detection includes signature-based intrusion detection systems (IDS), rule-based approaches, and anomaly-based statistical models. IDS-based systems are designed to prevent unauthorised access based on predefined patterns and signatures of known threats. It is an effective method for detecting known attacks. However, it is not successful in detecting new or unknown threats. They are preferred because they are simple and have a low false positive rate [ 43 ]. A study by Tripathi and colleagues indicated that zero-day attacks and new types of unauthorised access techniques, which are becoming widespread in SCADA systems, cannot be detected by traditional signature-based detection systems [ 44 ]. In rule-based detection systems, experts or past information are used to identify suspicious activities. In his study, Sayghe indicated that rule-based systems can be successful in certain operations [ 10 ]. Okpeseyi and colleagues, however, stated that rule-based systems are weak against evolving threats and that rules in such systems need to be constantly updated [ 13 ]. In statistical detection methods based on anomalies, deviations from normal behaviour patterns are taken into account. Statistical models and deviations are evaluated to define abnormal behaviour. Known attacks are not trusted for general purposes. Therefore, it provides better attack detection against new attacks compared to other traditional models. This approach appears to be slightly more suitable for dynamic environments such as SCADA [ 45 ]. Ahakonye and colleagues have stated that detection using statistical models in SCADA systems is a challenging process, as natural flows can be mistakenly perceived as threats. For this reason, they have demonstrated a tendency to produce false positives [ 46 ]. Traditional detection systems show that while it is possible to detect known attacks in the system, it is difficult to detect new types of attacks using such methods. 2.3. Machine Learning-Based SCADA Attack Detection Unlike traditional methods, machine learning methods are more successful in detecting attacks on SCADA systems. Various machine learning methods offer advantages. The literature includes machine learning methods that enable the detection of attacks on SCADA systems, such as Support Vector Machines (SVM), Decision Trees (DT), Random Forest, k-Nearest Neighbour (k-NN), and XGBoost. Patil demonstrated in his study that attacks on SCADA-based systems can be detected with a low error rate [ 47 ]. Sukhadeo et al. classified attacks using random forest and k-KNN on the NSL-KDD dataset [ 48 ]. Lee et al. achieved a result of 95% in detecting attacks in SCADA systems using SVM and XGBoost methods [ 49 ]. When the studies are examined, it is seen that feature extraction has a high impact on performance in machine learning-based detection. In another study employing various feature extractions, redundant fields were eliminated and generalisability was improved [ 49 ]. Overall, the achieved performance exceeds 90% in the studies conducted. Some examples of studies using machine learning methods are shown in Table 2 . Table 2 Studies conducted using various machine learning methods and feature selections. Method Feature Selection Rate of Success Number of Classes Description SVM [ 49 ] PCA %93.5 5 Linear SVM worked with high accuracy for normal and 4 attack classes in SCADA data SVM [ 50 ] Recursive FS %90.2 2 Binary classification (attack/normal) for industrial IDS; kernel-based SVM was used Random Forest [ 47 ] Information Gain %95.1 4 High performance with low overfitting on SCADA network traffic Random Forest [ 48 ] Chi-Square %97.3 5 NSL-KDD-based IDS design; robust against class imbalance k-NN [ 49 ] Correlation Based FS %92.4 4 Based on PLC data; the best results were obtained with k = 5 k-NN [ 51 ] Relief-F %94.2 3 More stable results with weighted distance metrics in the SCADA system XGBoost [ 52 ] Mutual Information %98.6 5 XGBoost delivered more stable and faster results than other models XGBoost[ 52 ] Random Feature Subset %96.8 6 Robust results against different types of attacks in SCADA power grid networks LightGBM[ 52 ] L1 Regularization %95.4 5 Similar accuracy with lower resource usage compared to XGBoost Studies conducted on machine learning methods have shown that they achieve higher performance than traditional methods. Research indicates that the most significant reason for this performance is due to feature selection. 2.4. Deep Learning-Based SCADA Security Solutions More advanced attack detection methods in SCADA-based systems are deep learning-based methods. These are known as Convolution Neural Network (CNN), Long-Short Term Memory (LSTM), Auto Encoder, and Transformer Models. CNN models are widely used for detection in such systems. They struggle with temporal dependencies in the data. However, they stand out due to their computational efficiency and speed [ 53 ]. LSTMs are particularly better at processing sequential data. This provides more effective learning in detecting related attacks. They require strong recall rates and computational resources [ 54 ]. It is noted that unsupervised methods based on autoencoders perform well in classification problems [ 55 ]. Transformer models, on the other hand, perform quite well in capturing long-term temporal dependencies and complex sequential data [ 56 ]. It is emphasised that each detection system using deep learning models is more effective on datasets with specific characteristics. Each deep learning-based method focuses on specific features within the system. This demonstrates that each model has its own unique structure (see Table 3 ). Table 3 Comparison of deep learning-based models used for attack detection in SCADA-based systems Perception Accuracy Efficiency Performance Temporal-Spatial Feature Extraction False Positive/Negative Rates Transformers demonstrate superior performance to CNNs and RNNs in terms of accuracy and generalisation [ 56 ] Transformer optimised for low-latency inference Transformers capture long-range dependencies better than RNN/CNN Low false positive and false negative rates CNN demonstrates superior performance to other DL models across multiple datasets [ 57 ] Suitable efficiency for CNN CNN is effective for spatial features; attention mechanisms included False positive rates considered in the evaluation 1D CNN and RNN demonstrate better performance than traditional ML in anomaly detection [ 58 ] 1D CNNs are preferred for long sequences due to their efficiency 1D CNN replaces RNN for spatio-temporal features Improved false positive rates compared to traditional methods The CKAN model achieves over 98% accuracy in the multi-IDS dataset [ 59 ] Fewer parameters increase computational efficiency Develops CNN feature extraction with blood layers According to CNN, improved false positive rates LSTM achieves > 99% accuracy; DCNN achieves 96% accuracy on ICS datasets [ 60 ] Improved efficiency with smaller models LSTM and DCNN are effective for temporal and spatial features Low false positive and false negative rates SCADA-based automatic encoder-based unattended anomaly detection in gas pipelines [ 61 ] Suitable efficiency for real time The automatic encoder captures normal traffic characteristics False positive and false negative rates managed by thresholding Transformer models deliver good performance [ 62 ] Productivity is not detailed It excels in transformer series modelling False positive and false negative rates are not detailed Deep autoencoder detects DDoS attacks with high detection rates and low false alarms [ 63 ] Suitable efficiency for real time The automatic encoder captures network streaming features Low false positive and false negative rates LSTM-based IDS detects MiTM and DoS attacks within 2 minutes [ 64 ] Suitable efficiency for real time LSTM captures temporal dependencies Low false positive and false negative rates Artificial intelligence-based anomaly detection on the DNP 3.0 network achieves 99% accuracy [ 65 ] Average efficiency The automatic encoder captures network traffic characteristics Low false positive and false negative rates Attention-based variational autoencoder improves anomaly detection in the sWAT dataset [ 66 ] Average efficiency The attention mechanism develops spatial-temporal feature extraction False positive and false negative rates have been reduced Each deep learning model reveals certain contextual attributes related to attack detection. This contextuality may vary depending on the model type. Therefore, each model appears to be more suitable for a separate detection. 2.5. Hybrid and Multi-Scale Architectural Approaches Deep learning models better understand the unique context of different attacks. This demonstrates that it is not possible to address all attack types with a single model. Although CNNs are weak in time dependencies, they are quite powerful in extracting local and spatial patterns. LSTMs are strong in time dependencies but can be sensitive to noise. Autoencoders are powerful in representation learning but are insufficient for classification on their own. Transformer models are good at long dependencies but require large amounts of data, which increases hardware costs. Deep learning models are weak when used alone. Therefore, higher performance can be achieved by combining different deep learning models to create new models that offer better advantages. Examples of studies conducted with hybrid models are shown in Table 4 . These models demonstrate the best performance among existing methods with their achieved performance. Table 4 Comparison of hybrid models for attack detection in SCADA-based systems. Perception Accuracy Efficiency Performance Temporal-Spatial Feature Extraction False Positive/Negative Rates F1 and AUC improvements in ICS datasets [ 53 ] Low-efficiency training/inference with transformer integration Powerful spatio-temporal features with CAE + Transformer Low false alarm with SVDD optimisation SCADA ransomware detection ~ 97% Accuracy, > 98% AUC [ 67 ] Middle Spatio-temporal representations with CNN + LSTM Low false alarm rate (< 1.88%) Very high Acc/F1 with ConvLSTM [ 68 ] Efficient in practice with a combined structure ConvLSTM spatial + temporal dependency FP minimise 99.5% accuracy in DNP3 [ 69 ] Middle CNN-LSTM Low FP/FN In the PLC network, Acc = 95.11, F1 = 95.12 [ 70 ] High productivity cost Multi-scale CNN + Transformer FP/FN improved AE-GRU outperforms independent methods [ 71 ] Middle GRU-based autoencoder FP/FN improved FDI detection improved with CNN-LSTM-AE [ 72 ] Middle CNN-LSTM + AE FP has decreased significantly Semi-supervised LSTM-AE effective [ 73 ] Middle LSTM Autoencoder FP/FN improved GoogleNet-LSTM achieves 97.56% accuracy in Modbus [ 74 ] Middle CNN-LSTM Low FP and misses Hybrid methods are those in which multiple models are combined to achieve better results, following traditional methods, machine learning-based methods, and deep learning models. They are recognised as the best known methods for attack detection in SCADA and IDS systems. 2.6. Limitations of Existing Studies and Research Gap Literature studies have shown significant progress in detecting attacks on SCADA systems. Despite these developments, some research gaps have been identified. Based on the findings from these studies, the existing limitations and research gaps can be summarised as follows. Realistic and SCADA-specific data set: The literature contains many studies on attack detection in SCADA systems. Studies have used data sets such as NSL-KDD and CIC-IDS2017, which belong to general network traffic. These data sets are based on irregular traffic flows found in normal networks. They do not reflect the cyclical and predictable data flow associated with traffic involving industrial protocols such as Modbus/TCP. In a real SCADA environment, devices are queried at specific intervals. The query-response cycle continues for a long period. The packet size and traffic are generally low. Anomalies usually arise from a command within the packet or a disruption in the timing cycle. Since datasets such as NSL-KDD and CIC-IDS2017 reflect general network traffic, they do not reflect command injection and protocol-based attack vectors. This calls into question the reliability of these datasets as training data for attack detection in SCADA systems. Failure to Address Imbalanced Data and Diverse Attack Scenarios Together In SCADA-based systems, normal network traffic is much larger than attack traffic. This situation causes class imbalance among attack types. Detecting attack classes that occur infrequently is particularly difficult. This causes the developed model to focus on attacks belonging to the majority class, leading to attacks belonging to the minority class being missed. Comprehensive scenarios for numerous attack classes are limited in existing data sets. The inadequacy of single models and the need for hybrid architectural models Deep learning models focus on specific features within a dataset. While a model may perform well on one dataset, another deep learning model may be more effective on a different dataset. CNN models focus on local and spatial patterns, LSTMs on temporal dependencies, and autoencoders on normal behaviour representations. An attack occurring in SCADA systems may exhibit both anomalies in the packet internal structure and temporal behaviour in the packet sequence. A large portion of existing studies attempt to capture this through a single model. This study presents a sophisticated model that enables the detection of attacks with different characteristics through the proposed hybrid model. Insufficient assessment of generalisability and robustness Literature reviews reveal that studies on detecting attacks in SCADA systems typically focus on a single dataset. This leads to overfitting to the dataset and prevents the same level of success from being achieved in different scenarios and structures. The model proposed in this study has been evaluated by applying it to different datasets.This study presents a structure that develops a solution for high accuracy and generalisability in SCADA systems. It was conducted to address the limitations and gaps mentioned above. 3. Material and Method 3.1 Data Preprocessing The SCADANet dataset used in the study was first processed through the steps of imputation of missing values, scaling, and digitisation of labels. Missing values were filled with a fixed value of 0, and then all numerical features were normalised using StandardScaler. This balanced the effect of variables with different scales on the model. The normalised input data was transformed into the (sample count, feature count, 1) format, making it suitable for the CNN-based network. The output labels were digitised using LabelEncoder and converted into a format suitable for multi-class classification using the one-hot encoding method. To reduce data imbalance, the class_weight approach was used to include minority classes in training with higher weights. 3.2 Proposed Model Architecture In this study, a hybrid deep learning architecture consisting of Parallel Dilated Conv1D, Residual-SE blocks, and LSTM layers is proposed to jointly model the multi-scale spatial patterns and temporal dependencies observed in the network traffic of SCADA-based industrial control systems. The general flow diagram of the proposed architecture is presented in Fig. 2 . Input Layer The model's input is organised so that it is of dimension (T, 1) for each example. Here, T represents the time step or feature length. Parallel Dilated Convolution Layers Convolutional Neural Networks are deep learning architectures frequently used in the field of cyber security for network traffic analysis, anomaly detection, and DDoS attack classification [ 75 ]. CNNs preserve spatial correlations and extract local patterns on the input tensor \(\:X\in\:{\mathbb{R}}^{H\times\:W\times\:C}\) . A convolution operation is defined using a kernel filter \(\:k\in\:{\mathbb{R}}^{n\times\:n\times\:C}\) as shown in Eq. 1 . $$\:Y\left(i,j\right)={\sum\:}_{m=1}^{n}{\sum\:}_{n=1}^{n}X\left(i+m,j+n\right).k(m,n)$$ 1 In Eq. 1 , \(\:Y\left(i,j\right)\) represents the feature map, X \(\:\left(i+m,j+n\right)\) represents the local pixels in the input tensor, and \(\:k(m,n)\) represents the learnable weights multiplied by these pixels. This classical structure can only learn short-range dependencies due to its limited receptive field. In high-dimensional network traffic flows, this makes it difficult to capture long-range dependencies. To overcome this limitation, the dilated convolution mechanism is used. In this approach, gaps are added between the kernel elements with the dilation ratio d. Thus, the effective receptive field is expanded while the number of parameters is kept constant. A one-dimensional dilated convolution operation is mathematically expressed as shown in Eq. 2 . $$\:\left({F}^{\left(d\right)}*k\right)t=\sum\:_{{\tau\:}}{k}_{\tau\:}\bullet\:{F}_{t-d\tau\:}$$ 2 In Eq. 2 , \(\:F\) represents the input signal (traffic flow signal, etc.), k represents the core weight, d represents the dilation ratio, and τ represents the core's position index. In this case, the effective receiver area \(\:{R}_{\text{e}\text{f}\text{f}}\) is expressed as in Eq. 3 . $$\:{R}_{\text{e}\text{f}\text{f}}={\left[(n-1)d+1\right]}^{2}$$ 3 This increase enables the model to capture broader contextual information with the same number of parameters. This makes it possible to learn both local (fine-grained) and global features simultaneously [ 76 ]. In the Efficient Spatial Pyramid module, multi-scale feature extraction is performed by running convolution branches with different dilation rates in parallel. If the dilation rate is defined as \(\:{d}_{k}={2}^{k-1}\) , the effective receptive field expands as shown in Eq. 4 . $$\:{R}_{ESP}={\left[(n-1){2}^{K-1}+1\right]}^{2}$$ 4 The number of parameters for the Efficient Spatial Pyramid module is expressed as in Eq. 5 . $$\:{P}_{ESP}=\frac{1}{K}(NM+{n}^{2}{N}^{2})$$ 5 This enables learning a broader spatial context with fewer parameters compared to classical CNN architectures. The generalised form of this structure is referred to as the Parallel Dilated Convolutional Neural Network architecture. This architecture simultaneously runs multiple convolutional layers with different dilation rates \(\:\left({d}_{i}\right)\) . The feature extraction process for each dilation rate is expressed as in Eq. 6 . $$\:{D}_{c}^{\left(i\right)}=\sigma\:\left({F}^{{d}_{i}}*X\right)$$ 6 Equation 6 denotes \(\:\sigma\:\) , which represents non-linear activation functions such as ReLU or Swish. The resulting multi-scale feature maps are then combined in the Global Average Pooling layer. The Global Average Pooling layer is expressed as shown in Eq. 7 . $$\:{y}_{c}=\frac{1}{H\times\:W}{\sum\:}_{i=1}^{H}{\sum\:}_{j=1}^{W}{D}_{c}^{\left(L\right)}(i,j)$$ 7 Each step in Eq. 7 extracts the average activation of each channel. It also enhances the model's generalisation ability and reduces the risk of overfitting. In cyber attack detection, low dilation ratios learn local packet statistics and short-range correlations. High dilation rates, on the other hand, capture global anomalies and long-range relationships within network traffic. Thus, the model develops contextual awareness with a wide effective receiver area R_eff. This results in high accuracy and generalisation performance in detecting multi-scale patterns such as DDoS attacks. During the application phase of the model developed in this study, the input was sent to three parallel Conv1D layers. While the same filter size (3) was used in these layers, different dilation rates were applied. Thus, the architecture was able to learn short-term and long-term dependencies simultaneously. Each branch utilised 64 filters and a ReLU activation function. The outputs obtained from the parallel branches were combined to form a tensor of dimension (T,192). This structure enhanced the model's large-scale feature extraction capacity, thereby strengthening its cyber attack detection performance [ 77 ]. Batch Normalisation and 1×1 Convolution Batch Normalisation (BN) is a widely used normalisation technique employed to accelerate the training process in deep neural networks while also enhancing its stability. Fundamentally, it aims to reduce internal covariate shift, which arises from the continuous variation in the distribution of activations between layers during training. This method normalises the activations within each mini-batch, transforming them to a mean of zero and a variance of one. It then reshapes them using the scale (γ) and bias (β) parameters that the model can learn [ 78 ]. Mathematically, the process is expressed in Eq. 8 . $$\:\mu\:=\frac{1}{m}\sum\:_{i=1}^{m}{x}_{i},\:\:\:\:\:\:\:\:\:{\sigma\:}^{2}=\frac{1}{m}\sum\:_{i=1}^{m}{{(x}_{i-}\mu\:)}^{2}$$ 8 Here, the expression \(\:\mu\:=\frac{1}{m}\sum\:_{i=1}^{m}{x}_{i}\:\) calculates the mean of the data within the mini-batch. \(\:{\sigma\:}^{2}=\frac{1}{m}\sum\:_{i=1}^{m}{{(x}_{i-}\mu\:)}^{2}\) calculates the variance of the mini-batch data. The normalisation process specified in Eq. 9 is then applied. It normalises the data so that the mean is zero and the variance is one. $$\:\widehat{{x}_{i}}=\frac{{x}_{i}-\mu\:}{\sqrt{{\sigma\:}^{2}+ϵ}}$$ 9 The output is obtained by the rescaling and shifting process specified in the last Eq. 10 . $$\:{\mathcal{Y}}_{i}=\gamma\:\widehat{{x}_{i}}+\beta\:,\:\gamma\:ϵ\mathbb{R}\mathbb{\:}and\:\beta\:ϵ\mathbb{R},$$ 10 Here (Eq. 10 ), \(\:ϵ\) is a small constant that ensures numerical stability. During the training phase, statistics are calculated over mini-batches, while during the testing phase, the moving average and variance obtained from the entire training set are used. BN enables training with larger learning rates and prevents gradients from exploding or vanishing. It also reduces the risk of overfitting by acting as a regulariser. In the model developed within the scope of this study, the high-dimensional feature map obtained after concatenation was normalised using Batch Normalisation. Subsequently, a 1×1 Conv1D layer (64 filters, ReLU activation) was used to reduce the number of parameters and balance the dimensions [ 79 ]. Residual-SE Block As the number of layers increases in deep neural networks, gradient decay and learning difficulties are observed. The Residual Block, used to overcome this problem, learns the difference between the input and the target instead of the objective function directly [ 80 ]. The structure is defined mathematically as shown in Eq. 11 $$\:y=\mathcal{F}\left(\text{x},W\right)+\text{x}$$ 11 Equation 11 now demonstrates the fundamental principle of the residual block. The input \(\:x\) is added to its transformed form \(\:\mathcal{F}\left(x,W\right)\) using parameters ( \(\:W\) ). Thus, the network learns not the target directly, but the difference between the input and the target. The residual block used in this study consists of the following operations: $$\:\mathcal{F}\left(\text{x}\right)={\text{C}\text{o}\text{n}\text{v}1\text{D}}_{3\text{x}3}\to\:\text{S}\text{w}\text{i}\text{s}\text{h}\to\:\text{B}\text{N}\to\:{\text{C}\text{o}\text{n}\text{v}1\text{D}}_{1\text{x}1}$$ 12 Equation 12 now specifies how the function is calculated. After passing through the 3x3 convolution, Swish activation, and Batch Normalisation steps, a 1x1 convolution is applied. The aim is to transform the input features and obtain more meaningful representations. Shortcut transformation: $$\:{\text{x}}^{{\prime\:}}={\text{C}\text{o}\text{n}\text{v}1\text{D}}_{1\text{x}1}\left(\text{x}\right)$$ 13 This expression (Eq. 13 ) defines the shortcut transformation. The input data is transformed using a 1x1 convolution to achieve dimension matching, thereby enabling it to be added to \(\:\mathcal{F}\left(x\right)\) . $$\:y=\text{S}\text{w}\text{i}\text{s}\text{h}(\mathcal{F}\left(\text{x}\right)+{\text{x}}^{{\prime\:}})$$ 14 The final output is obtained using the formula specified in Eq. 14 . After the residual function and shortcut output are summed, they are passed through the Swish activation function. This structure enables the effective learning of multi-layer representations and the efficient training of deep architectures by combining linear and non-linear components. LSTM Layer Long Short-Term Memory (LSTM) is a structure proposed by Hochreiter and Schmidhuber in 1997, developed specifically to address the gradient vanishing/exploding issues experienced by traditional Recurrent Neural Networks (RNNs) when learning long-term dependencies. The most fundamental feature of LSTM is its ability to preserve information obtained from past data for extended periods through gate mechanisms that regulate information flow [ 81 ]. An LSTM cell contains the following elements (Fig. 3 ) Cell state ( \(\:{C}_{t}\) ): The main route for transporting long-term information. Hidden state ( \(\:{h}_{t}\) ) : Short-term information representing the current output. Forget gate( \(\:\:{f}_{t}\) ) : Determines which information will be deleted from the memory. Input gate ( \(\:{i}_{t}\) ) : It controls which parts of the incoming data are written to memory. Output gate ( \(\:\:{O}_{t}\) ): It regulates how much of the information in memory is transferred out. Cell candidate ( \(\:{\stackrel{\sim}{C}}_{t}\) ): Creates a candidate for new information that can be added. The updating process of the LSTM is defined by the following equations: \(\:{f}_{t}=\sigma\:({W}_{f}.\left[{h}_{t-1},{x}_{t}\right]+{b}_{f})\) : This expression defines the forget gate. It also determines how much of the previous information is retained. \(\:{i}_{t}=\sigma\:({W}_{i}.\left[{h}_{t-1},{x}_{t}\right]+{b}_{i})\) : This is the input gate. It regulates the rate at which new information enters the memory. \(\:{\stackrel{\sim}{C}}_{t}=\text{tanh}\left({W}_{C}.\left[{h}_{t-1},{x}_{t}\right]+{b}_{C}\right)\) : Candidate memory. It produces new information suitable for addition. \(\:{C}_{t}={f}_{t}\odot\:{C}_{t-1}+{i}_{t}\odot\:{\stackrel{\sim}{C}}_{t}\:\) : Updated cell state, represents the combination of the appropriate part of the old information and the new information. \(\:{O}_{t}=\sigma\:\left({W}_{o}.\left[{h}_{t-1},{x}_{t}\right]+{b}_{o}\right)\) : Output gate. Selects which part of the cell information will be the output. \(\:{h}_{t}={o}_{t}\odot\:\text{tanh}\left({C}_{t}\right)\) : Hidden state, represents the information that forms the final output. Here, \(\:\sigma\:\) denotes the sigmoid function, tanh denotes the hyperbolic tangent function, and \(\:\odot\:\) denotes element-wise multiplication. This structure enables the LSTM to update information when necessary and store it for extended periods when required. A key factor in the success of LSTM is a mechanism called Constant Error Carousel (CEC), which allows the error signal to be carried over time without loss. This enables the model to access past information even in long sequences. The training process is typically carried out using the Backpropagation Through Time (BPTT) algorithm. Over time, different types of LSTMs have been developed. The basic (vanilla) LSTM consists only of input, forget, and output gates. Peephole LSTM provides additional information transfer by directly connecting the memory state to the gates. Bidirectional LSTM processes data in both forward and backward directions, while Stacked LSTM can learn more complex dependencies by stacking multiple layers on top of each other. LSTM is widely used in many areas such as natural language processing, speech recognition, time series prediction, health data analysis, and network security. Thanks to its ability to learn long-term relationships, it has become an indispensable deep learning model for sequence-based problems [ 83 ]. In the model developed within the scope of this study, the outputs obtained from the Residual-SE block were fed into a 128-unit LSTM layer (return_sequences = True) to model their temporal dependencies. This allowed for the capture of sequential relationships in addition to CNN-based feature extraction. Pooling and Fully Connected Layers: The output of the LSTM layer was summarized using Global Average Pooling (GAP) and converted into a fixed-length vector. This vector was fed into a dense layer with 128 neurons and ReLU activation, and Dropout (rate = 0.3) was applied to reduce overfitting. Output Layer The final layer has C neurons, corresponding to the number of classes, and produces a multi-class probability distribution using the Softmax activation function. 3.3 Training Strategy The training of the proposed model within the scope of this study was performed using the categorical cross-entropy loss function and the Adam optimization algorithm. The initial learning rate was set to 0.001, and consistent training was ensured by maintaining the same optimization settings throughout all experiments. During the training phase, multiple regularization strategies were used together to prevent overfitting, increase the model's generalization ability, and make the learning process more stable. In this context, the EarlyStopping mechanism was applied first. If no improvement was observed in the validation loss for 50 epochs, the training process was automatically terminated. This approach reduced computational costs by preventing unnecessary training iterations and prevented the model from overfitting to the training data. Additionally, the ReduceLROnPlateau strategy was used to adaptively manage the learning process. If the validation loss did not improve over 15 epochs, the current learning rate was halved. This method contributes to a more balanced and stable optimization process by allowing the model to continue learning with smaller steps in the plateau regions of the loss function. Finally, the model weights at the point where the validation loss reaches its lowest level are saved using the ModelCheckpoint method. This ensures that the model version with the best generalization performance is preserved at the end of the training process. The combined use of these strategies has made the training process computationally efficient while also increasing the consistency and reliability of performance through early stopping, adaptive learning rate adjustment, and saving the best model. 4. Experimental Work This section presents in detail the experimental evaluations of the proposed model on two different datasets, the cross-validation strategy used, optimizations for the imbalanced data problem, performance metrics, and ablation analyses. The experiments aim to comprehensively demonstrate the generalizability of the method, the contributions of its components, and its robustness under class imbalance. 4.1. Experimental Setup and Acquisition of the SCADANet Dataset The SCADANet dataset used in this study was generated in a completely isolated virtual SCADA laboratory. The dataset consists of a total of 486,714 labeled network packets. The dataset includes packets obtained from nine different attack scenarios along with normal traffic. The dataset contains 6,403 different source IPs, 123 destination IPs, and 165 network protocols. Approximately 83% of the traffic consists of attack packets, while 17% consists of normal packets. Class imbalance is also observed. This situation necessitates the use of appropriate training strategies to ensure that underrepresented attack classes can be learned correctly. The dataset includes TCP SYN Flood, TCP ACK Flood, UDP Flood, ICMP Flood, HTTP Flood, SQL Injection, Port Scan, Vulnerability Scan, and Operating System Scan attacks. These attacks are designed to cover different threat categories such as reconnaissance, resource consumption, vulnerability scanning, and service exploitation. Multi-protocol structures such as Modbus/TCP, UDP, ICMP, and HTTP, along with attacks performed simultaneously within the same flow, ensure that the dataset represents real traffic in industrial environments. The dataset provides a rich research resource for multi-class attack detection, containing both volume and variety specific to SCADA's normal behavior and attack patterns. The experimental environment was configured using VMware Workstation Pro running on the Windows operating system. As shown in Fig. 4 , this completely isolated virtual laboratory environment is designed as a multi-node SCADA topology consisting of seven virtual machines (VMs). This topology includes attacker systems, target servers, Modbus/TCP-based field devices, SCADA/HMI master systems, and a listener node that passively monitors all traffic. All virtual machines are connected to each other via a NAT-based network to form a single broadcast domain. The Ubuntu-based listener VM, configured to record network traffic, was set to operate in passive mode on the virtual switch and captured all packets generated in the environment. The roles of virtual machines used in the virtual laboratory environment and their task definitions are summarized in Table 4 . Table 4 Virtual machines used in the experimental virtual laboratory structure created to obtain the dataset Virtual machines Role Task Description IP Address Ubuntu VM Listener (Sniffer) It is configured to passively capture all traffic on the network using Wireshark and Tshark. 192.168.119.130 Kali VM 1 Attacker They have run attack scripts to simulate malicious activities. 192.168.119.140 Kali VM 2 Victim It hosted a web server and served as the main target of attacks. 192.168.119.141 Kali VM 3 Modbus Server It has simulated a SCADA field device by running a Modbus/TCP server. 192.168.119.142 Kali VM 4 Modbus Client It represented a SCADA/HMI master system that generates legitimate Modbus traffic. 192.168.119.143 Kali VM 5 Attacker It has run additional attack scripts to create malicious traffic scenarios. 192.168.119.144 Kali VM 6 Modbus Client It has served as a second SCADA/HMI master system that generates standard Modbus communication. 192.168.119.145 4.1.1 Traffic Generation and Communication Flows Two primary communication flows have been defined in the simulated environment. The first flow is legitimate industrial communication established between the Modbus/TCP server running on Kali 3 and the Modbus clients on Kali 4 and Kali 6. This structure is configured to mimic the periodic query-response cycles observed in real field environments. The Modbus clients generated deterministic SCADA traffic by performing holding register, input register, and coil read/write operations at specific time intervals. The second flow is attack traffic. Attacker nodes located on Kali 1 and Kali 5 performed various attack scenarios targeting the target system running on Kali 2. All this traffic was generated simultaneously and interleaved without interrupting normal Modbus communication. This approach ensured that realistic traffic patterns were obtained, with attack traffic embedded within normal industrial flow. During normal traffic generation, not only Modbus/TCP communication but also ICMP-based availability checks and HTTP-based service requests commonly observed in industrial networks are included in the system as background traffic. Thus, the resulting dataset represents a multi-service and heterogeneous SCADA network rather than a synthetic structure based on a single protocol. 4.1.2 Traffic Capture and Feature Extraction The network traffic capture process was performed passively using the TShark tool running on an Ubuntu VM. Separate “.pcapng” files were created for each scenario, and Layer-2 noise traffic (such as ARP packets) was filtered during the analysis phase. The captured raw packets were parsed using Wireshark and TShark; attributes belonging to the frame, IP, TCP/UDP/ICMP, and application layers were extracted in detail. Additionally, cryptographic and behavioral fingerprint characteristics were obtained at the session and flow levels using the JA4 + mechanism. These characteristics provide distinctive information, particularly for detecting low-volume and covert SCADA attacks. 4.1.3 Labeling Process The data labeling process is not based solely on port or protocol-based heuristic rules. Instead, the start and end times of attacks were precisely determined by synchronizing the log records of the scripts that initiated the attack scenarios with the packet timestamps. This approach has increased the accuracy of class labels and ensured that the dataset can be used reliably in multi-class attack detection studies. As a result, each packet has been labeled as either “normal traffic” or the relevant attack class and structured in CSV format for use in the analysis phase. 4.1.4 Traffic Generation and Attack Scenario Design The network traffic generation process was carried out in two stages. In the first stage, harmless traffic representing normal operating conditions was generated and recorded as reference data. In the second stage, nine different attack scenarios were applied while normal traffic continued in the background. The attacks carried out included TCP-SYN Flood, TCP-ACK Flood, UDP Flood, ICMP Flood, HTTP Flood, SQL Injection, Port Scan, Vulnerability Scan, and OS Scan. These attacks were selected to represent different threat classes, such as reconnaissance, resource consumption, and service exploitation, rather than just producing anomalies at the network level. Each scenario was executed for durations ranging from 5 to 20 minutes, depending on the attack type, thus ensuring diversity in the time dimension. The resulting dataset consists of a total of ten traffic categories: one normal traffic class and nine different attack classes. 4.1.5 Second Data Set Used for Comparison (WUSTL-IIoT-2021) The WUSTL-IIoT-2021 data set was also used for comparison purposes in this study. This data set was created in an isolated and virtualized laboratory environment to represent network traffic from industrial IoT-based SCADA systems. In addition to normal operation scenarios, attack scenarios were generated in a controlled manner, and background traffic was preserved. The dataset contains approximately 1.2 million network flow records and 44 network/flow-based attributes. The records are labeled into five classes: normal, Backdoor, Command Injection, Denial of Service, and Reconnaissance. The explicit definition of Command Injection and Backdoor attacks specific to SCADA systems makes the dataset an important reference for industrial cybersecurity studies. Furthermore, the class imbalance observed in the dataset provides a realistic testing environment for detecting rare attacks and evaluating model robustness. In this study, two different datasets were used to evaluate the model's performance on both an internally created dataset and an external dataset commonly used in the literature: • SCADANet Dataset: An original dataset collected within the scope of the study, containing examples from different classes. • WUSTL-IIoT-2021 [ 84 ]: A data set frequently used in the literature, with high class diversity and a more heterogeneous structure. For both data sets, all examples underwent standard preprocessing steps (scaling, label encoding, reshaping, etc.) as described in the methods section. To ensure a reliable and statistically meaningful evaluation of the model, the 5-fold cross-validation method was used in all experiments. Accordingly, the dataset was divided into five equal sub-sections while preserving the class distribution; in each experiment cycle, one of these sub-sections was designated as the test set, while the remaining four were used for training. After all layers were completed, the performance values obtained from each fold were combined, and the final results were reported by calculating the arithmetic mean and standard deviation of the metrics. This approach aims to ensure the model's stability, generalizability, and statistical reliability across different data subsets. The model was trained using the same hyperparameters, the same training strategy, and the same data splitting protocol in all experiments, thus providing a consistent basis for comparison between models. 4.2. Addressing the Imbalanced Data Problem Due to a significant imbalance between classes in the datasets, a two-stage loss optimization strategy was applied to increase the representativeness of minority classes and improve the model's sensitivity to these classes. In this context, Focal Loss was first used to reduce the impact of easy examples belonging to frequently encountered classes on the loss function, thereby ensuring that the model focused on more difficult examples and minority classes. Additionally, class weights were defined to balance each class's contribution to the training process; these weights were determined in proportion to the inverse of the number of examples in the relevant class, thereby increasing the impact of rare classes on the total loss. This dual-pronged approach reduced biases arising from the imbalanced data problem and significantly strengthened the model's learning capacity, particularly for classes with low sample sizes. This two-stage approach to the imbalanced data problem has led to significant improvements in both recall and F1-score, especially for classes with small sample sizes. 4.3. Evaluation Metrics The model's performance was evaluated not only based on accuracy but also using the following metrics to accurately reflect the effects of class imbalance: $$\:Accuracy=\frac{TP}{TP+FP}$$ 15 $$\:Precision=\frac{TP}{TP+FN}\:$$ 16 $$\:Recall=\frac{TP\:}{TP+FN}$$ 17 $$\:F1-Score=\frac{2\times\:Precision\:\times\:Recall}{Precision+Recall}$$ 18 In these metrics, TP represents true positives; TN represents true negatives; FP represents false positives; and FN represents false negatives. These four fundamental terms form the basis for calculating Accuracy, Precision, Recall, F1-score, and Confusion Matrix. These metrics have been calculated both class-based and average (macro/weighted); the mean and standard deviation values of the metrics across folds are reported in tables. Confusion matrices are presented in figures to detail the confusion between classes. 4.4. Results on the SCADANet Dataset Five-fold cross-validation experiments conducted on the SCADANet dataset obtained from experimental studies demonstrate that the proposed model possesses both high generalization performance and a strong representation capacity that can effectively perform inter-class discrimination. The integrated use of dilated CNN structures enabling multi-scale feature extraction, attention mechanisms at the channel level, and LSTM layers modeling temporal dependencies ensured that the model exhibited stable and consistent performance despite the pronounced class imbalance observed in the dataset. The model's 5-fold average performance metrics on the SCADANet dataset are presented in Table 5 . Table 5 5-Fold Average Performance Results for the SCADANet Dataset Metric Value Average Accuracy 99.67 Macro Precision 97.10 Macro Recall 97.23 Macro F1-score 97.16 Weighted Precision 99.67 Weighted Recall 99.67 Weighted F1-score 99.67 As shown in Table 5 , the average accuracy value of 0.9967 indicates that the model demonstrated high and stable accuracy performance throughout the five folds. The high macro average metrics reveal that the model does not focus solely on classes with dense samples; it can also effectively learn classes with low distribution. In particular, the Macro Recall value of 0.9723 indicates that samples belonging to minority classes are largely captured correctly and that the model offers strong performance in terms of sensitivity. The fact that the weighted average Precision, Recall, and F1-score values all reach 0.9967 is noteworthy in that it shows that the model can represent the overall distribution of the dataset almost flawlessly. The confusion matrix obtained by combining all test results of the five folds is presented in Fig. 5 . This matrix allows for a detailed examination of the model's confusion levels between classes and clearly shows how errors are distributed across classes, especially in situations where class imbalance is intense. The 5-fold pooled confusion matrix presented in Fig. 5 clearly shows the model's class-based decision behavior and where errors are concentrated among classes. Upon examining the matrix, it is observed that values on the diagonal are dominant, especially in classes with high sample sizes, and off-diagonal errors are very limited; this indicates that the model has strongly learned the distinctive patterns associated with these classes. The low level of false negative (FN) values in minority classes indicates that the Focal Loss + class weights strategy used to address the imbalanced data problem has achieved the desired effect and reduced the model's tendency to miss critical examples. On the other hand, it is observed that class mix-ups are not randomly distributed; rather, they cluster between specific class pairs that can be considered structurally close to each other (e.g., shifts to neighboring classes in some classes). This finding suggests that the model generally learns the decision boundaries clearly, but that patterns with limited overlap between similar classes can cause errors. Overall, Fig. 5 confirms that the model performs with high accuracy in majority classes while maintaining sensitivity in minority classes, exhibiting a balanced error profile. 4.5. Results on the WUSTL-IIoT-2021 Dataset Five-fold cross-validation experiments conducted on the WUSTL-IIoT-2021 dataset demonstrate that the proposed model exhibits high stability across different data distributions and possesses strong generalization capabilities. Although the class distribution of the WUSTL-IIoT-2021 dataset shows a more heterogeneous structure compared to the primary dataset, it was observed that the model's learning capacity and the strategies applied to address the imbalanced data problem remained effective on this dataset. The model's 5-fold average performance metrics on the WUSTL-IIoT-2021 dataset are presented in Table 6 . Table 6 5-Fold Average Performance Results for the WUSTL-IIoT-2021 Dataset Metric Value (%) Average Accuracy 99.9973 Average Macro Precision 97.79 Average Macro Recall 97.68 Average Macro F1-score 97.70 Average Weighted Precision 99.9973 Average Weighted Recall 99.9973 Average Weighted F1-score 99.9973 The results presented in Table 6 show that the proposed model demonstrates high and balanced performance not only in the majority classes of the dataset but also in classes with lower sample sizes. The fact that the macro average Precision, Recall, and F1-score values are above 97% reveals that the model has a strong discrimination capacity even in an evaluation environment where all classes contribute equally. In contrast, the fact that all weighted average metrics are at the 99.9973% level shows that the model can represent the distribution of the majority class almost flawlessly and that the overall classification accuracy is exceptionally high. The confusion matrix obtained by combining the test results of all folds is presented in Fig. 6 . This matrix allows for a detailed examination of the model's levels of confusion between classes. When examining the confusion matrix presented in Fig. 6 , it is clear that the model performs with extremely high accuracy on both small and large sample classes. Particularly in the majority class, the fact that nearly all of the over 1.1 million examples are correctly classified demonstrates the model's high representativeness and discriminative capacity. In medium-sized classes, error rates remain negligible, with only a limited number of false positives or false negatives observed. Even in classes with lower sample sizes, false negative values remain at a minimum level, indicating that the model does not miss critical classes and offers high sensitivity. Overall, the extremely low level of misclassifications confirms that the decision boundaries between classes have been learned in a clear and consistent manner. When these findings are evaluated together, the results obtained on the WUSTL-IIoT-2021 dataset clearly demonstrate that the proposed model offers a high level of generalizability not only to the dataset used in the training process but also to external datasets with different distributions. The high macro average metrics indicate that minority classes are strongly represented, while the nearly flawless results obtained in the weighted average metrics confirm the model's overall classification stability and reliability. Considering the low error rates in the confusion matrix, it can be said that the proposed approach offers a scalable, reliable, and stable classification solution for different data sources. 4.6. Ablation Study Ablation study was performed only on the original SCADANet developed within the scope of this study to quantitatively demonstrate the contribution of the basic components in the proposed architecture to classification performance. In this context, the model architecture was systematically retrained with certain components disabled, and the performance of each configuration was analyzed comparatively. Thus, the contribution of each module to spatial and temporal representation power could be evaluated separately. The model configurations evaluated in the ablation study are listed below: • The proposed model including all components (ALL model), • The model with the Residual and SE blocks removed (Without Res-SE Block), • The model with the LSTM layer modeling temporal dependencies removed (Without LSTM), and • The model with the dilated CNN structure, which enables multi-scale feature extraction, removed (Without Dilated CNN). The performance results obtained are presented in Table 7 . Table 7 Ablation Study Results Model Configuration Accuracy Precision Recall F1-score ALL model 0.9967 0.9710 0.9723 0.9716 Without Res-SE Block 0.9941 0.9584 0.9569 0.9576 Without LSTM 0.9928 0.9411 0.9416 0.9412 Without Dilated CNN 0.9919 0.9365 0.9348 0.9356 The ablation results presented in Table 7 clearly demonstrate that the ALL model configuration, in which all architectural components are active, achieves the highest values in terms of all performance metrics. This finding shows that the holistic design of the proposed architecture, which considers the interaction between components, provides meaningful and consistent contributions to classification performance. The findings obtained by disabling different architectural components within the ablation study are summarized as follows: • When the residual and SE blocks were removed, a significant decrease was observed, particularly in precision and F1-score values. This clearly demonstrates the critical role of attention mechanisms at the channel level in highlighting discriminative features and preserving information flow in deep network architectures. Disabling these components limited the model's discriminative representation capacity, resulting in weaker learning of inter-class decision boundaries. • Removing the LSTM layer caused a more pronounced performance loss in recall and F1-score values. This finding demonstrates that the LSTM structure makes an important contribution to effectively modeling sequential and temporal dependencies in the dataset. Failure to transfer temporal context information to the model led to an increase in false negatives, particularly by reducing the capture rate of examples belonging to minority classes. • When the Dilated CNN architecture was removed, it was observed that the model's ability to represent multi-scale spatial patterns weakened significantly, leading to a decline in all performance metrics. Without this architecture, which provides a wide receptive field, the model was unable to sufficiently distinguish complex structures at different scales. In general, ablation studies clearly demonstrate that each component in the proposed architecture provides complementary and statistically significant contributions to performance. The combined use of multi-scale spatial feature extraction, channel attention mechanisms, and temporal modeling has enabled the model to exhibit high accuracy, balanced class performance, and strong generalization ability on unbalanced and complex data structures. 5. Conclusions and Future Work In this study, a hybrid deep learning architecture capable of modeling both multi-scale spatial patterns and temporal dependencies has been proposed for detecting cyberattacks observed in SCADA-based critical infrastructure networks. Within the scope of the study, a SCADANet dataset specific to SCADA systems was also created by designing a completely isolated virtual SCADA environment containing multi-class attack scenarios generated in parallel with legitimate network traffic. The proposed approach was comprehensively evaluated on both the created SCADA dataset and the WUSTL-IIoT-2021 dataset, which is widely used in the literature. The experimental analyses conducted demonstrate that the proposed architecture achieves high accuracy, macro F1-score, and recall values on both datasets. In particular, the high sensitivity achieved for attack types belonging to minority classes indicates that the model possesses strong representation and discrimination capabilities even under imbalanced data conditions. These results confirm that the combined use of multi-scale spatial feature extraction, channel-level attention mechanisms, and temporal modeling contributes significantly to the effective capture of complex attack patterns specific to SCADA traffic. The findings reveal that the proposed approach is not merely a model tailored to a specific dataset; it demonstrates generalizable and stable attack detection performance across SCADA environments with different traffic distributions and attack scenarios. In this respect, the study makes a significant contribution to the literature by providing a realistic experimental framework for SCADA security and by comprehensively evaluating the hybrid deep learning architecture on multiple data sources. Future work will focus on expanding the scope of the created dataset and integrating advanced attack scenarios specific to SCADA systems. In this regard, the goal is to include more sophisticated and process-oriented attack types in the system, such as Advanced Modbus False Data Injection (FDI), Modbus Command Abuse, APT-based data exfiltration, and Insider Threat (sabotage). Adding these types of attacks will increase both the diversity of attacks and the operational realism of the dataset. In the long term, the goal is to evaluate more advanced hybrid or autonomous deep learning architectures on this expanded dataset and to develop a real-time, scalable SCADA attack detection framework that is compatible with operational environments. Thus, the aim is to offer more resilient and application-oriented solutions for enhancing cybersecurity in critical infrastructure systems. Declarations Conflicts of Interest: The authors declare no conflicts of interest. Funding: This research received no external funding. Author Contribution For research articles with several authors, a short paragraph specifying their individual contributions must be provided. The following statements should be used “Conceptualization, O.P. and S.B.; methodology, S.B. and O.P; software, O.P. and S.B.; validation, S.B. and O.P.; formal analysis, O.P. and S.B.; investigation, O.P. and S.B.; resources, S.B. and O.P ; data curation, O.P., and S.B; writing—original draft preparation, S.B., O.P.; writing—review and editing, O.P. and S.B.; visualization, O.P. and S.B.; supervision, O.P.; project administration, O.P.; All authors have read and agreed to the published version of the manuscript.” Please turn to the CRediT taxonomy for the term explanation. Authorship must be limited to those who have contributed substantially to the work reported. Data Availability The WUSTL-IIoT-2021 dataset used in this study is an open-access dataset for research purposes. The dataset can be accessed via the official Washington University in St. Louis (WUSTL) data repository at the following link: https://www.cse.wustl.edu/~jain/iiot2/index.html. All data analyzed in this study are included in the published article. In addition to the WUSTL-IIoT-2021 dataset, this study also utilizes a dataset named SCADANet, which was generated by the authors to further support the experimental analysis. References Birnbaum, Z. et al. Cyber-Resilient SCADA Systems via Secure State Restoration. IFIP Adv. Inf. Commun. Technol. 596 , 183–207 (2020). Alsabbagh, W., Amogbonjaye, S., Urrego, D. & Langendörfer, P. A. Stealthy False Command Injection Attack on Modbus based SCADA Systems. Proceedings - IEEE Consumer Communications and Networking Conference, CCNC 2023-January, (2023). Paulraj, J., Raghuraman, B., Gopalakrishnan, N. & Otoum, Y. Autonomous AI-based Cybersecurity Framework for Critical Infrastructure: Real-Time Threat Mitigation. IEEE/ACIS 29th International Conference on Software Engineering, Artificial Intelligence, Networking and Parallel/Distributed Computing (SNPD) 925–931 (2025) 925–931 (2025) (2025). 10.1109/SNPD65828.2025.11254587 Do, V. L., Fillatre, L., Nikiforov, I. & Willett, P. Security of SCADA systems against cyber-physical attacks. IEEE Aerosp. Electron. Syst. Mag. 32 , 28–45 (2017). Jahan Simu, S. & Zaman, F. I. Advanced Cybersecurity Strategies for Protecting Critical Infrastructure: Strengthening the Backbone of National Security. Int. J. Sci. Res. Manage. (IJSRM) . 11 , 999–1016 (2023). Lehto, M. Cyber-Attacks Against Critical Infrastructure. Comput. Methods Appl. Sci. 56 , 3–42 (2022). Le, X., Li, J., Zhao, Y., Fan, Z. A. & Security-Enhanced Scheme for ModBus TCP Protocol Based on Lightweight Cryptographic Algorithm. Electron. 2025 . 14 , 3674 (2025). Mohammed, A. S., Saxena, N. & Rana, O. Wheels on the Modbus - Attacking ModbusTCP Communications. WiSec 2022 - Proceedings of the 15th ACM Conference on Security and Privacy in Wireless and Mobile Networks 22, 288–289 (2022). Zhang, H. et al. A Method to Recognize DoS Attacks on Modbus/TCP. Conference Proceedings of the IEEE International Performance, Computing, and Communications Conference 2022-November, 319–324 (2022). Sayghe, A. Digital Twin-Driven Intrusion Detection for Industrial SCADA: A Cyber-Physical Case Study. Sens. 2025 . 25 , 4963 (2025). Zhu, B. & Sastry, S. Intrusion Detection and Resilient Control for SCADA Systems. https://services.igi-global.com/resolvedoi/resolve.aspx?doi=10.4018/978-1-4666-2659-1 . ch015 352–383 (1AD) 10.4018/978-1-4666-2659-1.CH015 Intrusion detection in. scada systems using one-class classification | IEEE Conference Publication | IEEE Xplore. https://ieeexplore.ieee.org/abstract/document/6811620 Gbabo, E. Y., Okenwa, K. & Chima, E. O. Developing Intrusion Detection Integration Models for SCADA-Controlled Electricity Infrastructure. (2023). https://doi.org/10.32628/IJSRST doi:10.32628/IJSRST. Kim, B. K. & Kang, Y. Abnormal Traffic Detection Mechanism for Protecting IIoT Environments. 9th International Conference on Information and Communication Technology Convergence: ICT Convergence Powered by Smart Intelligence, ICTC 2018 943–945 (2018). 10.1109/ICTC.2018.8539533 Radoglou-Grammatikis, P. Implementation and detection of modbus cyberattacks. 9th International Conference on Modern Circuits and Systems Technologies, MOCAST 2020 (2020). https://doi.org/10.1109/MOCAST49295.2020.9200287 (2020) doi:10.1109/MOCAST49295.2020.9200287. Mehrotra, L. & Saxena, P. S. An Assessment Report on: Statistics-Based and Signature-Based Intrusion Detection Techniques. Adv. Intell. Syst. Comput. 625 , 321–327 (2018). Doğan, F., Polat, O. & Yardimci, F. A new method for detecting beaconing attacks in IoT-based scada systems. International Journal of Information Security 2025 24:6 24, 244- (2025). Bajwa, A., Al Razee Tonoy, A., Rana, S., Ahmed, I. & CYBERSECURITY IN INDUSTRIAL CONTROL SYSTEMS: A SYSTEMATIC LITERATURE REVIEW ON AI-BASED THREAT DETECTION FOR SCADA AND IOT NETWORKS.. 1–15 10.63125/1cr1kj17 Sharma, N. & Arora, B. Machine Learning and Deep Learning Models for Anomaly Intrusion Detection in Networks: A Systematic Review. SN Computer Science 2025 6:7 6, 832- (2025). Razaque, A. et al. Review of malicious code detection in data mining applications: challenges, algorithms, and future direction. Cluster Comput. 28 , 206 (2025). Cui, J., Long, J., Min, E., Liu, Q. & Li, Q. Comparative Study of CNN and RNN for Deep Learning Based Intrusion Detection System. International Conference on Communication, Computing & Security 11067 LNCS, 159–170 (2018). Barik, K., Misra, S., Konar, K., Fernandez-Sanz, L. & Koyuncu, M. Cybersecurity Deep: Approaches, Attacks Dataset, and Comparative Study. Applied Artif. Intelligence 36 , (2022). Elsayed, S., Mohamed, K. & Madkour, M. A. A Comparative Study of Using Deep Learning Algorithms in Network Intrusion Detection. IEEE Access. 12 , 58851–58870 (2024). Kimanzi, R., Kimanga, P., Cherori, D. & Gikunda, P. K. Deep Learning Algorithms Used in Intrusion Detection Systems -- A Review. (2024). https://arxiv.org/pdf/2402.17020 Al-Shurbaji, T. et al. Deep Learning-Based Intrusion Detection System for Detecting IoT Botnet Attacks: A Review. IEEE Access. 13 , 11792–11822 (2025). Sangeetha, K., Kala, A., Femi, P. S. & Priya, S. B. A Comparative Analysis of Deep Learning Based Techniques for Cyber Security 1st International Conference on Software, Systems and Information Technology, SSITCON 2024 (2024). https://doi.org/10.1109/SSITCON62437.2024.10796142 (2024) doi:10.1109/SSITCON62437.2024.10796142. Markkandeyan, S. et al. Novel hybrid deep learning based cyber security threat detection model with optimization algorithm. Cyber Secur. Appl. 3 , 100075 (2025). Alguliyev, R. & Shikhaliyev, R. Network cybersecurity incidents multiclassification based on deep learning Network cybersecurity incidents Network cybersecurity incidents multiclassification, Deep learning model, CNN-LSTM model Network traffic classification. Probl. Inform. Technol. 15 , 16–23 (2024). WUSTL-IIOT-. 2021 Dataset for IIoT Cybersecurity Research. https://www.cse.wustl.edu/~jain/iiot2/index.html Morris, T. H. & Gao, W. Industrial Control System Cyber Attacks. https://doi.org/10.14236/EWIC/ICSCSR2013.3 doi: 10.14236/EWIC/ICSCSR2013.3 . (2013). Yang, Y. S. et al. Securing SCADA Energy Management System under DDos Attacks Using Token Verification Approach. Appl. Sci. 2022 . 12, Page 530 (12), 530 (2022). Altaleb, H. & Rajnai, Z. Malware Attacks on SCADA Systems: Assessing Risks and Strengthening Cybersecurity Measures. SISY 2023 - IEEE 21st International Symposium on Intelligent Systems and Informatics, Proceedings 625–629 (2023). 10.1109/SISY60376.2023.10417951 Wali, S., Farrukh, Y. A., Khan, I. & Hamilton, J. A. Covert penetrations: Analyzing and defending SCADA systems from stealth and Hijacking attacks. Comput. Secur. 156 , 104449 (2025). Sayegh, N., Chehab, A., Elhajj, I. H. & Kayssi, A. Internal security attacks on SCADA systems. 3rd International Conference on Communications and Information Technology, ICCIT 2013 22–27 (2013) 22–27 (2013) (2013). 10.1109/ICCITECHNOLOGY.2013.6579516 Mondal, S., Prudhvi, B., Khare, P. & Bharata Reddy, M. J. Real-time analysis of cyber attacks in SCADA based power system. Australian J. Electr. Electron. Eng. https://doi.org/10.1080 (2025). 2025.2531694;REQUESTEDJOURNAL:JOURNAL:TELE20;WGROUP:STRING:PUBLICATION./1448837X.2025.2531694;REQUESTEDJOURNAL:JOURNAL:TELE20;WGROUP:STRING:PUBLICATION. Langner, R. & Stuxnet Dissecting a cyberwarfare weapon. IEEE Secur. Priv. 9 , 49–51 (2011). NERC | Report Title | Report Date I Analysis of the Cyber Attack on the Ukrainian Power Grid Defense Use Case. (2016). Triton Malware Spearheads Latest Attacks on Industrial Systems | McAfee Blog. https://www.mcafee.com/blogs/other-blogs/mcafee-labs/triton-malware-spearheads-latest-generation-of-attacks-on-industrial-systems/ Slowik, J. & THE BAFFLING BERSERK BEAR: A DECADE’S ACTIVITY TARGETING CRITICAL INFRASTRUCTURE. View of Dragonfly Cyber Threats. A Case Study of Malware Attacks Targeting Power Grids. https://jcbi.org/index.php/Main/article/view/137/82 Verkerken, M., D’hooge, L., Wauters, T., Volckaert, B. & De Turck, F. Towards Model Generalization for Intrusion Detection: Unsupervised Machine Learning Techniques. Journal of Network and Systems Management 2021 30:1 30, 12- (2021). Bronk, C. & Tikk-Ringas, E. The Cyber Attack on Saudi Aramco. Survival (Lond) . 55 , 81–96 (2013). Liao, H. J., Lin, R., Lin, C. H., Tung, K. & Y. C. & Y. Intrusion detection system: A comprehensive review. J. Netw. Comput. Appl. 36 , 16–24 (2013). Tripathi, A., Upadhyay, P. & Goel, P. K. Industrial Control Systems (ICS) Security: AI-Based Threat Detection and Prevention. https://services.igi-global.com/resolvedoi/resolve.aspx?doi=10.4018/979-8-3373-3241-3 . ch008 149–172 (1AD) 10.4018/979-8-3373-3241-3.CH008 Awaad, A. M., Alheeti, A., Najem, A. K. & K. M. & A. H. Anomaly-Based IDS (Intrusion Detection System) for Cyber-Physical Systems. Mesopotamian J. Big Data . 2024 , 230–240 (2024). Ahakonye, L. A. C., Nwakanma, C. I., Lee, J. M. & Kim, D. S. SCADA intrusion detection scheme exploiting the fusion of modified decision tree and Chi-square feature selection. Internet Things . 21 , 100676 (2023). Network Intrusion Detection System using Ensemble Learning. MSc Academic Cyber Security Samruddhi Basagouda Patil. Sukhadeo, B. S. et al. MLIDS: A Machine Learning-Based Intrusion Detection System Using the NSLKDD Data. Int. J. Intell. Syst. Appl. Eng. 12 , 167–179 (2023). Lee, J. H., Shin, J. & Seo, J. T. Solar Power Plant Network Packet-Based Anomaly Detection System for Cybersecurity. Computers Mater. Continua . 77 , 757 (2023). Arqane, A., Boutkhoum, O., Boukhriss, H. & Moutaouakkil, A. E. L. Review-Intrusion Detection System using Ensemble Learning Approaches: A Systematic Literature Intrusion Detection System using Ensemble Learning Approaches: A Systematic Literature Review. https://doi.org/10.3991/ijoe.v18i13.33519 doi:10.3991/ijoe.v18i13.33519. Gbashi, S. M., Adedeji, P. A., Olatunji, O. O. & Madushele, N. Optimal feature selection for a weighted k-nearest neighbors for compound fault classification in wind turbine gearbox. Results Eng. 25 , 103791 (2025). Roopesh, Albert, B., Manuel, A. S. & Hemram, S. Developing an ML Model for Detecting the Cyber Attacks in Electric Vehicles. International Conference on Cognitive Robotics and Intelligent Systems, ICC - ROBINS 2024 776–781 (2024) 776–781 (2024) (2024). 10.1109/ICC-ROBINS60238.2024.10533886 Shang, W. et al. An Efficient Anomaly Detection Method for Industrial Control Systems: Deep Convolutional Autoencoding Transformer Network. International Journal of Intelligent Systems 5459452 (2024). (2024). Gao, J. et al. Omni SCADA Intrusion Detection Using Deep Learning Algorithms. IEEE Internet Things J. 8 , 951–961 (2021). Fährmann, D., Ihlefeld, M., Kuijper, A. & Damer, N. Resource-Efficient Anomaly Detection in Industrial Control Systems With Quantized Recurrent Variational Autoencoder. IET Collaborative Intell. Manuf. 7 , e70032 (2025). Musthafa, M. Real-Time Intrusion Detection Leveraging Deep Learning: A Comparative Analysis of CNN, RNN, and Transformer Architectures. International J. Adv. Eng. Manage. Sci. (IJAEMS) Peer-Reviewed Journal 11 , 2454–1311 . Nour, S. M. & Said, S. A. Deep Learning Performance Evaluation Model for Enhancing Network Intrusion Detection Systems. NILES –6th Novel Intelligent and Leading Emerging Sciences Conference, Proceedings 61–65 (2024) 61–65 (2024) (2024). 10.1109/NILES63360.2024.10753184 Siegel, B. Industrial Anomaly Detection: A Comparison of Unsupervised Neural Network Architectures. IEEE Sens. Lett 4 , (2020). Abd Elaziz, M., Ahmed Fares, I. & Aseeri, A. O. CKAN: Convolutional Kolmogorov-Arnold Networks Model for Intrusion Detection in IoT Environment. IEEE Access. 12 , 134837–134851 (2024). Saheed, Y. K., Misra, S. & Chockalingam, S. Autoencoder via DCNN and LSTM Models for Intrusion Detection in Industrial Control Systems of Critical Infrastructures. Proceedings – 2023 IEEE/ACM 4th International Workshop on Engineering and Cybersecurity of Critical Systems, EnCyCriS 2023 9–16 (2023). 10.1109/ENCYCRIS59249.2023.00006 Nazir, S., Patel, S. & Patel, D. Autoencoder Based Anomaly Detection for SCADA Networks. https://services.igi-global.com/resolvedoi/resolve.aspx?doi=10.4018/IJAIML.20210701.oa 6 11, 83–99 (1AD). Casajús-Setién, J., Bielza, C. & Larrañaga, P. Anomaly-Based Intrusion Detection in IIoT Networks Using Transformer Models. Proceedings of the IEEE International Conference on Cyber Security and Resilience, CSR 2023 72–77 (2023) 72–77 (2023) (2023). 10.1109/CSR57506.2023.10224965 Ortega-Fernandez, I., Sestelo, M. & Burguillo, J. C. & Piñón-Blanco, C. Network intrusion detection system for DDoS attacks in ICS using deep autoencoders. Wireless Networks 2023 30:6 30, 5059–5075 (2023). Ramos, L. S. & Yang, Z. LSTM-Based Detection of OT Cyber-Attacks for an Offshore HVAC-Cooling Process. IEEE 6th International Conference on Electronic Information and Communication Technology, ICEICT 2023 943–948 (2023) 943–948 (2023) (2023). 10.1109/ICEICT57916.2023.10245766 Ji, I., Jeon, S. & Seo, J. T. AE-LSTM Based Anomaly Detection System for Communication Over DNP 3.0. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 14402 LNCS, 91–104 (2024). Macas, M., Wu, C. & Fuertes, W. An Attention-Based Deep Generative Model for Anomaly Detection in Industrial Control Systems. International Conference on Web Information Systems and Technologies, WEBIST - Proceedings 566–577 (2024). 10.5220/0012264000003584 Basnet, M., Poudyal, S., Ali, M. H. & Dasgupta, D. Ransomware detection using deep learning in the SCADA system of electric vehicle charging station. 2021 IEEE PES Innovative Smart Grid Technologies Conference - Latin America, ISGT Latin America (2021). https://doi.org/10.1109/ISGTLATINAMERICA52371.2021.9543031 (2021) doi:10.1109/ISGTLATINAMERICA52371.2021.9543031. Eshmawi, A. A., Aldrees, A. & Alharthi, R. Smart framework for industrial IoT and cloud computing network intrusion detection using a ConvLSTM-based deep learning model. Front. Comput. Sci. 7 , 1622382 (2025). Alsaiari, A., Ilyas, M. A. & Hybrid, C. N. N. L. S. T. M. Deep Learning Model for Intrusion Detection in Smart Grid. SSRN Electron. J. https://doi.org/10.2139/ssrn.5446576 (2025). Zhang, Y., Zhang, L. & Zheng, X. Enhanced Intrusion Detection for ICS Using MS1DCNN and Transformer to Tackle Data Imbalance. Sens. 2024 . 24 , 7883 (2024). Harrou, F., Bouyeddou, B., Dairi, A. & Sun, Y. Exploiting Autoencoder-Based Anomaly Detection to Enhance Cybersecurity in Power Grids. Future Internet 2024 . 16 , 184 (2024). Mahi-Al-rashid, A., Hossain, F., Anwar, A. & Azam, S. False Data Injection Attack Detection in Smart Grid Using Energy Consumption Forecasting. Energies 2022 . 15 , 4877 (2022). Muhlburger, H., Wotawa, F. A. & Passive Testing Approach using a Semi-Supervised Intrusion Detection Model for SCADA Network Traffic. Proceedings – 4th IEEE International Conference on Artificial Intelligence Testing, AITest 2022 42–47 (2022). 10.1109/AITEST55621.2022.00015 Chu, A., Lai, Y. & Liu, J. Industrial Control Intrusion Detection Approach Based on Multiclassification GoogLeNet-LSTM Model. Security and Communication Networks 6757685 (2019). (2019). Alam, M., Abid, F., Guangpei, C. & Yunrong, L. V. Social media sentiment analysis through parallel dilated convolutional neural network for smart city applications. Comput. Commun. 154 , 129–137 (2020). Chauhan, V. K. & Kumar, A. Cascaded capsule twin attentional dilated convolutional network for malicious URL detection. Expert Syst. Appl. 262 , 125507 (2025). Qi, G., Mao, J., Huang, K., You, Z. & Lin, J. Multi-Head Attention Enhanced Parallel Dilated Convolution and Residual Learning for Network Traffic Anomaly Detection. Computers Mater. Continua . 82 , 2159 (2025). Hussen, N., Elghamrawy, S. M., Salem, M. & El-Desouky A. I. A Fully Streaming Big Data Framework for Cyber Security Based on Optimized Deep Learning Algorithm. IEEE Access. 11 , 65675–65688 (2023). Bjorck, N., Gomes, C. P., Selman, B. & Weinberger, K. Q. Understanding Batch Normalization. Adv Neural Inf. Process. Syst 31 , (2018). Kumar, A., HybridNet & Convolutions, D. Advancing Deepfake Detection Through Residual, SE, and IEEE Access. https://doi.org/10.1109/ACCESS.2025.3640106 doi:10.1109/ACCESS.2025.3640106. (2025). Kang, J., Jang, S., Li, S., Jeong, Y. S. & Sung, Y. Long short-term memory-based Malware classification method for information security. Comput. Electr. Eng. 77 , 366–375 (2019). Heddam, S. et al. A long short-term memory deep learning approach for river water temperature prediction. Current Trends and Advances in Computer-Aided Intelligent Environmental Data Engineering: A . Intell. Data-Centric Syst. 243–270. 10.1016/B978-0-323-85597-6.00015-X (2022). Laghrissi, F. E., Douzi, S., Douzi, K. & Hssina, B. Intrusion detection systems using long short-term memory (LSTM). Journal of Big Data 2021 8:1 8, 65- (2021). Zolanvari, M., Teixeira, M. A., Gupta, L., Khan, K. M. & Jain, R. Machine Learning-Based Network Vulnerability Analysis of Industrial Internet of Things. IEEE Internet Things J. 6 , 6822–6834 (2019). Additional Declarations No competing interests reported. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-8628547","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Article","associatedPublications":[],"authors":[{"id":591410659,"identity":"2a02c884-42fe-4042-ade3-729078c0afaf","order_by":0,"name":"Onur polat","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA4UlEQVRIiWNgGAWjYHACxgMMDDYJbCDmAyCvgRg9BxgS0iBaEsBamInScjiBgWgt/NLNBw78/HE+j0+6/eKDBAYb2Q0H+I99wKdFcs6xhIM9CbeL2WTOFBskMKQZbzjAzDwDnxaDGzkGB3gSbie2SeSkSSQwHE4EacHrMJCWg38SzsG0/CdOy2GehANALenHgFoOENYC8sthmbTkYjaJHGaDBINk45mHmY3xagGG2MGHb2zs8uRnpD988KHCTrbveONjvFoYJOAsHgOgO4E0wZhEaGF/QEjtKBgFo2AUjFAAAOPeTU0FWTn9AAAAAElFTkSuQmCC","orcid":"","institution":"Bingöl University","correspondingAuthor":true,"prefix":"","firstName":"Onur","middleName":"","lastName":"polat","suffix":""},{"id":591410660,"identity":"4143e1ab-7e49-4d50-a812-a1fa932cf974","order_by":1,"name":"Sümeyya BULUT","email":"","orcid":"","institution":"Bingöl University","correspondingAuthor":false,"prefix":"","firstName":"Sümeyya","middleName":"","lastName":"BULUT","suffix":""}],"badges":[],"createdAt":"2026-01-17 23:53:10","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-8628547/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-8628547/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":102840844,"identity":"d8ab030d-8e23-4022-bdb8-8ec4eac05710","added_by":"auto","created_at":"2026-02-17 12:02:17","extension":"png","order_by":1,"title":"Figure 1","display":"","copyAsset":false,"role":"figure","size":46066,"visible":true,"origin":"","legend":"\u003cp\u003eSCADA System Architecture\u003c/p\u003e","description":"","filename":"Onlinefloatimage1.png","url":"https://assets-eu.researchsquare.com/files/rs-8628547/v1/166dc06b5ad91693321eaa6c.png"},{"id":102840846,"identity":"e0a61515-a77f-48ac-bbd3-8ad2fbdb9d1f","added_by":"auto","created_at":"2026-02-17 12:02:17","extension":"png","order_by":2,"title":"Figure 2","display":"","copyAsset":false,"role":"figure","size":262819,"visible":true,"origin":"","legend":"\u003cp\u003eStructure of the Proposed Hybrid Architecture\u003c/p\u003e","description":"","filename":"floatimage2.png","url":"https://assets-eu.researchsquare.com/files/rs-8628547/v1/3129f2b416c8fc6be548ab6f.png"},{"id":102962847,"identity":"5790753f-41ab-4120-b49e-08403748d645","added_by":"auto","created_at":"2026-02-19 04:11:39","extension":"png","order_by":3,"title":"Figure 3","display":"","copyAsset":false,"role":"figure","size":354845,"visible":true,"origin":"","legend":"\u003cp\u003eLSTM structure [82]\u003c/p\u003e","description":"","filename":"floatimage3.png","url":"https://assets-eu.researchsquare.com/files/rs-8628547/v1/4b053082da803a1fca76b7c6.png"},{"id":102840849,"identity":"30307050-d163-4643-9785-91f92830f25a","added_by":"auto","created_at":"2026-02-17 12:02:17","extension":"png","order_by":4,"title":"Figure 4","display":"","copyAsset":false,"role":"figure","size":271301,"visible":true,"origin":"","legend":"\u003cp\u003eGeneral design of the virtualized SCADA architecture created to obtain the dataset.\u003c/p\u003e\n\u003cp\u003eThe roles of virtual machines used in the virtual laboratory environment and their task definitions are summarized in Table 4\u003c/p\u003e","description":"","filename":"floatimage4.png","url":"https://assets-eu.researchsquare.com/files/rs-8628547/v1/fce2b6a5060cc416c7b454e2.png"},{"id":102840848,"identity":"4e3e81f8-59c7-42dd-a4ad-bd43ea3eeeb0","added_by":"auto","created_at":"2026-02-17 12:02:17","extension":"png","order_by":5,"title":"Figure 5","display":"","copyAsset":false,"role":"figure","size":226817,"visible":true,"origin":"","legend":"\u003cp\u003e5-Fold Combined Confusion Matrix for the SCADANet Dataset\u003c/p\u003e","description":"","filename":"floatimage5.png","url":"https://assets-eu.researchsquare.com/files/rs-8628547/v1/770d60bf217030dfaef61c2f.png"},{"id":102840845,"identity":"d15218bc-a637-4a9a-906e-9ac4c5159f09","added_by":"auto","created_at":"2026-02-17 12:02:17","extension":"png","order_by":6,"title":"Figure 6","display":"","copyAsset":false,"role":"figure","size":127629,"visible":true,"origin":"","legend":"\u003cp\u003e5-Fold Combined Confusion Matrix for the WUSTL-IIoT-2021 Dataset\u003c/p\u003e","description":"","filename":"floatimage6.png","url":"https://assets-eu.researchsquare.com/files/rs-8628547/v1/d490a9854f5d047e34a80e6c.png"},{"id":105440512,"identity":"1e177926-1ea7-42e7-9594-d9a427b40879","added_by":"auto","created_at":"2026-03-26 05:41:29","extension":"pdf","order_by":0,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":3091649,"visible":true,"origin":"","legend":"","description":"","filename":"manuscript.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8628547/v1/d25a08d5-8b0b-4adb-95bc-f406e943628e.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"A Multi-Component Deep Learning Approach for Cyber Attack Detection in Critical Infrastructure SCADA Systems","fulltext":[{"header":"1. Introduction","content":"\u003cdiv id=\"Sec2\" class=\"Section2\"\u003e \u003ch2\u003e1.1. The Importance of Critical Infrastructure Systems in Cyber Security\u003c/h2\u003e \u003cp\u003eSystems with critical infrastructure such as energy, healthcare, transportation, and financial services are essential and necessary for the natural flow of life. A large portion of such systems are managed using Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS) technologies [\u003cspan citationid=\"CR1\" class=\"CitationRef\"\u003e1\u003c/span\u003e, \u003cspan citationid=\"CR2\" class=\"CitationRef\"\u003e2\u003c/span\u003e]. There are numerous sensors and IoT devices within the system (Fig.\u0026nbsp;\u003cspan refid=\"Fig1\" class=\"InternalRef\"\u003e1\u003c/span\u003e). These types of devices create a data flow traffic that enables data exchange within the system. Data is collected in systems such as SCADA and ICS, and control processes are carried out. The ability to manage systems remotely creates a natural cybersecurity requirement within the system. To ensure the continuity of the services provided by critical infrastructure, the system must be protected against external attacks [\u003cspan citationid=\"CR3\" class=\"CitationRef\"\u003e3\u003c/span\u003e].\u003c/p\u003e \u003cp\u003eThe devices within these critical infrastructure systems are highly interconnected. An attack on the system could potentially affect the entire system. A vulnerability in the system does not only cause a malfunction in the system. External factors connected to the system may also suffer damage [\u003cspan citationid=\"CR4\" class=\"CitationRef\"\u003e4\u003c/span\u003e]. For example, an attack on the electricity grid could halt electricity production. This would negatively affect hospitals, industrial enterprises, public services, traffic services, and many other processes that require electricity. The process can cause chaos, economic losses, and negatively impact the natural life cycle [\u003cspan citationid=\"CR5\" class=\"CitationRef\"\u003e5\u003c/span\u003e]. At the forefront of these threats are Denial of Service (DoS) attacks and Advanced Persistent Threats (APT). These attacks occur quite frequently, slowing down or obstructing the operation of the system [\u003cspan citationid=\"CR5\" class=\"CitationRef\"\u003e5\u003c/span\u003e, \u003cspan citationid=\"CR6\" class=\"CitationRef\"\u003e6\u003c/span\u003e].\u003c/p\u003e \u003cp\u003e \u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec3\" class=\"Section2\"\u003e \u003ch2\u003e1.2. Cyber Threats Targeting SCADA Systems\u003c/h2\u003e \u003cp\u003eCyber security is extremely important for critical infrastructure that includes SCADA and IDS systems. Detecting attacks on this infrastructure is more complex and difficult than detecting attacks on traditional environments [\u003cspan citationid=\"CR7\" class=\"CitationRef\"\u003e7\u003c/span\u003e]. Industrial systems lack inherent security features such as Modbus/TCP, encryption, authentication, and integrity checks. This makes such systems vulnerable to various attacks [\u003cspan citationid=\"CR8\" class=\"CitationRef\"\u003e8\u003c/span\u003e]. Security flaws in the system are seen as an opportunity by attackers, who inject commands that negatively impact communication flows [\u003cspan citationid=\"CR2\" class=\"CitationRef\"\u003e2\u003c/span\u003e]. Attacks are evolving daily, posing serious threats to the system.\u003c/p\u003e \u003cp\u003eAdvanced attack techniques such as Flood Attacks, Wrong Command Injection, and DoS attacks pose serious threats to industrial systems such as SCADA. In flood attacks, attackers corrupt Modbus/TCP packets to prevent the controller from interpreting commands or to cause unsafe scenarios [\u003cspan citationid=\"CR8\" class=\"CitationRef\"\u003e8\u003c/span\u003e]. In false command injection attacks, attackers attempt to inject commands by hiding behind repetitive responses from the SCADA operator. This can cause significant damage [\u003cspan citationid=\"CR2\" class=\"CitationRef\"\u003e2\u003c/span\u003e]. While traditional DoS attacks focus on disrupting the service on the system, protocol-specific DoS attacks focus on security vulnerabilities in Modbus/TCP protocols in order to disrupt communication [\u003cspan citationid=\"CR9\" class=\"CitationRef\"\u003e9\u003c/span\u003e].\u003c/p\u003e \u003cp\u003eThe diversification of protocol-specific attacks highlights the necessity of significant detection mechanisms on SCADA traffic.\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec4\" class=\"Section2\"\u003e \u003ch2\u003e1.3. Challenges in Attack Detection in Critical Systems\u003c/h2\u003e \u003cp\u003eAttack and anomaly detection in systems such as SCADA and IDS presents various challenges. Examples include the need for real-time operation, low tolerance for false alarms, unbalanced data sets, detection of covert attacks, and the cost associated with high false alarm rates [\u003cspan citationid=\"CR10\" class=\"CitationRef\"\u003e10\u003c/span\u003e].\u003c/p\u003e \u003cp\u003eDelays in the system during an attack can cause significant interruptions. This situation can bring the system to a partial or complete standstill [\u003cspan citationid=\"CR11\" class=\"CitationRef\"\u003e11\u003c/span\u003e]. SCADA and IDS systems have low tolerance for false alarms due to their infrastructure. High false alarm rates can cause unnecessary interruptions. This leads to a waste of resources. In an environment where a SCADA system is present, data is unstable and multidimensional. This makes detecting unauthorised access difficult. Furthermore, the cost of false alarms in the system can lead to unnecessary interventions. A system with ineffective intrusion detection must balance detection accuracy with the cost implications of false alarms [\u003cspan citationid=\"CR12\" class=\"CitationRef\"\u003e12\u003c/span\u003e, \u003cspan citationid=\"CR13\" class=\"CitationRef\"\u003e13\u003c/span\u003e].\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec5\" class=\"Section2\"\u003e \u003ch2\u003e1.4. Limitations of Traditional IDS Approaches\u003c/h2\u003e \u003cp\u003eVarious detection and mitigation strategies exist for such attacks on systems. Examples include anomaly detection systems, Intrusion Detection Systems (IDS), and cryptographic systems. Approaches that monitor Modbus/TCP operations can detect abnormal traffic in anomaly detection. They can also respond quickly to DoS and command injection attacks [\u003cspan citationid=\"CR14\" class=\"CitationRef\"\u003e14\u003c/span\u003e]. Cryptographic systems can ensure that Modbus/TCP communications are sent with end-to-end confidentiality using encryption algorithms such as ASCON. IDS systems, on the other hand, adopt an anomaly detection-based approach [\u003cspan citationid=\"CR7\" class=\"CitationRef\"\u003e7\u003c/span\u003e, \u003cspan citationid=\"CR15\" class=\"CitationRef\"\u003e15\u003c/span\u003e]. Although various methods have been developed to detect cyber threats in systems, it is a very challenging process.\u003c/p\u003e \u003cp\u003eTraditional Intrusion Detection Systems (IDS) are an important issue in network security. However, they are inadequate against advanced cyber threats. Signature-based detection systems, rule-based detection systems, and statistical methods in this type of detection system often fail to provide sufficient performance. Advanced techniques based on artificial intelligence and deep learning must be incorporated to address these limitations.\u003c/p\u003e \u003cp\u003eSignature-based threats require signature-based IDs for detection. Predefined signatures are needed to detect threats. Previously encountered and documented attacks can be identified. These attacks demonstrate the system's ineffectiveness against zero-day attacks and new types of attacks that do not match existing signatures. Signature-based protection requires the system to be constantly updated. This creates a vulnerability in delayed update processes and implies limitations for this type of attack [\u003cspan citationid=\"CR16\" class=\"CitationRef\"\u003e16\u003c/span\u003e]. Attackers model these known attacks and circumvent them by making slight changes to render the system ineffective [\u003cspan citationid=\"CR17\" class=\"CitationRef\"\u003e17\u003c/span\u003e].\u003c/p\u003e \u003cp\u003eRule-based systems act according to predefined rules and present an approach against threats. This creates a system that is vulnerable to complex and advanced attacks. Furthermore, networks expand day by day. In rule-based systems, new rules continue to increase for expanding networks. This situation causes a decrease in the scalability and performance of the network [\u003cspan citationid=\"CR18\" class=\"CitationRef\"\u003e18\u003c/span\u003e].\u003c/p\u003e \u003cp\u003eIn statistical methods, there is fundamental network behaviour. Even if the network is well defined, it struggles in the face of evolving threats. It performs poorly against evolving threats. Consequently, it may misinterpret normal behaviour in network traffic. The false positive rate increases and may cause false negatives [\u003cspan citationid=\"CR19\" class=\"CitationRef\"\u003e19\u003c/span\u003e]. Statistical approaches lack contextual understanding in distinguishing between benign and malicious network traffic. Therefore, the likelihood of misclassification is higher [\u003cspan citationid=\"CR20\" class=\"CitationRef\"\u003e20\u003c/span\u003e].\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec6\" class=\"Section2\"\u003e \u003ch2\u003e1.5. The Rise of Deep Learning-Based Approaches\u003c/h2\u003e \u003cp\u003eTraditional methods used in threat detection and attack identification within cybersecurity systems are proving inadequate in the face of increasing complexity. The search for more effective ways to detect attacks has led to studies focusing on deep learning and artificial neural network-based approaches, which have demonstrated success. Convolutional Neural Networks (CNN), Recurrent Neural Networks (RNN), Long Short-Term Memory (LSTM) networks, and hybrid deep learning (DL) models demonstrate more resilient approaches against emerging threats. The adaptability of these models, their high accuracy, and their ability to process various data types contribute significantly to the field of cybersecurity. These methods are prominent in processes such as unauthorised access detection, malware detection, and anomaly detection.\u003c/p\u003e \u003cp\u003eAgainst cybersecurity threats, patterns in data packets can be identified using CNN architectures. This has enabled the creation of a detection system framework that can be adapted to network traffic [\u003cspan citationid=\"CR21\" class=\"CitationRef\"\u003e21\u003c/span\u003e]. This approach has been seen to achieve over 98% performance in network traffic with both binary and multi-class classification capabilities [\u003cspan citationid=\"CR22\" class=\"CitationRef\"\u003e22\u003c/span\u003e]. It is noted that CNNs effectively analyse network traffic modelling by leveraging the spatiality of the data [\u003cspan citationid=\"CR23\" class=\"CitationRef\"\u003e23\u003c/span\u003e].\u003c/p\u003e \u003cp\u003eMethods such as RNN and LSTM are highly effective in analysing data arranged in sequences. They are ideal methods for detecting attacks in unauthorised access detection systems for network traffic [\u003cspan citationid=\"CR24\" class=\"CitationRef\"\u003e24\u003c/span\u003e, \u003cspan citationid=\"CR25\" class=\"CitationRef\"\u003e25\u003c/span\u003e]. LSTMs have been shown to perform well in detecting cyber threats, achieving over 96% accuracy. Studies have also shown that they are superior to CNN in some cases [\u003cspan citationid=\"CR26\" class=\"CitationRef\"\u003e26\u003c/span\u003e, \u003cspan citationid=\"CR27\" class=\"CitationRef\"\u003e27\u003c/span\u003e].\u003c/p\u003e \u003cp\u003eVarious hybrid methods combining techniques such as CNN and LSTM are used in the field of cyber security. Combining the strengths of CNN and LSTM yields high accuracy. They are more effective in detecting threats by processing spatial and temporal data. Accuracy rates above 98% in multi-classification studies using hybrid models demonstrate the importance of these methods [\u003cspan citationid=\"CR28\" class=\"CitationRef\"\u003e28\u003c/span\u003e].\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec7\" class=\"Section2\"\u003e \u003ch2\u003e1.6. Motivation and Contributions of This Study\u003c/h2\u003e \u003cp\u003eThere is a growing need for real-time systems with low false alarms in networks with SCADA and IDS-based critical infrastructure. Traditional security systems are inadequate against evolving attacks. Attackers embedding attacks within normal traffic flows and class imbalance in data sets further increase the need to research more effective methods. Advanced methods such as deep learning ensure not only high accuracy but also high sensitivity in classes with data imbalance. Therefore, new and effective deep learning models to be developed will be highly valuable for protecting such systems. This study proposes a SCADANet dataset that realistically represents different attack scenarios specific to SCADA. Furthermore, a hybrid deep learning architecture capable of modelling multi-scale and time dependencies well in attacks has been proposed. This work aims to contribute to the literature and fill an important gap. The contributions of this study can be summarised as follows:\u003c/p\u003e \u003cp\u003e \u003cstrong\u003eSCADA-specific SCADANet dataset\u003c/strong\u003e \u003cp\u003eA virtual environment has been created within a completely isolated environment with a SCADA-based structure. In this environment, Modbus/TCP and ICMP/HTTP, which are present in background traffic, have been generated together. The attack scenario has been generated concurrently and embedded within the normal network traffic flow. The dataset consists of normal traffic data and a dataset comprising 9 attacks (SYN/ACK/UDP/ICMP/HTTP Flood, SQLi, Port Scan, Vuln Scan, OS Scan).\u003c/p\u003e \u003c/p\u003e \u003cp\u003e \u003cstrong\u003eFlow richness\u003c/strong\u003e \u003cp\u003eMulti-layered attributes were extracted for raw packets on the network. JA4+-based fingerprint features capable of distinguishing attacks with particularly low volume in network traffic were obtained.\u003c/p\u003e \u003c/p\u003e \u003cp\u003e \u003cstrong\u003eNovel hybrid architecture\u003c/strong\u003e \u003cp\u003eParallel dilated Conv1D was used to extract short- and long-range features in the SCADA system. A Residuan-SE block was added to increase representational power. A hybrid method that also learns time dependencies using LSTM was presented.\u003c/p\u003e \u003c/p\u003e \u003cp\u003e \u003cstrong\u003eA balanced approach to imbalanced data classes\u003c/strong\u003e \u003cp\u003eDespite data imbalance, a two-stage optimisation was applied using Focal Loss and class weights. This has ensured increased sensitivity in minority classes.\u003c/p\u003e \u003c/p\u003e \u003cp\u003e \u003cstrong\u003eConductivity\u003c/strong\u003e \u003cp\u003eThe proposed hybrid method was applied both to the created dataset and to the WUSTL-IIoT-2021 dataset [\u003cspan citationid=\"CR29\" class=\"CitationRef\"\u003e29\u003c/span\u003e], which is frequently used in the literature. This demonstrates that the hybrid method is not dependent on the dataset and is conductive.\u003c/p\u003e \u003c/p\u003e \u003cp\u003e \u003cstrong\u003eRobust evaluation metrics\u003c/strong\u003e \u003cp\u003eThe training and test data in the dataset used in the study were evaluated using 5-fold cross-validation and accuracy, macro/weighted precision, recall, and F1 metrics. Furthermore, errors were detailed using confusion matrices.\u003c/p\u003e \u003c/p\u003e \u003cp\u003e \u003cstrong\u003eModel ablation study\u003c/strong\u003e \u003cp\u003eResults obtained when Dilated CNN, LSTM, and Res-SE were removed are presented, demonstrating the performance of the hybrid model.\u003c/p\u003e \u003c/p\u003e \u003c/div\u003e"},{"header":"2. Literature Review","content":"\u003cdiv id=\"Sec9\" class=\"Section2\"\u003e \u003ch2\u003e2.1. Cyber Attacks Targeting SCADA and Industrial Control Systems\u003c/h2\u003e \u003cp\u003eAttacks against SCADA and IDS systems are increasing day by day. These attacks target different points within such systems. Each type of attack has its own target. Reconnaissance attacks gather information about the SCADA system and map its architectural structure. Weak points in the architecture are identified by scanning with network tools [\u003cspan citationid=\"CR30\" class=\"CitationRef\"\u003e30\u003c/span\u003e]. In command and measurement injection attacks, commands are sent to manipulate the system. These deceptive commands cause adverse behaviour in the system and can lead to physical damage and system interruptions. DoS attacks flood the system with unnecessary data traffic. This causes disruption to the services running on the system. They aim to render the system unusable due to protocol weaknesses [\u003cspan citationid=\"CR31\" class=\"CitationRef\"\u003e31\u003c/span\u003e]. Malicious software attacks attempt to gain unauthorised access. Once access is gained, data is stolen or used to interrupt operations [\u003cspan citationid=\"CR32\" class=\"CitationRef\"\u003e32\u003c/span\u003e]. Hijacking and blackout attacks focus on taking control of the system and shutting it down completely. Traditional IDS systems exploit protocol-based vulnerabilities [\u003cspan citationid=\"CR33\" class=\"CitationRef\"\u003e33\u003c/span\u003e]. Replay and fragmentation attacks focus on capturing data packets. These packets are resent, causing process interruptions [\u003cspan citationid=\"CR34\" class=\"CitationRef\"\u003e34\u003c/span\u003e, \u003cspan citationid=\"CR35\" class=\"CitationRef\"\u003e35\u003c/span\u003e]. Such attacks on the world cause various damages. Some of these attacks are summarised in Table\u0026nbsp;\u003cspan refid=\"Tab1\" class=\"InternalRef\"\u003e1\u003c/span\u003e.\u003c/p\u003e \u003cp\u003e \u003cdiv class=\"gridtable\"\u003e\u003ctable float=\"Yes\" id=\"Tab1\" border=\"1\"\u003e \u003ccaption language=\"En\"\u003e \u003cdiv class=\"CaptionNumber\"\u003eTable 1\u003c/div\u003e \u003cdiv class=\"CaptionContent\"\u003e \u003cp\u003eSome attacks on SCADA and ICS systems and their effects\u003c/p\u003e \u003c/div\u003e \u003c/caption\u003e \u003ccolgroup cols=\"6\"\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c1\" colnum=\"1\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c2\" colnum=\"2\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c3\" colnum=\"3\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c4\" colnum=\"4\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c5\" colnum=\"5\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c6\" colnum=\"6\"\u003e\u003c/div\u003e \u003cthead\u003e \u003ctr\u003e \u003cth align=\"left\" colname=\"c1\"\u003e \u003cp\u003eName of Attack\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c2\"\u003e \u003cp\u003eTarget\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c3\"\u003e \u003cp\u003eAttack Centre\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c4\"\u003e \u003cp\u003eYear\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c5\"\u003e \u003cp\u003eCountry /Region\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c6\"\u003e \u003cp\u003eImpact\u003c/p\u003e \u003c/th\u003e \u003c/tr\u003e \u003c/thead\u003e \u003ctbody\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eStuxnet [\u003cspan citationid=\"CR36\" class=\"CitationRef\"\u003e36\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eSCADA/ICS\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eIran's Natanz Nuclear Facility\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003e2010\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c5\"\u003e \u003cp\u003eIran\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c6\"\u003e \u003cp\u003ePhysical damage and disruption of operations in centrifuges through manipulation of PLC/SCADA systems\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eBlackEnergy (2015 Ukraine Power Grid) [\u003cspan citationid=\"CR37\" class=\"CitationRef\"\u003e37\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eSCADA/ICS\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eUkrainian Electricity Grid (transmission/distribution)\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003e2015\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c5\"\u003e \u003cp\u003eUkraine\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c6\"\u003e \u003cp\u003ePower outages (affecting approximately 230,000 users) caused the remote SCADA system to shut down.\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eTriton / Trisis [\u003cspan citationid=\"CR38\" class=\"CitationRef\"\u003e38\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eSCADA/ICS\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eTriconex SIS in a petrochemical plant in the Middle East\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003e2017\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c5\"\u003e \u003cp\u003eMiddle East (Arabia)\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c6\"\u003e \u003cp\u003eSecurity was disabled by targeting the SIS logic.\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eHavex (Backdoor.Oldrea) [\u003cspan citationid=\"CR39\" class=\"CitationRef\"\u003e39\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eSCADA/ICS\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eEuropean energy companies\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003e2013\u0026ndash;2014\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c5\"\u003e \u003cp\u003eEurope (primarily the energy sector)\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c6\"\u003e \u003cp\u003eInformation gathered for reconnaissance\u0026mdash;sabotage in ICS/OPC environments\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eDragonfly (Energetic Bear) [\u003cspan citationid=\"CR40\" class=\"CitationRef\"\u003e40\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eSCADA/ICS\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eEuropean \u0026amp; US energy companies\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003e2010\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c5\"\u003e \u003cp\u003eGlobal (critical infrastructure/energy)\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c6\"\u003e \u003cp\u003eSupply chain\u0026thinsp;+\u0026thinsp;spearphishing\u0026thinsp;+\u0026thinsp;drive-by to infiltrate and explore the system\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eIDS Evasion via Fragroute [\u003cspan citationid=\"CR41\" class=\"CitationRef\"\u003e41\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eIDS\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eGeneral IDS systems\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003e1998 / 2002\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c5\"\u003e \u003cp\u003e\u0026mdash;\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c6\"\u003e \u003cp\u003eMisinterpretation of traffic by IDS due to packet fragmentation/rewriting, etc., detection prevention\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eSnort IDS Evasion [\u003cspan citationid=\"CR41\" class=\"CitationRef\"\u003e41\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eIDS\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eNetworks using Snort\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003e1998+\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c5\"\u003e \u003cp\u003e\u0026mdash;\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c6\"\u003e \u003cp\u003eDue to differences such as reassembly/fragmentation, Snort risks missing some scenarios (if there is no correct pre-processor/normaliser).\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eShamoon [\u003cspan citationid=\"CR42\" class=\"CitationRef\"\u003e42\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eSCADA (indirect)\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eSaudi Aramco (IT network; OT integrations may be affected)\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003e2012\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c5\"\u003e \u003cp\u003eSaudi Arabia\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c6\"\u003e \u003cp\u003eWidespread wiper effect; reports indicate that approximately 30,000 computers were affected.\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003c/tbody\u003e \u003c/colgroup\u003e \u003c/table\u003e\u003c/div\u003e \u003c/p\u003e \u003cp\u003eAttacks on SCADA and ICS systems, which cause physical and operational damage, are detailed in Table\u0026nbsp;\u003cspan refid=\"Tab1\" class=\"InternalRef\"\u003e1\u003c/span\u003e. The extent of the damage these attacks cause to countries and people is evident.\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec10\" class=\"Section2\"\u003e \u003ch2\u003e2.2. Traditional SCADA Attack Detection Methods\u003c/h2\u003e \u003cp\u003eAttacks on SCADA and IDS systems cause significant physical and operational damage to the system. Various methods and approaches have been developed to prevent these attacks. Efforts to prevent and detect attacks on systems are documented in the literature as traditional detection methods, machine learning methods, deep learning-based methods, and hybrid methods. Among these methods, traditional attack detection includes signature-based intrusion detection systems (IDS), rule-based approaches, and anomaly-based statistical models.\u003c/p\u003e \u003cp\u003eIDS-based systems are designed to prevent unauthorised access based on predefined patterns and signatures of known threats. It is an effective method for detecting known attacks. However, it is not successful in detecting new or unknown threats. They are preferred because they are simple and have a low false positive rate [\u003cspan citationid=\"CR43\" class=\"CitationRef\"\u003e43\u003c/span\u003e]. A study by Tripathi and colleagues indicated that zero-day attacks and new types of unauthorised access techniques, which are becoming widespread in SCADA systems, cannot be detected by traditional signature-based detection systems [\u003cspan citationid=\"CR44\" class=\"CitationRef\"\u003e44\u003c/span\u003e]. In rule-based detection systems, experts or past information are used to identify suspicious activities. In his study, Sayghe indicated that rule-based systems can be successful in certain operations [\u003cspan citationid=\"CR10\" class=\"CitationRef\"\u003e10\u003c/span\u003e]. Okpeseyi and colleagues, however, stated that rule-based systems are weak against evolving threats and that rules in such systems need to be constantly updated [\u003cspan citationid=\"CR13\" class=\"CitationRef\"\u003e13\u003c/span\u003e].\u003c/p\u003e \u003cp\u003eIn statistical detection methods based on anomalies, deviations from normal behaviour patterns are taken into account. Statistical models and deviations are evaluated to define abnormal behaviour. Known attacks are not trusted for general purposes. Therefore, it provides better attack detection against new attacks compared to other traditional models. This approach appears to be slightly more suitable for dynamic environments such as SCADA [\u003cspan citationid=\"CR45\" class=\"CitationRef\"\u003e45\u003c/span\u003e]. Ahakonye and colleagues have stated that detection using statistical models in SCADA systems is a challenging process, as natural flows can be mistakenly perceived as threats. For this reason, they have demonstrated a tendency to produce false positives [\u003cspan citationid=\"CR46\" class=\"CitationRef\"\u003e46\u003c/span\u003e].\u003c/p\u003e \u003cp\u003eTraditional detection systems show that while it is possible to detect known attacks in the system, it is difficult to detect new types of attacks using such methods.\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec11\" class=\"Section2\"\u003e \u003ch2\u003e2.3. Machine Learning-Based SCADA Attack Detection\u003c/h2\u003e \u003cp\u003eUnlike traditional methods, machine learning methods are more successful in detecting attacks on SCADA systems. Various machine learning methods offer advantages. The literature includes machine learning methods that enable the detection of attacks on SCADA systems, such as Support Vector Machines (SVM), Decision Trees (DT), Random Forest, k-Nearest Neighbour (k-NN), and XGBoost. Patil demonstrated in his study that attacks on SCADA-based systems can be detected with a low error rate [\u003cspan citationid=\"CR47\" class=\"CitationRef\"\u003e47\u003c/span\u003e]. Sukhadeo et al. classified attacks using random forest and k-KNN on the NSL-KDD dataset [\u003cspan citationid=\"CR48\" class=\"CitationRef\"\u003e48\u003c/span\u003e]. Lee et al. achieved a result of 95% in detecting attacks in SCADA systems using SVM and XGBoost methods [\u003cspan citationid=\"CR49\" class=\"CitationRef\"\u003e49\u003c/span\u003e]. When the studies are examined, it is seen that feature extraction has a high impact on performance in machine learning-based detection. In another study employing various feature extractions, redundant fields were eliminated and generalisability was improved [\u003cspan citationid=\"CR49\" class=\"CitationRef\"\u003e49\u003c/span\u003e]. Overall, the achieved performance exceeds 90% in the studies conducted. Some examples of studies using machine learning methods are shown in Table\u0026nbsp;\u003cspan refid=\"Tab2\" class=\"InternalRef\"\u003e2\u003c/span\u003e.\u003c/p\u003e \u003cp\u003e \u003cdiv class=\"gridtable\"\u003e\u003ctable float=\"Yes\" id=\"Tab2\" border=\"1\"\u003e \u003ccaption language=\"En\"\u003e \u003cdiv class=\"CaptionNumber\"\u003eTable 2\u003c/div\u003e \u003cdiv class=\"CaptionContent\"\u003e \u003cp\u003eStudies conducted using various machine learning methods and feature selections.\u003c/p\u003e \u003c/div\u003e \u003c/caption\u003e \u003ccolgroup cols=\"5\"\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c1\" colnum=\"1\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c2\" colnum=\"2\"\u003e\u003c/div\u003e \u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c3\" colnum=\"3\"\u003e\u003c/div\u003e \u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c4\" colnum=\"4\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c5\" colnum=\"5\"\u003e\u003c/div\u003e \u003cthead\u003e \u003ctr\u003e \u003cth align=\"left\" colname=\"c1\"\u003e \u003cp\u003eMethod\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c2\"\u003e \u003cp\u003eFeature Selection\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c3\"\u003e \u003cp\u003eRate of Success\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c4\"\u003e \u003cp\u003eNumber of Classes\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c5\"\u003e \u003cp\u003eDescription\u003c/p\u003e \u003c/th\u003e \u003c/tr\u003e \u003c/thead\u003e \u003ctbody\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eSVM [\u003cspan citationid=\"CR49\" class=\"CitationRef\"\u003e49\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003ePCA\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e \u003cp\u003e%93.5\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e5\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c5\"\u003e \u003cp\u003eLinear SVM worked with high accuracy for normal and 4 attack classes in SCADA data\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eSVM [\u003cspan citationid=\"CR50\" class=\"CitationRef\"\u003e50\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eRecursive FS\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e \u003cp\u003e%90.2\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e2\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c5\"\u003e \u003cp\u003eBinary classification (attack/normal) for industrial IDS; kernel-based SVM was used\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eRandom Forest [\u003cspan citationid=\"CR47\" class=\"CitationRef\"\u003e47\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eInformation Gain\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e \u003cp\u003e%95.1\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e4\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c5\"\u003e \u003cp\u003eHigh performance with low overfitting on SCADA network traffic\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eRandom Forest [\u003cspan citationid=\"CR48\" class=\"CitationRef\"\u003e48\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eChi-Square\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e \u003cp\u003e%97.3\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e5\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c5\"\u003e \u003cp\u003eNSL-KDD-based IDS design; robust against class imbalance\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003ek-NN [\u003cspan citationid=\"CR49\" class=\"CitationRef\"\u003e49\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eCorrelation Based FS\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e \u003cp\u003e%92.4\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e4\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c5\"\u003e \u003cp\u003eBased on PLC data; the best results were obtained with k\u0026thinsp;=\u0026thinsp;5\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003ek-NN [\u003cspan citationid=\"CR51\" class=\"CitationRef\"\u003e51\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eRelief-F\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e \u003cp\u003e%94.2\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e3\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c5\"\u003e \u003cp\u003eMore stable results with weighted distance metrics in the SCADA system\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eXGBoost [\u003cspan citationid=\"CR52\" class=\"CitationRef\"\u003e52\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eMutual Information\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e \u003cp\u003e%98.6\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e5\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c5\"\u003e \u003cp\u003eXGBoost delivered more stable and faster results than other models\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eXGBoost[\u003cspan citationid=\"CR52\" class=\"CitationRef\"\u003e52\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eRandom Feature Subset\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e \u003cp\u003e%96.8\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e6\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c5\"\u003e \u003cp\u003eRobust results against different types of attacks in SCADA power grid networks\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eLightGBM[\u003cspan citationid=\"CR52\" class=\"CitationRef\"\u003e52\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eL1 Regularization\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e \u003cp\u003e%95.4\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e5\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c5\"\u003e \u003cp\u003eSimilar accuracy with lower resource usage compared to XGBoost\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003c/tbody\u003e \u003c/colgroup\u003e \u003c/table\u003e\u003c/div\u003e \u003c/p\u003e \u003cp\u003eStudies conducted on machine learning methods have shown that they achieve higher performance than traditional methods. Research indicates that the most significant reason for this performance is due to feature selection.\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec12\" class=\"Section2\"\u003e \u003ch2\u003e2.4. Deep Learning-Based SCADA Security Solutions\u003c/h2\u003e \u003cp\u003eMore advanced attack detection methods in SCADA-based systems are deep learning-based methods. These are known as Convolution Neural Network (CNN), Long-Short Term Memory (LSTM), Auto Encoder, and Transformer Models. CNN models are widely used for detection in such systems. They struggle with temporal dependencies in the data. However, they stand out due to their computational efficiency and speed [\u003cspan citationid=\"CR53\" class=\"CitationRef\"\u003e53\u003c/span\u003e]. LSTMs are particularly better at processing sequential data. This provides more effective learning in detecting related attacks. They require strong recall rates and computational resources [\u003cspan citationid=\"CR54\" class=\"CitationRef\"\u003e54\u003c/span\u003e]. It is noted that unsupervised methods based on autoencoders perform well in classification problems [\u003cspan citationid=\"CR55\" class=\"CitationRef\"\u003e55\u003c/span\u003e]. Transformer models, on the other hand, perform quite well in capturing long-term temporal dependencies and complex sequential data [\u003cspan citationid=\"CR56\" class=\"CitationRef\"\u003e56\u003c/span\u003e].\u003c/p\u003e \u003cp\u003eIt is emphasised that each detection system using deep learning models is more effective on datasets with specific characteristics. Each deep learning-based method focuses on specific features within the system. This demonstrates that each model has its own unique structure (see Table\u0026nbsp;\u003cspan refid=\"Tab3\" class=\"InternalRef\"\u003e3\u003c/span\u003e).\u003c/p\u003e \u003cp\u003e \u003cdiv class=\"gridtable\"\u003e\u003ctable float=\"Yes\" id=\"Tab3\" border=\"1\"\u003e \u003ccaption language=\"En\"\u003e \u003cdiv class=\"CaptionNumber\"\u003eTable 3\u003c/div\u003e \u003cdiv class=\"CaptionContent\"\u003e \u003cp\u003eComparison of deep learning-based models used for attack detection in SCADA-based systems\u003c/p\u003e \u003c/div\u003e \u003c/caption\u003e \u003ccolgroup cols=\"4\"\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c1\" colnum=\"1\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c2\" colnum=\"2\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c3\" colnum=\"3\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c4\" colnum=\"4\"\u003e\u003c/div\u003e \u003cthead\u003e \u003ctr\u003e \u003cth align=\"left\" colname=\"c1\"\u003e \u003cp\u003ePerception Accuracy\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c2\"\u003e \u003cp\u003eEfficiency Performance\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c3\"\u003e \u003cp\u003eTemporal-Spatial Feature Extraction\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c4\"\u003e \u003cp\u003eFalse Positive/Negative Rates\u003c/p\u003e \u003c/th\u003e \u003c/tr\u003e \u003c/thead\u003e \u003ctbody\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eTransformers demonstrate superior performance to CNNs and RNNs in terms of accuracy and generalisation [\u003cspan citationid=\"CR56\" class=\"CitationRef\"\u003e56\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eTransformer optimised for low-latency inference\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eTransformers capture long-range dependencies better than RNN/CNN\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eLow false positive and false negative rates\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eCNN demonstrates superior performance to other DL models across multiple datasets [\u003cspan citationid=\"CR57\" class=\"CitationRef\"\u003e57\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eSuitable efficiency for CNN\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eCNN is effective for spatial features; attention mechanisms included\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eFalse positive rates considered in the evaluation\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003e1D CNN and RNN demonstrate better performance than traditional ML in anomaly detection [\u003cspan citationid=\"CR58\" class=\"CitationRef\"\u003e58\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003e1D CNNs are preferred for long sequences due to their efficiency\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003e1D CNN replaces RNN for spatio-temporal features\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eImproved false positive rates compared to traditional methods\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eThe CKAN model achieves over 98% accuracy in the multi-IDS dataset [\u003cspan citationid=\"CR59\" class=\"CitationRef\"\u003e59\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eFewer parameters increase computational efficiency\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eDevelops CNN feature extraction with blood layers\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eAccording to CNN, improved false positive rates\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eLSTM achieves\u0026thinsp;\u0026gt;\u0026thinsp;99% accuracy; DCNN achieves 96% accuracy on ICS datasets [\u003cspan citationid=\"CR60\" class=\"CitationRef\"\u003e60\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eImproved efficiency with smaller models\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eLSTM and DCNN are effective for temporal and spatial features\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eLow false positive and false negative rates\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eSCADA-based automatic encoder-based unattended anomaly detection in gas pipelines [\u003cspan citationid=\"CR61\" class=\"CitationRef\"\u003e61\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eSuitable efficiency for real time\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eThe automatic encoder captures normal traffic characteristics\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eFalse positive and false negative rates managed by thresholding\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eTransformer models deliver good performance [\u003cspan citationid=\"CR62\" class=\"CitationRef\"\u003e62\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eProductivity is not detailed\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eIt excels in transformer series modelling\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eFalse positive and false negative rates are not detailed\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eDeep autoencoder detects DDoS attacks with high detection rates and low false alarms [\u003cspan citationid=\"CR63\" class=\"CitationRef\"\u003e63\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eSuitable efficiency for real time\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eThe automatic encoder captures network streaming features\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eLow false positive and false negative rates\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eLSTM-based IDS detects MiTM and DoS attacks within 2 minutes [\u003cspan citationid=\"CR64\" class=\"CitationRef\"\u003e64\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eSuitable efficiency for real time\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eLSTM captures temporal dependencies\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eLow false positive and false negative rates\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eArtificial intelligence-based anomaly detection on the DNP 3.0 network achieves 99% accuracy [\u003cspan citationid=\"CR65\" class=\"CitationRef\"\u003e65\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eAverage efficiency\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eThe automatic encoder captures network traffic characteristics\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eLow false positive and false negative rates\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eAttention-based variational autoencoder improves anomaly detection in the sWAT dataset [\u003cspan citationid=\"CR66\" class=\"CitationRef\"\u003e66\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eAverage efficiency\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eThe attention mechanism develops spatial-temporal feature extraction\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eFalse positive and false negative rates have been reduced\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003c/tbody\u003e \u003c/colgroup\u003e \u003c/table\u003e\u003c/div\u003e \u003c/p\u003e \u003cp\u003eEach deep learning model reveals certain contextual attributes related to attack detection. This contextuality may vary depending on the model type. Therefore, each model appears to be more suitable for a separate detection.\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec13\" class=\"Section2\"\u003e \u003ch2\u003e2.5. Hybrid and Multi-Scale Architectural Approaches\u003c/h2\u003e \u003cp\u003eDeep learning models better understand the unique context of different attacks. This demonstrates that it is not possible to address all attack types with a single model. Although CNNs are weak in time dependencies, they are quite powerful in extracting local and spatial patterns. LSTMs are strong in time dependencies but can be sensitive to noise. Autoencoders are powerful in representation learning but are insufficient for classification on their own. Transformer models are good at long dependencies but require large amounts of data, which increases hardware costs. Deep learning models are weak when used alone. Therefore, higher performance can be achieved by combining different deep learning models to create new models that offer better advantages. Examples of studies conducted with hybrid models are shown in Table\u0026nbsp;\u003cspan refid=\"Tab5\" class=\"InternalRef\"\u003e4\u003c/span\u003e. These models demonstrate the best performance among existing methods with their achieved performance.\u003c/p\u003e \u003cp\u003e \u003cdiv class=\"gridtable\"\u003e\u003ctable float=\"Yes\" id=\"Tab4\" border=\"1\"\u003e \u003ccaption language=\"En\"\u003e \u003cdiv class=\"CaptionNumber\"\u003eTable 4\u003c/div\u003e \u003cdiv class=\"CaptionContent\"\u003e \u003cp\u003eComparison of hybrid models for attack detection in SCADA-based systems.\u003c/p\u003e \u003c/div\u003e \u003c/caption\u003e \u003ccolgroup cols=\"4\"\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c1\" colnum=\"1\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c2\" colnum=\"2\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c3\" colnum=\"3\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c4\" colnum=\"4\"\u003e\u003c/div\u003e \u003cthead\u003e \u003ctr\u003e \u003cth align=\"left\" colname=\"c1\"\u003e \u003cp\u003ePerception Accuracy\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c2\"\u003e \u003cp\u003eEfficiency Performance\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c3\"\u003e \u003cp\u003eTemporal-Spatial Feature Extraction\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c4\"\u003e \u003cp\u003eFalse Positive/Negative Rates\u003c/p\u003e \u003c/th\u003e \u003c/tr\u003e \u003c/thead\u003e \u003ctbody\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eF1 and AUC improvements in ICS datasets [\u003cspan citationid=\"CR53\" class=\"CitationRef\"\u003e53\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eLow-efficiency training/inference with transformer integration\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003ePowerful spatio-temporal features with CAE\u0026thinsp;+\u0026thinsp;Transformer\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eLow false alarm with SVDD optimisation\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eSCADA ransomware detection\u0026thinsp;~\u0026thinsp;97% Accuracy, \u0026gt;\u0026thinsp;98% AUC [\u003cspan citationid=\"CR67\" class=\"CitationRef\"\u003e67\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eMiddle\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eSpatio-temporal representations with CNN\u0026thinsp;+\u0026thinsp;LSTM\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eLow false alarm rate (\u0026lt;\u0026thinsp;1.88%)\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eVery high Acc/F1 with ConvLSTM [\u003cspan citationid=\"CR68\" class=\"CitationRef\"\u003e68\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eEfficient in practice with a combined structure\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eConvLSTM spatial\u0026thinsp;+\u0026thinsp;temporal dependency\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eFP minimise\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003e99.5% accuracy in DNP3 [\u003cspan citationid=\"CR69\" class=\"CitationRef\"\u003e69\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eMiddle\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eCNN-LSTM\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eLow FP/FN\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eIn the PLC network, Acc\u0026thinsp;=\u0026thinsp;95.11, F1\u0026thinsp;=\u0026thinsp;95.12 [\u003cspan citationid=\"CR70\" class=\"CitationRef\"\u003e70\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eHigh productivity cost\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eMulti-scale CNN\u0026thinsp;+\u0026thinsp;Transformer\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eFP/FN improved\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eAE-GRU outperforms independent methods [\u003cspan citationid=\"CR71\" class=\"CitationRef\"\u003e71\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eMiddle\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eGRU-based autoencoder\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eFP/FN improved\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eFDI detection improved with CNN-LSTM-AE [\u003cspan citationid=\"CR72\" class=\"CitationRef\"\u003e72\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eMiddle\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eCNN-LSTM\u0026thinsp;+\u0026thinsp;AE\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eFP has decreased significantly\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eSemi-supervised LSTM-AE effective [\u003cspan citationid=\"CR73\" class=\"CitationRef\"\u003e73\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eMiddle\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eLSTM Autoencoder\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eFP/FN improved\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eGoogleNet-LSTM achieves 97.56% accuracy in Modbus [\u003cspan citationid=\"CR74\" class=\"CitationRef\"\u003e74\u003c/span\u003e]\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eMiddle\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eCNN-LSTM\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c4\"\u003e \u003cp\u003eLow FP and misses\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003c/tbody\u003e \u003c/colgroup\u003e \u003c/table\u003e\u003c/div\u003e \u003c/p\u003e \u003cp\u003eHybrid methods are those in which multiple models are combined to achieve better results, following traditional methods, machine learning-based methods, and deep learning models. They are recognised as the best known methods for attack detection in SCADA and IDS systems.\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec14\" class=\"Section2\"\u003e \u003ch2\u003e2.6. Limitations of Existing Studies and Research Gap\u003c/h2\u003e \u003cp\u003eLiterature studies have shown significant progress in detecting attacks on SCADA systems. Despite these developments, some research gaps have been identified. Based on the findings from these studies, the existing limitations and research gaps can be summarised as follows.\u003c/p\u003e \u003cp\u003eRealistic and SCADA-specific data set: The literature contains many studies on attack detection in SCADA systems. Studies have used data sets such as NSL-KDD and CIC-IDS2017, which belong to general network traffic. These data sets are based on irregular traffic flows found in normal networks. They do not reflect the cyclical and predictable data flow associated with traffic involving industrial protocols such as Modbus/TCP. In a real SCADA environment, devices are queried at specific intervals. The query-response cycle continues for a long period. The packet size and traffic are generally low. Anomalies usually arise from a command within the packet or a disruption in the timing cycle. Since datasets such as NSL-KDD and CIC-IDS2017 reflect general network traffic, they do not reflect command injection and protocol-based attack vectors. This calls into question the reliability of these datasets as training data for attack detection in SCADA systems.\u003c/p\u003e \u003cp\u003e \u003cstrong\u003eFailure to Address Imbalanced Data and Diverse Attack Scenarios Together\u003c/strong\u003e \u003cp\u003eIn SCADA-based systems, normal network traffic is much larger than attack traffic. This situation causes class imbalance among attack types. Detecting attack classes that occur infrequently is particularly difficult. This causes the developed model to focus on attacks belonging to the majority class, leading to attacks belonging to the minority class being missed. Comprehensive scenarios for numerous attack classes are limited in existing data sets.\u003c/p\u003e \u003c/p\u003e \u003cp\u003e \u003cstrong\u003eThe inadequacy of single models and the need for hybrid architectural models\u003c/strong\u003e \u003cp\u003eDeep learning models focus on specific features within a dataset. While a model may perform well on one dataset, another deep learning model may be more effective on a different dataset. CNN models focus on local and spatial patterns, LSTMs on temporal dependencies, and autoencoders on normal behaviour representations. An attack occurring in SCADA systems may exhibit both anomalies in the packet internal structure and temporal behaviour in the packet sequence. A large portion of existing studies attempt to capture this through a single model. This study presents a sophisticated model that enables the detection of attacks with different characteristics through the proposed hybrid model.\u003c/p\u003e \u003c/p\u003e \u003cp\u003e \u003cstrong\u003eInsufficient assessment of generalisability and robustness\u003c/strong\u003e \u003cp\u003eLiterature reviews reveal that studies on detecting attacks in SCADA systems typically focus on a single dataset. This leads to overfitting to the dataset and prevents the same level of success from being achieved in different scenarios and structures. The model proposed in this study has been evaluated by applying it to different datasets.This study presents a structure that develops a solution for high accuracy and generalisability in SCADA systems. It was conducted to address the limitations and gaps mentioned above.\u003c/p\u003e \u003c/p\u003e \u003c/div\u003e"},{"header":"3. Material and Method","content":"\u003cdiv id=\"Sec16\" class=\"Section2\"\u003e \u003ch2\u003e3.1 Data Preprocessing\u003c/h2\u003e \u003cp\u003eThe SCADANet dataset used in the study was first processed through the steps of imputation of missing values, scaling, and digitisation of labels. Missing values were filled with a fixed value of 0, and then all numerical features were normalised using StandardScaler. This balanced the effect of variables with different scales on the model. The normalised input data was transformed into the (sample count, feature count, 1) format, making it suitable for the CNN-based network. The output labels were digitised using LabelEncoder and converted into a format suitable for multi-class classification using the one-hot encoding method. To reduce data imbalance, the class_weight approach was used to include minority classes in training with higher weights.\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec17\" class=\"Section2\"\u003e \u003ch2\u003e3.2 Proposed Model Architecture\u003c/h2\u003e \u003cp\u003eIn this study, a hybrid deep learning architecture consisting of Parallel Dilated Conv1D, Residual-SE blocks, and LSTM layers is proposed to jointly model the multi-scale spatial patterns and temporal dependencies observed in the network traffic of SCADA-based industrial control systems. The general flow diagram of the proposed architecture is presented in Fig.\u0026nbsp;\u003cspan refid=\"Fig2\" class=\"InternalRef\"\u003e2\u003c/span\u003e.\u003c/p\u003e \u003cp\u003e \u003c/p\u003e \u003cp\u003e \u003cstrong\u003eInput Layer\u003c/strong\u003e \u003cp\u003eThe model's input is organised so that it is of dimension (T, 1) for each example. Here, T represents the time step or feature length.\u003c/p\u003e \u003c/p\u003e \u003cp\u003e \u003cstrong\u003eParallel Dilated Convolution Layers\u003c/strong\u003e \u003cp\u003eConvolutional Neural Networks are deep learning architectures frequently used in the field of cyber security for network traffic analysis, anomaly detection, and DDoS attack classification [\u003cspan citationid=\"CR75\" class=\"CitationRef\"\u003e75\u003c/span\u003e]. CNNs preserve spatial correlations and extract local patterns on the input tensor \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:X\\in\\:{\\mathbb{R}}^{H\\times\\:W\\times\\:C}\\)\u003c/span\u003e\u003c/span\u003e. A convolution operation is defined using a kernel filter \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:k\\in\\:{\\mathbb{R}}^{n\\times\\:n\\times\\:C}\\)\u003c/span\u003e\u003c/span\u003e as shown in Eq.\u0026nbsp;\u003cspan refid=\"Equ1\" class=\"InternalRef\"\u003e1\u003c/span\u003e.\u003c/p\u003e \u003c/p\u003e \u003cp\u003e \u003cdiv id=\"Equ1\" class=\"Equation\"\u003e \u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ1\" name=\"EquationSource\"\u003e\n$$\\:Y\\left(i,j\\right)={\\sum\\:}_{m=1}^{n}{\\sum\\:}_{n=1}^{n}X\\left(i+m,j+n\\right).k(m,n)$$\u003c/div\u003e \u003cdiv class=\"EquationNumber\"\u003e1\u003c/div\u003e\u003c/div\u003e \u003c/p\u003e \u003cp\u003eIn Eq.\u0026nbsp;\u003cspan refid=\"Equ1\" class=\"InternalRef\"\u003e1\u003c/span\u003e, \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:Y\\left(i,j\\right)\\)\u003c/span\u003e\u003c/span\u003e represents the feature map, \u003cem\u003eX\u003c/em\u003e\u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:\\left(i+m,j+n\\right)\\)\u003c/span\u003e\u003c/span\u003e represents the local pixels in the input tensor, and \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:k(m,n)\\)\u003c/span\u003e\u003c/span\u003e represents the learnable weights multiplied by these pixels. This classical structure can only learn short-range dependencies due to its limited receptive field. In high-dimensional network traffic flows, this makes it difficult to capture long-range dependencies. To overcome this limitation, the dilated convolution mechanism is used. In this approach, gaps are added between the kernel elements with the dilation ratio d. Thus, the effective receptive field is expanded while the number of parameters is kept constant. A one-dimensional dilated convolution operation is mathematically expressed as shown in Eq.\u0026nbsp;\u003cspan refid=\"Equ2\" class=\"InternalRef\"\u003e2\u003c/span\u003e.\u003cdiv id=\"Equ2\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ2\" name=\"EquationSource\"\u003e\n$$\\:\\left({F}^{\\left(d\\right)}*k\\right)t=\\sum\\:_{{\\tau\\:}}{k}_{\\tau\\:}\\bullet\\:{F}_{t-d\\tau\\:}$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e2\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e \u003cp\u003eIn Eq.\u0026nbsp;\u003cspan refid=\"Equ2\" class=\"InternalRef\"\u003e2\u003c/span\u003e, \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:F\\)\u003c/span\u003e\u003c/span\u003e represents the input signal (traffic flow signal, etc.), \u003cem\u003ek\u003c/em\u003e represents the core weight, d represents the dilation ratio, and τ represents the core's position index.\u003c/p\u003e \u003cp\u003eIn this case, the effective receiver area \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{R}_{\\text{e}\\text{f}\\text{f}}\\)\u003c/span\u003e\u003c/span\u003e is expressed as in Eq.\u0026nbsp;\u003cspan refid=\"Equ3\" class=\"InternalRef\"\u003e3\u003c/span\u003e.\u003cdiv id=\"Equ3\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ3\" name=\"EquationSource\"\u003e\n$$\\:{R}_{\\text{e}\\text{f}\\text{f}}={\\left[(n-1)d+1\\right]}^{2}$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e3\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e \u003cp\u003eThis increase enables the model to capture broader contextual information with the same number of parameters. This makes it possible to learn both local (fine-grained) and global features simultaneously [\u003cspan citationid=\"CR76\" class=\"CitationRef\"\u003e76\u003c/span\u003e].\u003c/p\u003e \u003cp\u003eIn the Efficient Spatial Pyramid module, multi-scale feature extraction is performed by running convolution branches with different dilation rates in parallel. If the dilation rate is defined as \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{d}_{k}={2}^{k-1}\\)\u003c/span\u003e\u003c/span\u003e, the effective receptive field expands as shown in Eq.\u0026nbsp;\u003cspan refid=\"Equ4\" class=\"InternalRef\"\u003e4\u003c/span\u003e.\u003cdiv id=\"Equ4\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ4\" name=\"EquationSource\"\u003e\n$$\\:{R}_{ESP}={\\left[(n-1){2}^{K-1}+1\\right]}^{2}$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e4\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e \u003cp\u003eThe number of parameters for the Efficient Spatial Pyramid module is expressed as in Eq.\u0026nbsp;\u003cspan refid=\"Equ5\" class=\"InternalRef\"\u003e5\u003c/span\u003e.\u003cdiv id=\"Equ5\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ5\" name=\"EquationSource\"\u003e\n$$\\:{P}_{ESP}=\\frac{1}{K}(NM+{n}^{2}{N}^{2})$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e5\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e \u003cp\u003eThis enables learning a broader spatial context with fewer parameters compared to classical CNN architectures.\u003c/p\u003e \u003cp\u003eThe generalised form of this structure is referred to as the Parallel Dilated Convolutional Neural Network architecture. This architecture simultaneously runs multiple convolutional layers with different dilation rates \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:\\left({d}_{i}\\right)\\)\u003c/span\u003e\u003c/span\u003e. The feature extraction process for each dilation rate is expressed as in Eq.\u0026nbsp;\u003cspan refid=\"Equ6\" class=\"InternalRef\"\u003e6\u003c/span\u003e.\u003cdiv id=\"Equ6\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ6\" name=\"EquationSource\"\u003e\n$$\\:{D}_{c}^{\\left(i\\right)}=\\sigma\\:\\left({F}^{{d}_{i}}*X\\right)$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e6\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e \u003cp\u003eEquation \u003cspan refid=\"Equ6\" class=\"InternalRef\"\u003e6\u003c/span\u003e denotes \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:\\sigma\\:\\)\u003c/span\u003e\u003c/span\u003e, which represents non-linear activation functions such as ReLU or Swish. The resulting multi-scale feature maps are then combined in the Global Average Pooling layer. The Global Average Pooling layer is expressed as shown in Eq.\u0026nbsp;\u003cspan refid=\"Equ7\" class=\"InternalRef\"\u003e7\u003c/span\u003e.\u003cdiv id=\"Equ7\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ7\" name=\"EquationSource\"\u003e\n$$\\:{y}_{c}=\\frac{1}{H\\times\\:W}{\\sum\\:}_{i=1}^{H}{\\sum\\:}_{j=1}^{W}{D}_{c}^{\\left(L\\right)}(i,j)$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e7\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e \u003cp\u003eEach step in Eq.\u0026nbsp;\u003cspan refid=\"Equ7\" class=\"InternalRef\"\u003e7\u003c/span\u003e extracts the average activation of each channel. It also enhances the model's generalisation ability and reduces the risk of overfitting. In cyber attack detection, low dilation ratios learn local packet statistics and short-range correlations. High dilation rates, on the other hand, capture global anomalies and long-range relationships within network traffic. Thus, the model develops contextual awareness with a wide effective receiver area R_eff. This results in high accuracy and generalisation performance in detecting multi-scale patterns such as DDoS attacks.\u003c/p\u003e \u003cp\u003eDuring the application phase of the model developed in this study, the input was sent to three parallel Conv1D layers. While the same filter size (3) was used in these layers, different dilation rates were applied. Thus, the architecture was able to learn short-term and long-term dependencies simultaneously. Each branch utilised 64 filters and a ReLU activation function. The outputs obtained from the parallel branches were combined to form a tensor of dimension (T,192). This structure enhanced the model's large-scale feature extraction capacity, thereby strengthening its cyber attack detection performance [\u003cspan citationid=\"CR77\" class=\"CitationRef\"\u003e77\u003c/span\u003e].\u003c/p\u003e \u003cp\u003e \u003cstrong\u003eBatch Normalisation and 1\u0026times;1 Convolution\u003c/strong\u003e \u003cp\u003eBatch Normalisation (BN) is a widely used normalisation technique employed to accelerate the training process in deep neural networks while also enhancing its stability. Fundamentally, it aims to reduce internal covariate shift, which arises from the continuous variation in the distribution of activations between layers during training. This method normalises the activations within each mini-batch, transforming them to a mean of zero and a variance of one. It then reshapes them using the scale (γ) and bias (β) parameters that the model can learn [\u003cspan citationid=\"CR78\" class=\"CitationRef\"\u003e78\u003c/span\u003e]. Mathematically, the process is expressed in Eq.\u0026nbsp;\u003cspan refid=\"Equ8\" class=\"InternalRef\"\u003e8\u003c/span\u003e.\u003c/p\u003e \u003c/p\u003e \u003cp\u003e \u003cdiv id=\"Equ8\" class=\"Equation\"\u003e \u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ8\" name=\"EquationSource\"\u003e\n$$\\:\\mu\\:=\\frac{1}{m}\\sum\\:_{i=1}^{m}{x}_{i},\\:\\:\\:\\:\\:\\:\\:\\:\\:{\\sigma\\:}^{2}=\\frac{1}{m}\\sum\\:_{i=1}^{m}{{(x}_{i-}\\mu\\:)}^{2}$$\u003c/div\u003e \u003cdiv class=\"EquationNumber\"\u003e8\u003c/div\u003e\u003c/div\u003e \u003c/p\u003e \u003cp\u003eHere, the expression \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:\\mu\\:=\\frac{1}{m}\\sum\\:_{i=1}^{m}{x}_{i}\\:\\)\u003c/span\u003e\u003c/span\u003e calculates the mean of the data within the mini-batch. \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{\\sigma\\:}^{2}=\\frac{1}{m}\\sum\\:_{i=1}^{m}{{(x}_{i-}\\mu\\:)}^{2}\\)\u003c/span\u003e\u003c/span\u003e calculates the variance of the mini-batch data. The normalisation process specified in Eq.\u0026nbsp;\u003cspan refid=\"Equ9\" class=\"InternalRef\"\u003e9\u003c/span\u003e is then applied. It normalises the data so that the mean is zero and the variance is one.\u003cdiv id=\"Equ9\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ9\" name=\"EquationSource\"\u003e\n$$\\:\\widehat{{x}_{i}}=\\frac{{x}_{i}-\\mu\\:}{\\sqrt{{\\sigma\\:}^{2}+ϵ}}$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e9\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e \u003cp\u003eThe output is obtained by the rescaling and shifting process specified in the last Eq.\u0026nbsp;\u003cspan refid=\"Equ10\" class=\"InternalRef\"\u003e10\u003c/span\u003e.\u003cdiv id=\"Equ10\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ10\" name=\"EquationSource\"\u003e\n$$\\:{\\mathcal{Y}}_{i}=\\gamma\\:\\widehat{{x}_{i}}+\\beta\\:,\\:\\gamma\\:ϵ\\mathbb{R}\\mathbb{\\:}and\\:\\beta\\:ϵ\\mathbb{R},$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e10\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e \u003cp\u003eHere (Eq.\u0026nbsp;\u003cspan refid=\"Equ10\" class=\"InternalRef\"\u003e10\u003c/span\u003e), \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:ϵ\\)\u003c/span\u003e\u003c/span\u003e is a small constant that ensures numerical stability. During the training phase, statistics are calculated over mini-batches, while during the testing phase, the moving average and variance obtained from the entire training set are used. BN enables training with larger learning rates and prevents gradients from exploding or vanishing. It also reduces the risk of overfitting by acting as a regulariser. In the model developed within the scope of this study, the high-dimensional feature map obtained after concatenation was normalised using Batch Normalisation. Subsequently, a 1\u0026times;1 Conv1D layer (64 filters, ReLU activation) was used to reduce the number of parameters and balance the dimensions [\u003cspan citationid=\"CR79\" class=\"CitationRef\"\u003e79\u003c/span\u003e].\u003c/p\u003e \u003cp\u003e \u003cstrong\u003eResidual-SE Block\u003c/strong\u003e \u003cp\u003eAs the number of layers increases in deep neural networks, gradient decay and learning difficulties are observed. The Residual Block, used to overcome this problem, learns the difference between the input and the target instead of the objective function directly [\u003cspan citationid=\"CR80\" class=\"CitationRef\"\u003e80\u003c/span\u003e]. The structure is defined mathematically as shown in Eq.\u0026nbsp;\u003cspan refid=\"Equ11\" class=\"InternalRef\"\u003e11\u003c/span\u003e\u003c/p\u003e \u003c/p\u003e \u003cp\u003e \u003cdiv id=\"Equ11\" class=\"Equation\"\u003e \u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ11\" name=\"EquationSource\"\u003e\n$$\\:y=\\mathcal{F}\\left(\\text{x},W\\right)+\\text{x}$$\u003c/div\u003e \u003cdiv class=\"EquationNumber\"\u003e11\u003c/div\u003e\u003c/div\u003e \u003c/p\u003e \u003cp\u003eEquation \u003cspan refid=\"Equ11\" class=\"InternalRef\"\u003e11\u003c/span\u003e now demonstrates the fundamental principle of the residual block. The input \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:x\\)\u003c/span\u003e\u003c/span\u003e is added to its transformed form \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:\\mathcal{F}\\left(x,W\\right)\\)\u003c/span\u003e\u003c/span\u003e using parameters (\u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:W\\)\u003c/span\u003e\u003c/span\u003e). Thus, the network learns not the target directly, but the difference between the input and the target. The residual block used in this study consists of the following operations:\u003cdiv id=\"Equ12\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ12\" name=\"EquationSource\"\u003e\n$$\\:\\mathcal{F}\\left(\\text{x}\\right)={\\text{C}\\text{o}\\text{n}\\text{v}1\\text{D}}_{3\\text{x}3}\\to\\:\\text{S}\\text{w}\\text{i}\\text{s}\\text{h}\\to\\:\\text{B}\\text{N}\\to\\:{\\text{C}\\text{o}\\text{n}\\text{v}1\\text{D}}_{1\\text{x}1}$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e12\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e \u003cp\u003eEquation \u003cspan refid=\"Equ12\" class=\"InternalRef\"\u003e12\u003c/span\u003e now specifies how the function is calculated. After passing through the 3x3 convolution, Swish activation, and Batch Normalisation steps, a 1x1 convolution is applied. The aim is to transform the input features and obtain more meaningful representations. Shortcut transformation:\u003cdiv id=\"Equ13\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ13\" name=\"EquationSource\"\u003e\n$$\\:{\\text{x}}^{{\\prime\\:}}={\\text{C}\\text{o}\\text{n}\\text{v}1\\text{D}}_{1\\text{x}1}\\left(\\text{x}\\right)$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e13\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e \u003cp\u003eThis expression (Eq.\u0026nbsp;\u003cspan refid=\"Equ13\" class=\"InternalRef\"\u003e13\u003c/span\u003e) defines the shortcut transformation. The input data is transformed using a 1x1 convolution to achieve dimension matching, thereby enabling it to be added to \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:\\mathcal{F}\\left(x\\right)\\)\u003c/span\u003e\u003c/span\u003e.\u003cdiv id=\"Equ14\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ14\" name=\"EquationSource\"\u003e\n$$\\:y=\\text{S}\\text{w}\\text{i}\\text{s}\\text{h}(\\mathcal{F}\\left(\\text{x}\\right)+{\\text{x}}^{{\\prime\\:}})$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e14\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e \u003cp\u003eThe final output is obtained using the formula specified in Eq.\u0026nbsp;\u003cspan refid=\"Equ14\" class=\"InternalRef\"\u003e14\u003c/span\u003e. After the residual function and shortcut output are summed, they are passed through the Swish activation function. This structure enables the effective learning of multi-layer representations and the efficient training of deep architectures by combining linear and non-linear components.\u003c/p\u003e \u003cp\u003e \u003cstrong\u003eLSTM Layer\u003c/strong\u003e \u003cp\u003eLong Short-Term Memory (LSTM) is a structure proposed by Hochreiter and Schmidhuber in 1997, developed specifically to address the gradient vanishing/exploding issues experienced by traditional Recurrent Neural Networks (RNNs) when learning long-term dependencies. The most fundamental feature of LSTM is its ability to preserve information obtained from past data for extended periods through gate mechanisms that regulate information flow [\u003cspan citationid=\"CR81\" class=\"CitationRef\"\u003e81\u003c/span\u003e]. An LSTM cell contains the following elements (Fig.\u0026nbsp;\u003cspan refid=\"Fig3\" class=\"InternalRef\"\u003e3\u003c/span\u003e)\u003c/p\u003e \u003c/p\u003e \u003cp\u003eCell state ( \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{C}_{t}\\)\u003c/span\u003e\u003c/span\u003e ): The main route for transporting long-term information. Hidden state\u003cb\u003e(\u003c/b\u003e\u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{h}_{t}\\)\u003c/span\u003e\u003c/span\u003e\u003cb\u003e)\u003c/b\u003e: Short-term information representing the current output. Forget gate(\u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:\\:{f}_{t}\\)\u003c/span\u003e\u003c/span\u003e \u003cb\u003e)\u003c/b\u003e: Determines which information will be deleted from the memory. Input gate ( \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{i}_{t}\\)\u003c/span\u003e\u003c/span\u003e\u003cb\u003e)\u003c/b\u003e: It controls which parts of the incoming data are written to memory. Output gate (\u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:\\:{O}_{t}\\)\u003c/span\u003e\u003c/span\u003e ): It regulates how much of the information in memory is transferred out. Cell candidate (\u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{\\stackrel{\\sim}{C}}_{t}\\)\u003c/span\u003e\u003c/span\u003e): Creates a candidate for new information that can be added.\u003c/p\u003e \u003cp\u003e \u003c/p\u003e \u003cp\u003eThe updating process of the LSTM is defined by the following equations:\u003c/p\u003e \u003cp\u003e \u003cspan class=\"InlineEquation\"\u003e \u003cspan class=\"mathinline\"\u003e\\(\\:{f}_{t}=\\sigma\\:({W}_{f}.\\left[{h}_{t-1},{x}_{t}\\right]+{b}_{f})\\)\u003c/span\u003e \u003c/span\u003e : This expression defines the forget gate. It also determines how much of the previous information is retained. \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{i}_{t}=\\sigma\\:({W}_{i}.\\left[{h}_{t-1},{x}_{t}\\right]+{b}_{i})\\)\u003c/span\u003e\u003c/span\u003e : This is the input gate. It regulates the rate at which new information enters the memory. \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{\\stackrel{\\sim}{C}}_{t}=\\text{tanh}\\left({W}_{C}.\\left[{h}_{t-1},{x}_{t}\\right]+{b}_{C}\\right)\\)\u003c/span\u003e\u003c/span\u003e: Candidate memory. It produces new information suitable for addition. \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{C}_{t}={f}_{t}\\odot\\:{C}_{t-1}+{i}_{t}\\odot\\:{\\stackrel{\\sim}{C}}_{t}\\:\\)\u003c/span\u003e\u003c/span\u003e: Updated cell state, represents the combination of the appropriate part of the old information and the new information. \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{O}_{t}=\\sigma\\:\\left({W}_{o}.\\left[{h}_{t-1},{x}_{t}\\right]+{b}_{o}\\right)\\)\u003c/span\u003e\u003c/span\u003e : Output gate. Selects which part of the cell information will be the output. \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:{h}_{t}={o}_{t}\\odot\\:\\text{tanh}\\left({C}_{t}\\right)\\)\u003c/span\u003e\u003c/span\u003e: Hidden state, represents the information that forms the final output.\u003c/p\u003e \u003cp\u003eHere, \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:\\sigma\\:\\)\u003c/span\u003e\u003c/span\u003e denotes the sigmoid function, tanh denotes the hyperbolic tangent function, and \u003cspan class=\"InlineEquation\"\u003e\u003cspan class=\"mathinline\"\u003e\\(\\:\\odot\\:\\)\u003c/span\u003e\u003c/span\u003e denotes element-wise multiplication. This structure enables the LSTM to update information when necessary and store it for extended periods when required. A key factor in the success of LSTM is a mechanism called Constant Error Carousel (CEC), which allows the error signal to be carried over time without loss. This enables the model to access past information even in long sequences. The training process is typically carried out using the Backpropagation Through Time (BPTT) algorithm. Over time, different types of LSTMs have been developed. The basic (vanilla) LSTM consists only of input, forget, and output gates. Peephole LSTM provides additional information transfer by directly connecting the memory state to the gates. Bidirectional LSTM processes data in both forward and backward directions, while Stacked LSTM can learn more complex dependencies by stacking multiple layers on top of each other. LSTM is widely used in many areas such as natural language processing, speech recognition, time series prediction, health data analysis, and network security. Thanks to its ability to learn long-term relationships, it has become an indispensable deep learning model for sequence-based problems [\u003cspan citationid=\"CR83\" class=\"CitationRef\"\u003e83\u003c/span\u003e]. In the model developed within the scope of this study, the outputs obtained from the Residual-SE block were fed into a 128-unit LSTM layer (return_sequences\u0026thinsp;=\u0026thinsp;True) to model their temporal dependencies. This allowed for the capture of sequential relationships in addition to CNN-based feature extraction. Pooling and Fully Connected Layers: The output of the LSTM layer was summarized using Global Average Pooling (GAP) and converted into a fixed-length vector. This vector was fed into a dense layer with 128 neurons and ReLU activation, and Dropout (rate\u0026thinsp;=\u0026thinsp;0.3) was applied to reduce overfitting.\u003c/p\u003e \u003cp\u003e \u003cstrong\u003eOutput Layer\u003c/strong\u003e \u003cp\u003eThe final layer has C neurons, corresponding to the number of classes, and produces a multi-class probability distribution using the Softmax activation function.\u003c/p\u003e \u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec18\" class=\"Section2\"\u003e \u003ch2\u003e3.3 Training Strategy\u003c/h2\u003e \u003cp\u003eThe training of the proposed model within the scope of this study was performed using the categorical cross-entropy loss function and the Adam optimization algorithm. The initial learning rate was set to 0.001, and consistent training was ensured by maintaining the same optimization settings throughout all experiments. During the training phase, multiple regularization strategies were used together to prevent overfitting, increase the model's generalization ability, and make the learning process more stable.\u003c/p\u003e \u003cp\u003eIn this context, the EarlyStopping mechanism was applied first. If no improvement was observed in the validation loss for 50 epochs, the training process was automatically terminated. This approach reduced computational costs by preventing unnecessary training iterations and prevented the model from overfitting to the training data. Additionally, the ReduceLROnPlateau strategy was used to adaptively manage the learning process. If the validation loss did not improve over 15 epochs, the current learning rate was halved.\u003c/p\u003e \u003cp\u003eThis method contributes to a more balanced and stable optimization process by allowing the model to continue learning with smaller steps in the plateau regions of the loss function. Finally, the model weights at the point where the validation loss reaches its lowest level are saved using the ModelCheckpoint method. This ensures that the model version with the best generalization performance is preserved at the end of the training process.\u003c/p\u003e \u003cp\u003eThe combined use of these strategies has made the training process computationally efficient while also increasing the consistency and reliability of performance through early stopping, adaptive learning rate adjustment, and saving the best model.\u003c/p\u003e \u003c/div\u003e"},{"header":"4. Experimental Work","content":"\u003cp\u003eThis section presents in detail the experimental evaluations of the proposed model on two different datasets, the cross-validation strategy used, optimizations for the imbalanced data problem, performance metrics, and ablation analyses. The experiments aim to comprehensively demonstrate the generalizability of the method, the contributions of its components, and its robustness under class imbalance.\u003c/p\u003e \u003cdiv id=\"Sec20\" class=\"Section2\"\u003e \u003ch2\u003e4.1. Experimental Setup and Acquisition of the SCADANet Dataset\u003c/h2\u003e \u003cp\u003eThe SCADANet dataset used in this study was generated in a completely isolated virtual SCADA laboratory. The dataset consists of a total of 486,714 labeled network packets. The dataset includes packets obtained from nine different attack scenarios along with normal traffic. The dataset contains 6,403 different source IPs, 123 destination IPs, and 165 network protocols. Approximately 83% of the traffic consists of attack packets, while 17% consists of normal packets. Class imbalance is also observed. This situation necessitates the use of appropriate training strategies to ensure that underrepresented attack classes can be learned correctly. The dataset includes TCP SYN Flood, TCP ACK Flood, UDP Flood, ICMP Flood, HTTP Flood, SQL Injection, Port Scan, Vulnerability Scan, and Operating System Scan attacks. These attacks are designed to cover different threat categories such as reconnaissance, resource consumption, vulnerability scanning, and service exploitation.\u003c/p\u003e \u003cp\u003eMulti-protocol structures such as Modbus/TCP, UDP, ICMP, and HTTP, along with attacks performed simultaneously within the same flow, ensure that the dataset represents real traffic in industrial environments. The dataset provides a rich research resource for multi-class attack detection, containing both volume and variety specific to SCADA's normal behavior and attack patterns.\u003c/p\u003e \u003cp\u003eThe experimental environment was configured using VMware Workstation Pro running on the Windows operating system. As shown in Fig.\u0026nbsp;\u003cspan refid=\"Fig4\" class=\"InternalRef\"\u003e4\u003c/span\u003e, this completely isolated virtual laboratory environment is designed as a multi-node SCADA topology consisting of seven virtual machines (VMs). This topology includes attacker systems, target servers, Modbus/TCP-based field devices, SCADA/HMI master systems, and a listener node that passively monitors all traffic.\u003c/p\u003e \u003cp\u003eAll virtual machines are connected to each other via a NAT-based network to form a single broadcast domain. The Ubuntu-based listener VM, configured to record network traffic, was set to operate in passive mode on the virtual switch and captured all packets generated in the environment.\u003c/p\u003e \u003cp\u003e \u003c/p\u003e \u003cp\u003eThe roles of virtual machines used in the virtual laboratory environment and their task definitions are summarized in Table\u0026nbsp;\u003cspan refid=\"Tab5\" class=\"InternalRef\"\u003e4\u003c/span\u003e.\u003c/p\u003e \u003cp\u003e \u003cdiv class=\"gridtable\"\u003e\u003ctable float=\"Yes\" id=\"Tab5\" border=\"1\"\u003e \u003ccaption language=\"En\"\u003e \u003cdiv class=\"CaptionNumber\"\u003eTable 4\u003c/div\u003e \u003cdiv class=\"CaptionContent\"\u003e \u003cp\u003eVirtual machines used in the experimental virtual laboratory structure created to obtain the dataset\u003c/p\u003e \u003c/div\u003e \u003c/caption\u003e \u003ccolgroup cols=\"4\"\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c1\" colnum=\"1\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c2\" colnum=\"2\"\u003e\u003c/div\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c3\" colnum=\"3\"\u003e\u003c/div\u003e \u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c4\" colnum=\"4\"\u003e\u003c/div\u003e \u003cthead\u003e \u003ctr\u003e \u003cth align=\"left\" colname=\"c1\"\u003e \u003cp\u003eVirtual machines\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c2\"\u003e \u003cp\u003eRole\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c3\"\u003e \u003cp\u003eTask Description\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c4\"\u003e \u003cp\u003eIP Address\u003c/p\u003e \u003c/th\u003e \u003c/tr\u003e \u003c/thead\u003e \u003ctbody\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eUbuntu VM\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eListener (Sniffer)\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eIt is configured to passively capture all traffic on the network using Wireshark and Tshark.\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e192.168.119.130\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eKali VM 1\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eAttacker\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eThey have run attack scripts to simulate malicious activities.\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e192.168.119.140\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eKali VM 2\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eVictim\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eIt hosted a web server and served as the main target of attacks.\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e192.168.119.141\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eKali VM 3\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eModbus Server\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eIt has simulated a SCADA field device by running a Modbus/TCP server.\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e192.168.119.142\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eKali VM 4\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eModbus Client\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eIt represented a SCADA/HMI master system that generates legitimate Modbus traffic.\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e192.168.119.143\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eKali VM 5\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eAttacker\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eIt has run additional attack scripts to create malicious traffic scenarios.\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e192.168.119.144\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eKali VM 6\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c2\"\u003e \u003cp\u003eModbus Client\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"left\" colname=\"c3\"\u003e \u003cp\u003eIt has served as a second SCADA/HMI master system that generates standard Modbus communication.\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e192.168.119.145\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003c/tbody\u003e \u003c/colgroup\u003e \u003c/table\u003e\u003c/div\u003e \u003c/p\u003e \u003cdiv id=\"Sec21\" class=\"Section3\"\u003e \u003ch2\u003e4.1.1 Traffic Generation and Communication Flows\u003c/h2\u003e \u003cp\u003eTwo primary communication flows have been defined in the simulated environment. The first flow is legitimate industrial communication established between the Modbus/TCP server running on Kali 3 and the Modbus clients on Kali 4 and Kali 6. This structure is configured to mimic the periodic query-response cycles observed in real field environments. The Modbus clients generated deterministic SCADA traffic by performing holding register, input register, and coil read/write operations at specific time intervals.\u003c/p\u003e \u003cp\u003eThe second flow is attack traffic. Attacker nodes located on Kali 1 and Kali 5 performed various attack scenarios targeting the target system running on Kali 2. All this traffic was generated simultaneously and interleaved without interrupting normal Modbus communication. This approach ensured that realistic traffic patterns were obtained, with attack traffic embedded within normal industrial flow.\u003c/p\u003e \u003cp\u003eDuring normal traffic generation, not only Modbus/TCP communication but also ICMP-based availability checks and HTTP-based service requests commonly observed in industrial networks are included in the system as background traffic. Thus, the resulting dataset represents a multi-service and heterogeneous SCADA network rather than a synthetic structure based on a single protocol.\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec22\" class=\"Section3\"\u003e \u003ch2\u003e4.1.2 Traffic Capture and Feature Extraction\u003c/h2\u003e \u003cp\u003eThe network traffic capture process was performed passively using the TShark tool running on an Ubuntu VM. Separate \u0026ldquo;.pcapng\u0026rdquo; files were created for each scenario, and Layer-2 noise traffic (such as ARP packets) was filtered during the analysis phase.\u003c/p\u003e \u003cp\u003eThe captured raw packets were parsed using Wireshark and TShark; attributes belonging to the frame, IP, TCP/UDP/ICMP, and application layers were extracted in detail. Additionally, cryptographic and behavioral fingerprint characteristics were obtained at the session and flow levels using the JA4\u0026thinsp;+\u0026thinsp;mechanism. These characteristics provide distinctive information, particularly for detecting low-volume and covert SCADA attacks.\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec23\" class=\"Section3\"\u003e \u003ch2\u003e4.1.3 Labeling Process\u003c/h2\u003e \u003cp\u003eThe data labeling process is not based solely on port or protocol-based heuristic rules. Instead, the start and end times of attacks were precisely determined by synchronizing the log records of the scripts that initiated the attack scenarios with the packet timestamps. This approach has increased the accuracy of class labels and ensured that the dataset can be used reliably in multi-class attack detection studies.\u003c/p\u003e \u003cp\u003eAs a result, each packet has been labeled as either \u0026ldquo;normal traffic\u0026rdquo; or the relevant attack class and structured in CSV format for use in the analysis phase.\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec24\" class=\"Section3\"\u003e \u003ch2\u003e4.1.4 Traffic Generation and Attack Scenario Design\u003c/h2\u003e \u003cp\u003eThe network traffic generation process was carried out in two stages. In the first stage, harmless traffic representing normal operating conditions was generated and recorded as reference data. In the second stage, nine different attack scenarios were applied while normal traffic continued in the background.\u003c/p\u003e \u003cp\u003eThe attacks carried out included TCP-SYN Flood, TCP-ACK Flood, UDP Flood, ICMP Flood, HTTP Flood, SQL Injection, Port Scan, Vulnerability Scan, and OS Scan. These attacks were selected to represent different threat classes, such as reconnaissance, resource consumption, and service exploitation, rather than just producing anomalies at the network level.\u003c/p\u003e \u003cp\u003eEach scenario was executed for durations ranging from 5 to 20 minutes, depending on the attack type, thus ensuring diversity in the time dimension. The resulting dataset consists of a total of ten traffic categories: one normal traffic class and nine different attack classes.\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec25\" class=\"Section3\"\u003e \u003ch2\u003e4.1.5 Second Data Set Used for Comparison (WUSTL-IIoT-2021)\u003c/h2\u003e \u003cp\u003eThe WUSTL-IIoT-2021 data set was also used for comparison purposes in this study. This data set was created in an isolated and virtualized laboratory environment to represent network traffic from industrial IoT-based SCADA systems. In addition to normal operation scenarios, attack scenarios were generated in a controlled manner, and background traffic was preserved.\u003c/p\u003e \u003cp\u003eThe dataset contains approximately 1.2\u0026nbsp;million network flow records and 44 network/flow-based attributes. The records are labeled into five classes: normal, Backdoor, Command Injection, Denial of Service, and Reconnaissance. The explicit definition of Command Injection and Backdoor attacks specific to SCADA systems makes the dataset an important reference for industrial cybersecurity studies. Furthermore, the class imbalance observed in the dataset provides a realistic testing environment for detecting rare attacks and evaluating model robustness.\u003c/p\u003e \u003cp\u003eIn this study, two different datasets were used to evaluate the model's performance on both an internally created dataset and an external dataset commonly used in the literature:\u003c/p\u003e \u003cp\u003e \u003cul\u003e \u003cli\u003e \u003cp\u003e\u0026bull; SCADANet Dataset: An original dataset collected within the scope of the study, containing examples from different classes.\u003c/p\u003e \u003c/li\u003e \u003cli\u003e \u003cp\u003e\u0026bull; WUSTL-IIoT-2021 [\u003cspan citationid=\"CR84\" class=\"CitationRef\"\u003e84\u003c/span\u003e]: A data set frequently used in the literature, with high class diversity and a more heterogeneous structure.\u003c/p\u003e \u003c/li\u003e \u003c/ul\u003e \u003c/p\u003e \u003cp\u003eFor both data sets, all examples underwent standard preprocessing steps (scaling, label encoding, reshaping, etc.) as described in the methods section.\u003c/p\u003e \u003cp\u003eTo ensure a reliable and statistically meaningful evaluation of the model, the 5-fold cross-validation method was used in all experiments. Accordingly, the dataset was divided into five equal sub-sections while preserving the class distribution; in each experiment cycle, one of these sub-sections was designated as the test set, while the remaining four were used for training. After all layers were completed, the performance values obtained from each fold were combined, and the final results were reported by calculating the arithmetic mean and standard deviation of the metrics. This approach aims to ensure the model's stability, generalizability, and statistical reliability across different data subsets.\u003c/p\u003e \u003cp\u003eThe model was trained using the same hyperparameters, the same training strategy, and the same data splitting protocol in all experiments, thus providing a consistent basis for comparison between models.\u003c/p\u003e \u003c/div\u003e \u003c/div\u003e \u003cdiv id=\"Sec26\" class=\"Section2\"\u003e \u003ch2\u003e4.2. Addressing the Imbalanced Data Problem\u003c/h2\u003e \u003cp\u003eDue to a significant imbalance between classes in the datasets, a two-stage loss optimization strategy was applied to increase the representativeness of minority classes and improve the model's sensitivity to these classes. In this context, Focal Loss was first used to reduce the impact of easy examples belonging to frequently encountered classes on the loss function, thereby ensuring that the model focused on more difficult examples and minority classes. Additionally, class weights were defined to balance each class's contribution to the training process; these weights were determined in proportion to the inverse of the number of examples in the relevant class, thereby increasing the impact of rare classes on the total loss. This dual-pronged approach reduced biases arising from the imbalanced data problem and significantly strengthened the model's learning capacity, particularly for classes with low sample sizes.\u003c/p\u003e \u003cp\u003eThis two-stage approach to the imbalanced data problem has led to significant improvements in both recall and F1-score, especially for classes with small sample sizes.\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec27\" class=\"Section2\"\u003e \u003ch2\u003e4.3. Evaluation Metrics\u003c/h2\u003e \u003cp\u003eThe model's performance was evaluated not only based on accuracy but also using the following metrics to accurately reflect the effects of class imbalance:\u003cdiv id=\"Equ15\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ15\" name=\"EquationSource\"\u003e\n$$\\:Accuracy=\\frac{TP}{TP+FP}$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e15\u003c/div\u003e\u003c/div\u003e\u003cdiv id=\"Equ16\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ16\" name=\"EquationSource\"\u003e\n$$\\:Precision=\\frac{TP}{TP+FN}\\:$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e16\u003c/div\u003e\u003c/div\u003e\u003cdiv id=\"Equ17\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ17\" name=\"EquationSource\"\u003e\n$$\\:Recall=\\frac{TP\\:}{TP+FN}$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e17\u003c/div\u003e\u003c/div\u003e\u003cdiv id=\"Equ18\" class=\"Equation\"\u003e\u003cdiv format=\"TEX\" class=\"mathdisplay\" id=\"FileID_Equ18\" name=\"EquationSource\"\u003e\n$$\\:F1-Score=\\frac{2\\times\\:Precision\\:\\times\\:Recall}{Precision+Recall}$$\u003c/div\u003e\u003cdiv class=\"EquationNumber\"\u003e18\u003c/div\u003e\u003c/div\u003e\u003c/p\u003e \u003cp\u003eIn these metrics, TP represents true positives; TN represents true negatives; FP represents false positives; and FN represents false negatives. These four fundamental terms form the basis for calculating Accuracy, Precision, Recall, F1-score, and Confusion Matrix. These metrics have been calculated both class-based and average (macro/weighted); the mean and standard deviation values of the metrics across folds are reported in tables. Confusion matrices are presented in figures to detail the confusion between classes.\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec28\" class=\"Section2\"\u003e \u003ch2\u003e4.4. Results on the SCADANet Dataset\u003c/h2\u003e \u003cp\u003eFive-fold cross-validation experiments conducted on the SCADANet dataset obtained from experimental studies demonstrate that the proposed model possesses both high generalization performance and a strong representation capacity that can effectively perform inter-class discrimination. The integrated use of dilated CNN structures enabling multi-scale feature extraction, attention mechanisms at the channel level, and LSTM layers modeling temporal dependencies ensured that the model exhibited stable and consistent performance despite the pronounced class imbalance observed in the dataset. The model's 5-fold average performance metrics on the SCADANet dataset are presented in Table\u0026nbsp;\u003cspan refid=\"Tab6\" class=\"InternalRef\"\u003e5\u003c/span\u003e.\u003c/p\u003e \u003cp\u003e \u003cdiv class=\"gridtable\"\u003e\u003ctable float=\"Yes\" id=\"Tab6\" border=\"1\"\u003e \u003ccaption language=\"En\"\u003e \u003cdiv class=\"CaptionNumber\"\u003eTable 5\u003c/div\u003e \u003cdiv class=\"CaptionContent\"\u003e \u003cp\u003e5-Fold Average Performance Results for the SCADANet Dataset\u003c/p\u003e \u003c/div\u003e \u003c/caption\u003e \u003ccolgroup cols=\"2\"\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c1\" colnum=\"1\"\u003e\u003c/div\u003e \u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c2\" colnum=\"2\"\u003e\u003c/div\u003e \u003cthead\u003e \u003ctr\u003e \u003cth align=\"left\" colname=\"c1\"\u003e \u003cp\u003eMetric\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c2\"\u003e \u003cp\u003eValue\u003c/p\u003e \u003c/th\u003e \u003c/tr\u003e \u003c/thead\u003e \u003ctbody\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eAverage Accuracy\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e99.67\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eMacro Precision\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e97.10\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eMacro Recall\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e97.23\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eMacro F1-score\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e97.16\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eWeighted Precision\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e99.67\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eWeighted Recall\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e99.67\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eWeighted F1-score\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e99.67\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003c/tbody\u003e \u003c/colgroup\u003e \u003c/table\u003e\u003c/div\u003e \u003c/p\u003e \u003cp\u003eAs shown in Table\u0026nbsp;\u003cspan refid=\"Tab6\" class=\"InternalRef\"\u003e5\u003c/span\u003e, the average accuracy value of 0.9967 indicates that the model demonstrated high and stable accuracy performance throughout the five folds. The high macro average metrics reveal that the model does not focus solely on classes with dense samples; it can also effectively learn classes with low distribution. In particular, the Macro Recall value of 0.9723 indicates that samples belonging to minority classes are largely captured correctly and that the model offers strong performance in terms of sensitivity. The fact that the weighted average Precision, Recall, and F1-score values all reach 0.9967 is noteworthy in that it shows that the model can represent the overall distribution of the dataset almost flawlessly.\u003c/p\u003e \u003cp\u003eThe confusion matrix obtained by combining all test results of the five folds is presented in Fig.\u0026nbsp;\u003cspan refid=\"Fig5\" class=\"InternalRef\"\u003e5\u003c/span\u003e. This matrix allows for a detailed examination of the model's confusion levels between classes and clearly shows how errors are distributed across classes, especially in situations where class imbalance is intense.\u003c/p\u003e \u003cp\u003e \u003c/p\u003e \u003cp\u003eThe 5-fold pooled confusion matrix presented in Fig.\u0026nbsp;\u003cspan refid=\"Fig5\" class=\"InternalRef\"\u003e5\u003c/span\u003e clearly shows the model's class-based decision behavior and where errors are concentrated among classes. Upon examining the matrix, it is observed that values on the diagonal are dominant, especially in classes with high sample sizes, and off-diagonal errors are very limited; this indicates that the model has strongly learned the distinctive patterns associated with these classes. The low level of false negative (FN) values in minority classes indicates that the Focal Loss\u0026thinsp;+\u0026thinsp;class weights strategy used to address the imbalanced data problem has achieved the desired effect and reduced the model's tendency to miss critical examples. On the other hand, it is observed that class mix-ups are not randomly distributed; rather, they cluster between specific class pairs that can be considered structurally close to each other (e.g., shifts to neighboring classes in some classes). This finding suggests that the model generally learns the decision boundaries clearly, but that patterns with limited overlap between similar classes can cause errors. Overall, Fig.\u0026nbsp;\u003cspan refid=\"Fig5\" class=\"InternalRef\"\u003e5\u003c/span\u003e confirms that the model performs with high accuracy in majority classes while maintaining sensitivity in minority classes, exhibiting a balanced error profile.\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec29\" class=\"Section2\"\u003e \u003ch2\u003e4.5. Results on the WUSTL-IIoT-2021 Dataset\u003c/h2\u003e \u003cp\u003eFive-fold cross-validation experiments conducted on the WUSTL-IIoT-2021 dataset demonstrate that the proposed model exhibits high stability across different data distributions and possesses strong generalization capabilities. Although the class distribution of the WUSTL-IIoT-2021 dataset shows a more heterogeneous structure compared to the primary dataset, it was observed that the model's learning capacity and the strategies applied to address the imbalanced data problem remained effective on this dataset. The model's 5-fold average performance metrics on the WUSTL-IIoT-2021 dataset are presented in Table\u0026nbsp;\u003cspan refid=\"Tab7\" class=\"InternalRef\"\u003e6\u003c/span\u003e.\u003c/p\u003e \u003cp\u003e \u003cdiv class=\"gridtable\"\u003e\u003ctable float=\"Yes\" id=\"Tab7\" border=\"1\"\u003e \u003ccaption language=\"En\"\u003e \u003cdiv class=\"CaptionNumber\"\u003eTable 6\u003c/div\u003e \u003cdiv class=\"CaptionContent\"\u003e \u003cp\u003e5-Fold Average Performance Results for the WUSTL-IIoT-2021 Dataset\u003c/p\u003e \u003c/div\u003e \u003c/caption\u003e \u003ccolgroup cols=\"2\"\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c1\" colnum=\"1\"\u003e\u003c/div\u003e \u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c2\" colnum=\"2\"\u003e\u003c/div\u003e \u003cthead\u003e \u003ctr\u003e \u003cth align=\"left\" colname=\"c1\"\u003e \u003cp\u003eMetric\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c2\"\u003e \u003cp\u003eValue (%)\u003c/p\u003e \u003c/th\u003e \u003c/tr\u003e \u003c/thead\u003e \u003ctbody\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eAverage Accuracy\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e99.9973\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eAverage Macro Precision\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e97.79\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eAverage Macro Recall\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e97.68\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eAverage Macro F1-score\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e97.70\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eAverage Weighted Precision\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e99.9973\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eAverage Weighted Recall\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e99.9973\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eAverage Weighted F1-score\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e99.9973\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003c/tbody\u003e \u003c/colgroup\u003e \u003c/table\u003e\u003c/div\u003e \u003c/p\u003e \u003cp\u003eThe results presented in Table\u0026nbsp;\u003cspan refid=\"Tab7\" class=\"InternalRef\"\u003e6\u003c/span\u003e show that the proposed model demonstrates high and balanced performance not only in the majority classes of the dataset but also in classes with lower sample sizes. The fact that the macro average Precision, Recall, and F1-score values are above 97% reveals that the model has a strong discrimination capacity even in an evaluation environment where all classes contribute equally. In contrast, the fact that all weighted average metrics are at the 99.9973% level shows that the model can represent the distribution of the majority class almost flawlessly and that the overall classification accuracy is exceptionally high.\u003c/p\u003e \u003cp\u003eThe confusion matrix obtained by combining the test results of all folds is presented in Fig.\u0026nbsp;\u003cspan refid=\"Fig6\" class=\"InternalRef\"\u003e6\u003c/span\u003e. This matrix allows for a detailed examination of the model's levels of confusion between classes.\u003c/p\u003e \u003cp\u003e \u003c/p\u003e \u003cp\u003eWhen examining the confusion matrix presented in Fig.\u0026nbsp;\u003cspan refid=\"Fig6\" class=\"InternalRef\"\u003e6\u003c/span\u003e, it is clear that the model performs with extremely high accuracy on both small and large sample classes. Particularly in the majority class, the fact that nearly all of the over 1.1\u0026nbsp;million examples are correctly classified demonstrates the model's high representativeness and discriminative capacity. In medium-sized classes, error rates remain negligible, with only a limited number of false positives or false negatives observed. Even in classes with lower sample sizes, false negative values remain at a minimum level, indicating that the model does not miss critical classes and offers high sensitivity. Overall, the extremely low level of misclassifications confirms that the decision boundaries between classes have been learned in a clear and consistent manner.\u003c/p\u003e \u003cp\u003eWhen these findings are evaluated together, the results obtained on the WUSTL-IIoT-2021 dataset clearly demonstrate that the proposed model offers a high level of generalizability not only to the dataset used in the training process but also to external datasets with different distributions. The high macro average metrics indicate that minority classes are strongly represented, while the nearly flawless results obtained in the weighted average metrics confirm the model's overall classification stability and reliability. Considering the low error rates in the confusion matrix, it can be said that the proposed approach offers a scalable, reliable, and stable classification solution for different data sources.\u003c/p\u003e \u003c/div\u003e \u003cdiv id=\"Sec30\" class=\"Section2\"\u003e \u003ch2\u003e4.6. Ablation Study\u003c/h2\u003e \u003cp\u003eAblation study was performed only on the original SCADANet developed within the scope of this study to quantitatively demonstrate the contribution of the basic components in the proposed architecture to classification performance. In this context, the model architecture was systematically retrained with certain components disabled, and the performance of each configuration was analyzed comparatively. Thus, the contribution of each module to spatial and temporal representation power could be evaluated separately.\u003c/p\u003e \u003cp\u003eThe model configurations evaluated in the ablation study are listed below:\u003c/p\u003e \u003cp\u003e \u003cul\u003e \u003cli\u003e \u003cp\u003e\u0026bull; The proposed model including all components (ALL model),\u003c/p\u003e \u003c/li\u003e \u003cli\u003e \u003cp\u003e\u0026bull; The model with the Residual and SE blocks removed (Without Res-SE Block),\u003c/p\u003e \u003c/li\u003e \u003cli\u003e \u003cp\u003e\u0026bull; The model with the LSTM layer modeling temporal dependencies removed (Without LSTM), and\u003c/p\u003e \u003c/li\u003e \u003cli\u003e \u003cp\u003e\u0026bull; The model with the dilated CNN structure, which enables multi-scale feature extraction, removed (Without Dilated CNN). The performance results obtained are presented in Table\u0026nbsp;\u003cspan refid=\"Tab8\" class=\"InternalRef\"\u003e7\u003c/span\u003e.\u003c/p\u003e \u003c/li\u003e \u003c/ul\u003e \u003c/p\u003e \u003cp\u003e \u003cdiv class=\"gridtable\"\u003e\u003ctable float=\"Yes\" id=\"Tab8\" border=\"1\"\u003e \u003ccaption language=\"En\"\u003e \u003cdiv class=\"CaptionNumber\"\u003eTable 7\u003c/div\u003e \u003cdiv class=\"CaptionContent\"\u003e \u003cp\u003eAblation Study Results\u003c/p\u003e \u003c/div\u003e \u003c/caption\u003e \u003ccolgroup cols=\"5\"\u003e \u003cdiv align=\"left\" class=\"colspec\" colname=\"c1\" colnum=\"1\"\u003e\u003c/div\u003e \u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c2\" colnum=\"2\"\u003e\u003c/div\u003e \u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c3\" colnum=\"3\"\u003e\u003c/div\u003e \u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c4\" colnum=\"4\"\u003e\u003c/div\u003e \u003cdiv align=\"char\" char=\".\" class=\"colspec\" colname=\"c5\" colnum=\"5\"\u003e\u003c/div\u003e \u003cthead\u003e \u003ctr\u003e \u003cth align=\"left\" colname=\"c1\"\u003e \u003cp\u003eModel Configuration\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c2\"\u003e \u003cp\u003eAccuracy\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c3\"\u003e \u003cp\u003ePrecision\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c4\"\u003e \u003cp\u003eRecall\u003c/p\u003e \u003c/th\u003e \u003cth align=\"left\" colname=\"c5\"\u003e \u003cp\u003eF1-score\u003c/p\u003e \u003c/th\u003e \u003c/tr\u003e \u003c/thead\u003e \u003ctbody\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eALL model\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e0.9967\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e \u003cp\u003e0.9710\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e0.9723\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c5\"\u003e \u003cp\u003e0.9716\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eWithout Res-SE Block\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e0.9941\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e \u003cp\u003e0.9584\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e0.9569\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c5\"\u003e \u003cp\u003e0.9576\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eWithout LSTM\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e0.9928\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e \u003cp\u003e0.9411\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e0.9416\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c5\"\u003e \u003cp\u003e0.9412\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003ctr\u003e \u003ctd align=\"left\" colname=\"c1\"\u003e \u003cp\u003eWithout Dilated CNN\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c2\"\u003e \u003cp\u003e0.9919\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c3\"\u003e \u003cp\u003e0.9365\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c4\"\u003e \u003cp\u003e0.9348\u003c/p\u003e \u003c/td\u003e \u003ctd align=\"char\" char=\".\" colname=\"c5\"\u003e \u003cp\u003e0.9356\u003c/p\u003e \u003c/td\u003e \u003c/tr\u003e \u003c/tbody\u003e \u003c/colgroup\u003e \u003c/table\u003e\u003c/div\u003e \u003c/p\u003e \u003cp\u003eThe ablation results presented in Table\u0026nbsp;\u003cspan refid=\"Tab8\" class=\"InternalRef\"\u003e7\u003c/span\u003e clearly demonstrate that the ALL model configuration, in which all architectural components are active, achieves the highest values in terms of all performance metrics. This finding shows that the holistic design of the proposed architecture, which considers the interaction between components, provides meaningful and consistent contributions to classification performance.\u003c/p\u003e \u003cp\u003eThe findings obtained by disabling different architectural components within the ablation study are summarized as follows:\u003c/p\u003e \u003cp\u003e \u003cul\u003e \u003cli\u003e \u003cp\u003e\u0026bull; When the residual and SE blocks were removed, a significant decrease was observed, particularly in precision and F1-score values. This clearly demonstrates the critical role of attention mechanisms at the channel level in highlighting discriminative features and preserving information flow in deep network architectures. Disabling these components limited the model's discriminative representation capacity, resulting in weaker learning of inter-class decision boundaries.\u003c/p\u003e \u003c/li\u003e \u003cli\u003e \u003cp\u003e\u0026bull; Removing the LSTM layer caused a more pronounced performance loss in recall and F1-score values. This finding demonstrates that the LSTM structure makes an important contribution to effectively modeling sequential and temporal dependencies in the dataset. Failure to transfer temporal context information to the model led to an increase in false negatives, particularly by reducing the capture rate of examples belonging to minority classes.\u003c/p\u003e \u003c/li\u003e \u003cli\u003e \u003cp\u003e\u0026bull; When the Dilated CNN architecture was removed, it was observed that the model's ability to represent multi-scale spatial patterns weakened significantly, leading to a decline in all performance metrics. Without this architecture, which provides a wide receptive field, the model was unable to sufficiently distinguish complex structures at different scales.\u003c/p\u003e \u003c/li\u003e \u003c/ul\u003e \u003c/p\u003e \u003cp\u003eIn general, ablation studies clearly demonstrate that each component in the proposed architecture provides complementary and statistically significant contributions to performance. The combined use of multi-scale spatial feature extraction, channel attention mechanisms, and temporal modeling has enabled the model to exhibit high accuracy, balanced class performance, and strong generalization ability on unbalanced and complex data structures.\u003c/p\u003e \u003c/div\u003e"},{"header":"5. Conclusions and Future Work","content":"\u003cp\u003eIn this study, a hybrid deep learning architecture capable of modeling both multi-scale spatial patterns and temporal dependencies has been proposed for detecting cyberattacks observed in SCADA-based critical infrastructure networks. Within the scope of the study, a SCADANet dataset specific to SCADA systems was also created by designing a completely isolated virtual SCADA environment containing multi-class attack scenarios generated in parallel with legitimate network traffic. The proposed approach was comprehensively evaluated on both the created SCADA dataset and the WUSTL-IIoT-2021 dataset, which is widely used in the literature.\u003c/p\u003e \u003cp\u003eThe experimental analyses conducted demonstrate that the proposed architecture achieves high accuracy, macro F1-score, and recall values on both datasets. In particular, the high sensitivity achieved for attack types belonging to minority classes indicates that the model possesses strong representation and discrimination capabilities even under imbalanced data conditions. These results confirm that the combined use of multi-scale spatial feature extraction, channel-level attention mechanisms, and temporal modeling contributes significantly to the effective capture of complex attack patterns specific to SCADA traffic.\u003c/p\u003e \u003cp\u003eThe findings reveal that the proposed approach is not merely a model tailored to a specific dataset; it demonstrates generalizable and stable attack detection performance across SCADA environments with different traffic distributions and attack scenarios. In this respect, the study makes a significant contribution to the literature by providing a realistic experimental framework for SCADA security and by comprehensively evaluating the hybrid deep learning architecture on multiple data sources.\u003c/p\u003e \u003cp\u003eFuture work will focus on expanding the scope of the created dataset and integrating advanced attack scenarios specific to SCADA systems. In this regard, the goal is to include more sophisticated and process-oriented attack types in the system, such as Advanced Modbus False Data Injection (FDI), Modbus Command Abuse, APT-based data exfiltration, and Insider Threat (sabotage). Adding these types of attacks will increase both the diversity of attacks and the operational realism of the dataset.\u003c/p\u003e \u003cp\u003eIn the long term, the goal is to evaluate more advanced hybrid or autonomous deep learning architectures on this expanded dataset and to develop a real-time, scalable SCADA attack detection framework that is compatible with operational environments. Thus, the aim is to offer more resilient and application-oriented solutions for enhancing cybersecurity in critical infrastructure systems.\u003c/p\u003e"},{"header":"Declarations","content":"\u003cp\u003e \u003ch2\u003eConflicts of Interest:\u003c/h2\u003e \u003cp\u003eThe authors declare no conflicts of interest.\u003c/p\u003e \u003c/p\u003e\u003ch2\u003eFunding:\u003c/h2\u003e \u003cp\u003eThis research received no external funding.\u003c/p\u003e\u003ch2\u003eAuthor Contribution\u003c/h2\u003e\u003cp\u003eFor research articles with several authors, a short paragraph specifying their individual contributions must be provided. The following statements should be used \u0026ldquo;Conceptualization, O.P. and S.B.; methodology, S.B. and O.P; software, O.P. and S.B.; validation, S.B. and O.P.; formal analysis, O.P. and S.B.; investigation, O.P. and S.B.; resources, S.B. and O.P ; data curation, O.P., and S.B; writing\u0026mdash;original draft preparation, S.B., O.P.; writing\u0026mdash;review and editing, O.P. and S.B.; visualization, O.P. and S.B.; supervision, O.P.; project administration, O.P.; All authors have read and agreed to the published version of the manuscript.\u0026rdquo; Please turn to the CRediT taxonomy for the term explanation. Authorship must be limited to those who have contributed substantially to the work reported.\u003c/p\u003e\u003ch2\u003eData Availability\u003c/h2\u003e\u003cp\u003eThe WUSTL-IIoT-2021 dataset used in this study is an open-access dataset for research purposes. The dataset can be accessed via the official Washington University in St. Louis (WUSTL) data repository at the following link: https://www.cse.wustl.edu/~jain/iiot2/index.html. All data analyzed in this study are included in the published article. In addition to the WUSTL-IIoT-2021 dataset, this study also utilizes a dataset named SCADANet, which was generated by the authors to further support the experimental analysis.\u003c/p\u003e"},{"header":"References","content":"\u003col\u003e\u003cli\u003e\u003cspan\u003eBirnbaum, Z. et al. Cyber-Resilient SCADA Systems via Secure State Restoration. \u003cem\u003eIFIP Adv. Inf. Commun. Technol.\u003c/em\u003e \u003cb\u003e596\u003c/b\u003e, 183\u0026ndash;207 (2020).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eAlsabbagh, W., Amogbonjaye, S., Urrego, D. \u0026amp; Langend\u0026ouml;rfer, P. A. Stealthy False Command Injection Attack on Modbus based SCADA Systems. \u003cem\u003eProceedings - IEEE Consumer Communications and Networking Conference, CCNC\u003c/em\u003e 2023-January, (2023).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003ePaulraj, J., Raghuraman, B., Gopalakrishnan, N. \u0026amp; Otoum, Y. Autonomous AI-based Cybersecurity Framework for Critical Infrastructure: Real-Time Threat Mitigation. \u003cem\u003eIEEE/ACIS 29th International Conference on Software Engineering, Artificial Intelligence, Networking and Parallel/Distributed Computing (SNPD)\u003c/em\u003e 925\u0026ndash;931 (2025) 925\u0026ndash;931 (2025) (2025). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003e10.1109/SNPD65828.2025.11254587\u003c/span\u003e\u003cspan address=\"10.1109/SNPD65828.2025.11254587\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eDo, V. L., Fillatre, L., Nikiforov, I. \u0026amp; Willett, P. Security of SCADA systems against cyber-physical attacks. \u003cem\u003eIEEE Aerosp. Electron. Syst. Mag.\u003c/em\u003e \u003cb\u003e32\u003c/b\u003e, 28\u0026ndash;45 (2017).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eJahan Simu, S. \u0026amp; Zaman, F. I. Advanced Cybersecurity Strategies for Protecting Critical Infrastructure: Strengthening the Backbone of National Security. \u003cem\u003eInt. J. Sci. Res. Manage. (IJSRM)\u003c/em\u003e. \u003cb\u003e11\u003c/b\u003e, 999\u0026ndash;1016 (2023).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eLehto, M. Cyber-Attacks Against Critical Infrastructure. \u003cem\u003eComput. Methods Appl. Sci.\u003c/em\u003e \u003cb\u003e56\u003c/b\u003e, 3\u0026ndash;42 (2022).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eLe, X., Li, J., Zhao, Y., Fan, Z. A. \u0026amp; Security-Enhanced Scheme for ModBus TCP Protocol Based on Lightweight Cryptographic Algorithm. \u003cem\u003eElectron. 2025\u003c/em\u003e. \u003cb\u003e14\u003c/b\u003e, 3674 (2025).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eMohammed, A. S., Saxena, N. \u0026amp; Rana, O. Wheels on the Modbus - Attacking ModbusTCP Communications. \u003cem\u003eWiSec 2022 - Proceedings of the 15th ACM Conference on Security and Privacy in Wireless and Mobile Networks\u003c/em\u003e 22, 288\u0026ndash;289 (2022).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eZhang, H. et al. A Method to Recognize DoS Attacks on Modbus/TCP. \u003cem\u003eConference Proceedings of the IEEE International Performance, Computing, and Communications Conference\u003c/em\u003e 2022-November, 319\u0026ndash;324 (2022).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eSayghe, A. Digital Twin-Driven Intrusion Detection for Industrial SCADA: A Cyber-Physical Case Study. \u003cem\u003eSens. 2025\u003c/em\u003e. \u003cb\u003e25\u003c/b\u003e, 4963 (2025).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eZhu, B. \u0026amp; Sastry, S. Intrusion Detection and Resilient Control for SCADA Systems. \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://services.igi-global.com/resolvedoi/resolve.aspx?doi=10.4018/978-1-4666-2659-1\u003c/span\u003e\u003cspan address=\"https://services.igi-global.com/resolvedoi/resolve.aspx?doi=10.4018/978-1-4666-2659-1\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e.\u003cem\u003ech015\u003c/em\u003e 352\u0026ndash;383 (1AD) \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003e10.4018/978-1-4666-2659-1.CH015\u003c/span\u003e\u003cspan address=\"10.4018/978-1-4666-2659-1.CH015\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eIntrusion detection in. scada systems using one-class classification | IEEE Conference Publication | IEEE Xplore. \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://ieeexplore.ieee.org/abstract/document/6811620\u003c/span\u003e\u003cspan address=\"https://ieeexplore.ieee.org/abstract/document/6811620\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eGbabo, E. Y., Okenwa, K. \u0026amp; Chima, E. O. Developing Intrusion Detection Integration Models for SCADA-Controlled Electricity Infrastructure. (2023). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://doi.org/10.32628/IJSRST\u003c/span\u003e\u003cspan address=\"10.32628/IJSRST\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e doi:10.32628/IJSRST.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eKim, B. K. \u0026amp; Kang, Y. Abnormal Traffic Detection Mechanism for Protecting IIoT Environments. \u003cem\u003e9th International Conference on Information and Communication Technology Convergence: ICT Convergence Powered by Smart Intelligence, ICTC 2018\u003c/em\u003e 943\u0026ndash;945 (2018). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003e10.1109/ICTC.2018.8539533\u003c/span\u003e\u003cspan address=\"10.1109/ICTC.2018.8539533\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eRadoglou-Grammatikis, P. Implementation and detection of modbus cyberattacks. \u003cem\u003e9th International Conference on Modern Circuits and Systems\u003c/em\u003e Technologies, \u003cem\u003eMOCAST 2020\u003c/em\u003e (2020). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://doi.org/10.1109/MOCAST49295.2020.9200287\u003c/span\u003e\u003cspan address=\"10.1109/MOCAST49295.2020.9200287\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e (2020) doi:10.1109/MOCAST49295.2020.9200287.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eMehrotra, L. \u0026amp; Saxena, P. S. An Assessment Report on: Statistics-Based and Signature-Based Intrusion Detection Techniques. \u003cem\u003eAdv. Intell. Syst. Comput.\u003c/em\u003e \u003cb\u003e625\u003c/b\u003e, 321\u0026ndash;327 (2018).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eDoğan, F., Polat, O. \u0026amp; Yardimci, F. A new method for detecting beaconing attacks in IoT-based scada systems. \u003cem\u003eInternational Journal of Information Security 2025 24:6\u003c/em\u003e 24, 244- (2025).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eBajwa, A., Al Razee Tonoy, A., Rana, S., Ahmed, I. \u0026amp; CYBERSECURITY IN INDUSTRIAL CONTROL SYSTEMS: A SYSTEMATIC LITERATURE REVIEW ON AI-BASED THREAT DETECTION FOR SCADA AND IOT NETWORKS.. 1\u0026ndash;15 \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003e10.63125/1cr1kj17\u003c/span\u003e\u003cspan address=\"10.63125/1cr1kj17\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eSharma, N. \u0026amp; Arora, B. Machine Learning and Deep Learning Models for Anomaly Intrusion Detection in Networks: A Systematic Review. \u003cem\u003eSN Computer Science 2025 6:7\u003c/em\u003e 6, 832- (2025).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eRazaque, A. et al. Review of malicious code detection in data mining applications: challenges, algorithms, and future direction. \u003cem\u003eCluster Comput.\u003c/em\u003e \u003cb\u003e28\u003c/b\u003e, 206 (2025).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eCui, J., Long, J., Min, E., Liu, Q. \u0026amp; Li, Q. Comparative Study of CNN and RNN for Deep Learning Based Intrusion Detection System. \u003cem\u003eInternational Conference on Communication, Computing \u0026amp; Security\u003c/em\u003e 11067 LNCS, 159\u0026ndash;170 (2018).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eBarik, K., Misra, S., Konar, K., Fernandez-Sanz, L. \u0026amp; Koyuncu, M. Cybersecurity Deep: Approaches, Attacks Dataset, and Comparative Study. \u003cem\u003eApplied Artif. Intelligence\u003c/em\u003e \u003cb\u003e36\u003c/b\u003e, (2022).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eElsayed, S., Mohamed, K. \u0026amp; Madkour, M. A. A Comparative Study of Using Deep Learning Algorithms in Network Intrusion Detection. \u003cem\u003eIEEE Access.\u003c/em\u003e \u003cb\u003e12\u003c/b\u003e, 58851\u0026ndash;58870 (2024).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eKimanzi, R., Kimanga, P., Cherori, D. \u0026amp; Gikunda, P. K. Deep Learning Algorithms Used in Intrusion Detection Systems -- A Review. (2024). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://arxiv.org/pdf/2402.17020\u003c/span\u003e\u003cspan address=\"https://arxiv.org/pdf/2402.17020\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eAl-Shurbaji, T. et al. Deep Learning-Based Intrusion Detection System for Detecting IoT Botnet Attacks: A Review. \u003cem\u003eIEEE Access.\u003c/em\u003e \u003cb\u003e13\u003c/b\u003e, 11792\u0026ndash;11822 (2025).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eSangeetha, K., Kala, A., Femi, P. S. \u0026amp; Priya, S. B. A Comparative Analysis of Deep Learning Based Techniques for Cyber Security \u003cem\u003e1st International Conference on Software, Systems and Information\u003c/em\u003e Technology, \u003cem\u003eSSITCON 2024\u003c/em\u003e (2024). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://doi.org/10.1109/SSITCON62437.2024.10796142\u003c/span\u003e\u003cspan address=\"10.1109/SSITCON62437.2024.10796142\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e (2024) doi:10.1109/SSITCON62437.2024.10796142.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eMarkkandeyan, S. et al. Novel hybrid deep learning based cyber security threat detection model with optimization algorithm. \u003cem\u003eCyber Secur. Appl.\u003c/em\u003e \u003cb\u003e3\u003c/b\u003e, 100075 (2025).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eAlguliyev, R. \u0026amp; Shikhaliyev, R. Network cybersecurity incidents multiclassification based on deep learning Network cybersecurity incidents Network cybersecurity incidents multiclassification, Deep learning model, CNN-LSTM model Network traffic classification. \u003cem\u003eProbl. Inform. Technol.\u003c/em\u003e \u003cb\u003e15\u003c/b\u003e, 16\u0026ndash;23 (2024).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eWUSTL-IIOT-. 2021 Dataset for IIoT Cybersecurity Research. \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://www.cse.wustl.edu/~jain/iiot2/index.html\u003c/span\u003e\u003cspan address=\"https://www.cse.wustl.edu/~jain/iiot2/index.html\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eMorris, T. H. \u0026amp; Gao, W. Industrial Control System Cyber Attacks. https://doi.org/10.14236/EWIC/ICSCSR2013.3 doi:\u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003e10.14236/EWIC/ICSCSR2013.3\u003c/span\u003e\u003cspan address=\"10.14236/EWIC/ICSCSR2013.3\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e. (2013).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eYang, Y. S. et al. Securing SCADA Energy Management System under DDos Attacks Using Token Verification Approach. \u003cem\u003eAppl. Sci. 2022\u003c/em\u003e. \u003cb\u003e12, Page 530\u003c/b\u003e (12), 530 (2022).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eAltaleb, H. \u0026amp; Rajnai, Z. Malware Attacks on SCADA Systems: Assessing Risks and Strengthening Cybersecurity Measures. \u003cem\u003eSISY 2023 - IEEE 21st International Symposium on Intelligent Systems and Informatics, Proceedings\u003c/em\u003e 625\u0026ndash;629 (2023). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003e10.1109/SISY60376.2023.10417951\u003c/span\u003e\u003cspan address=\"10.1109/SISY60376.2023.10417951\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eWali, S., Farrukh, Y. A., Khan, I. \u0026amp; Hamilton, J. A. Covert penetrations: Analyzing and defending SCADA systems from stealth and Hijacking attacks. \u003cem\u003eComput. Secur.\u003c/em\u003e \u003cb\u003e156\u003c/b\u003e, 104449 (2025).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eSayegh, N., Chehab, A., Elhajj, I. H. \u0026amp; Kayssi, A. Internal security attacks on SCADA systems. \u003cem\u003e3rd International Conference on Communications and Information Technology, ICCIT 2013\u003c/em\u003e 22\u0026ndash;27 (2013) 22\u0026ndash;27 (2013) (2013). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003e10.1109/ICCITECHNOLOGY.2013.6579516\u003c/span\u003e\u003cspan address=\"10.1109/ICCITECHNOLOGY.2013.6579516\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eMondal, S., Prudhvi, B., Khare, P. \u0026amp; Bharata Reddy, M. J. Real-time analysis of cyber attacks in SCADA based power system. \u003cem\u003eAustralian J. Electr. Electron. Eng.\u003c/em\u003e https://doi.org/10.1080 (2025). 2025.2531694;REQUESTEDJOURNAL:JOURNAL:TELE20;WGROUP:STRING:PUBLICATION./1448837X.2025.2531694;REQUESTEDJOURNAL:JOURNAL:TELE20;WGROUP:STRING:PUBLICATION.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eLangner, R. \u0026amp; Stuxnet Dissecting a cyberwarfare weapon. \u003cem\u003eIEEE Secur. Priv.\u003c/em\u003e \u003cb\u003e9\u003c/b\u003e, 49\u0026ndash;51 (2011).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eNERC | Report Title | Report Date I Analysis of the Cyber Attack on the Ukrainian Power Grid Defense Use Case. (2016).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eTriton Malware Spearheads Latest Attacks on Industrial Systems | McAfee Blog. \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://www.mcafee.com/blogs/other-blogs/mcafee-labs/triton-malware-spearheads-latest-generation-of-attacks-on-industrial-systems/\u003c/span\u003e\u003cspan address=\"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/triton-malware-spearheads-latest-generation-of-attacks-on-industrial-systems/\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eSlowik, J. \u0026amp; THE BAFFLING BERSERK BEAR: A DECADE\u0026rsquo;S ACTIVITY TARGETING CRITICAL INFRASTRUCTURE. \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003e\u003c/span\u003e\u003cspan address=\"http://www.virusbulletin.com\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eView of Dragonfly Cyber Threats. A Case Study of Malware Attacks Targeting Power Grids. \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://jcbi.org/index.php/Main/article/view/137/82\u003c/span\u003e\u003cspan address=\"https://jcbi.org/index.php/Main/article/view/137/82\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eVerkerken, M., D\u0026rsquo;hooge, L., Wauters, T., Volckaert, B. \u0026amp; De Turck, F. Towards Model Generalization for Intrusion Detection: Unsupervised Machine Learning Techniques. \u003cem\u003eJournal of Network and Systems Management 2021 30:1\u003c/em\u003e 30, 12- (2021).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eBronk, C. \u0026amp; Tikk-Ringas, E. The Cyber Attack on Saudi Aramco. \u003cem\u003eSurvival (Lond)\u003c/em\u003e. \u003cb\u003e55\u003c/b\u003e, 81\u0026ndash;96 (2013).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eLiao, H. J., Lin, R., Lin, C. H., Tung, K. \u0026amp; Y. C. \u0026amp; Y. Intrusion detection system: A comprehensive review. \u003cem\u003eJ. Netw. Comput. Appl.\u003c/em\u003e \u003cb\u003e36\u003c/b\u003e, 16\u0026ndash;24 (2013).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eTripathi, A., Upadhyay, P. \u0026amp; Goel, P. K. Industrial Control Systems (ICS) Security: AI-Based Threat Detection and Prevention. \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://services.igi-global.com/resolvedoi/resolve.aspx?doi=10.4018/979-8-3373-3241-3\u003c/span\u003e\u003cspan address=\"https://services.igi-global.com/resolvedoi/resolve.aspx?doi=10.4018/979-8-3373-3241-3\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e.\u003cem\u003ech008\u003c/em\u003e 149\u0026ndash;172 (1AD) \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003e10.4018/979-8-3373-3241-3.CH008\u003c/span\u003e\u003cspan address=\"10.4018/979-8-3373-3241-3.CH008\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eAwaad, A. M., Alheeti, A., Najem, A. K. \u0026amp; K. M. \u0026amp; A. H. Anomaly-Based IDS (Intrusion Detection System) for Cyber-Physical Systems. \u003cem\u003eMesopotamian J. Big Data\u003c/em\u003e. \u003cb\u003e2024\u003c/b\u003e, 230\u0026ndash;240 (2024).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eAhakonye, L. A. C., Nwakanma, C. I., Lee, J. M. \u0026amp; Kim, D. S. SCADA intrusion detection scheme exploiting the fusion of modified decision tree and Chi-square feature selection. \u003cem\u003eInternet Things\u003c/em\u003e. \u003cb\u003e21\u003c/b\u003e, 100676 (2023).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eNetwork Intrusion Detection System using Ensemble Learning. MSc Academic Cyber Security Samruddhi Basagouda Patil.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eSukhadeo, B. S. et al. MLIDS: A Machine Learning-Based Intrusion Detection System Using the NSLKDD Data. \u003cem\u003eInt. J. Intell. Syst. Appl. Eng.\u003c/em\u003e \u003cb\u003e12\u003c/b\u003e, 167\u0026ndash;179 (2023).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eLee, J. H., Shin, J. \u0026amp; Seo, J. T. Solar Power Plant Network Packet-Based Anomaly Detection System for Cybersecurity. \u003cem\u003eComputers Mater. Continua\u003c/em\u003e. \u003cb\u003e77\u003c/b\u003e, 757 (2023).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eArqane, A., Boutkhoum, O., Boukhriss, H. \u0026amp; Moutaouakkil, A. E. L. Review-Intrusion Detection System using Ensemble Learning Approaches: A Systematic Literature Intrusion Detection System using Ensemble Learning Approaches: A Systematic Literature Review. \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://doi.org/10.3991/ijoe.v18i13.33519\u003c/span\u003e\u003cspan address=\"10.3991/ijoe.v18i13.33519\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e doi:10.3991/ijoe.v18i13.33519.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eGbashi, S. M., Adedeji, P. A., Olatunji, O. O. \u0026amp; Madushele, N. Optimal feature selection for a weighted k-nearest neighbors for compound fault classification in wind turbine gearbox. \u003cem\u003eResults Eng.\u003c/em\u003e \u003cb\u003e25\u003c/b\u003e, 103791 (2025).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eRoopesh, Albert, B., Manuel, A. S. \u0026amp; Hemram, S. Developing an ML Model for Detecting the Cyber Attacks in Electric Vehicles. \u003cem\u003eInternational Conference on Cognitive Robotics and Intelligent Systems, ICC - ROBINS 2024\u003c/em\u003e 776\u0026ndash;781 (2024) 776\u0026ndash;781 (2024) (2024). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003e10.1109/ICC-ROBINS60238.2024.10533886\u003c/span\u003e\u003cspan address=\"10.1109/ICC-ROBINS60238.2024.10533886\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eShang, W. et al. An Efficient Anomaly Detection Method for Industrial Control Systems: Deep Convolutional Autoencoding Transformer Network. \u003cem\u003eInternational Journal of Intelligent Systems\u003c/em\u003e 5459452 (2024). (2024).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eGao, J. et al. Omni SCADA Intrusion Detection Using Deep Learning Algorithms. \u003cem\u003eIEEE Internet Things J.\u003c/em\u003e \u003cb\u003e8\u003c/b\u003e, 951\u0026ndash;961 (2021).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eF\u0026auml;hrmann, D., Ihlefeld, M., Kuijper, A. \u0026amp; Damer, N. Resource-Efficient Anomaly Detection in Industrial Control Systems With Quantized Recurrent Variational Autoencoder. \u003cem\u003eIET Collaborative Intell. Manuf.\u003c/em\u003e \u003cb\u003e7\u003c/b\u003e, e70032 (2025).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eMusthafa, M. Real-Time Intrusion Detection Leveraging Deep Learning: A Comparative Analysis of CNN, RNN, and Transformer Architectures. \u003cem\u003eInternational J. Adv. Eng. Manage. Sci. (IJAEMS) Peer-Reviewed Journal\u003c/em\u003e \u003cb\u003e11\u003c/b\u003e, 2454\u0026ndash;1311 .\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eNour, S. M. \u0026amp; Said, S. A. Deep Learning Performance Evaluation Model for Enhancing Network Intrusion Detection Systems. \u003cem\u003eNILES \u0026ndash;6th Novel Intelligent and Leading Emerging Sciences Conference, Proceedings\u003c/em\u003e 61\u0026ndash;65 (2024) 61\u0026ndash;65 (2024) (2024). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003e10.1109/NILES63360.2024.10753184\u003c/span\u003e\u003cspan address=\"10.1109/NILES63360.2024.10753184\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eSiegel, B. Industrial Anomaly Detection: A Comparison of Unsupervised Neural Network Architectures. \u003cem\u003eIEEE Sens. Lett\u003c/em\u003e \u003cb\u003e4\u003c/b\u003e, (2020).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eAbd Elaziz, M., Ahmed Fares, I. \u0026amp; Aseeri, A. O. CKAN: Convolutional Kolmogorov-Arnold Networks Model for Intrusion Detection in IoT Environment. \u003cem\u003eIEEE Access.\u003c/em\u003e \u003cb\u003e12\u003c/b\u003e, 134837\u0026ndash;134851 (2024).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eSaheed, Y. K., Misra, S. \u0026amp; Chockalingam, S. Autoencoder via DCNN and LSTM Models for Intrusion Detection in Industrial Control Systems of Critical Infrastructures. \u003cem\u003eProceedings \u0026ndash;\u0026thinsp;2023 IEEE/ACM 4th International Workshop on Engineering and Cybersecurity of Critical Systems, EnCyCriS 2023\u003c/em\u003e 9\u0026ndash;16 (2023). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003e10.1109/ENCYCRIS59249.2023.00006\u003c/span\u003e\u003cspan address=\"10.1109/ENCYCRIS59249.2023.00006\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eNazir, S., Patel, S. \u0026amp; Patel, D. Autoencoder Based Anomaly Detection for SCADA Networks. \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://services.igi-global.com/resolvedoi/resolve.aspx?doi=10.4018/IJAIML.20210701.oa\u003c/span\u003e\u003cspan address=\"https://services.igi-global.com/resolvedoi/resolve.aspx?doi=10.4018/IJAIML.20210701.oa\" targettype=\"URL\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003cem\u003e6\u003c/em\u003e 11, 83\u0026ndash;99 (1AD).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eCasaj\u0026uacute;s-Seti\u0026eacute;n, J., Bielza, C. \u0026amp; Larra\u0026ntilde;aga, P. Anomaly-Based Intrusion Detection in IIoT Networks Using Transformer Models. \u003cem\u003eProceedings of the IEEE International Conference on Cyber Security and Resilience, CSR 2023\u003c/em\u003e 72\u0026ndash;77 (2023) 72\u0026ndash;77 (2023) (2023). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003e10.1109/CSR57506.2023.10224965\u003c/span\u003e\u003cspan address=\"10.1109/CSR57506.2023.10224965\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eOrtega-Fernandez, I., Sestelo, M. \u0026amp; Burguillo, J. C. \u0026amp; Pi\u0026ntilde;\u0026oacute;n-Blanco, C. Network intrusion detection system for DDoS attacks in ICS using deep autoencoders. \u003cem\u003eWireless Networks 2023 30:6\u003c/em\u003e 30, 5059\u0026ndash;5075 (2023).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eRamos, L. S. \u0026amp; Yang, Z. LSTM-Based Detection of OT Cyber-Attacks for an Offshore HVAC-Cooling Process. \u003cem\u003eIEEE 6th International Conference on Electronic Information and Communication Technology, ICEICT 2023\u003c/em\u003e 943\u0026ndash;948 (2023) 943\u0026ndash;948 (2023) (2023). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003e10.1109/ICEICT57916.2023.10245766\u003c/span\u003e\u003cspan address=\"10.1109/ICEICT57916.2023.10245766\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eJi, I., Jeon, S. \u0026amp; Seo, J. T. AE-LSTM Based Anomaly Detection System for Communication Over DNP 3.0. \u003cem\u003eLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)\u003c/em\u003e 14402 LNCS, 91\u0026ndash;104 (2024).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eMacas, M., Wu, C. \u0026amp; Fuertes, W. An Attention-Based Deep Generative Model for Anomaly Detection in Industrial Control Systems. \u003cem\u003eInternational Conference on Web Information Systems and Technologies, WEBIST - Proceedings\u003c/em\u003e 566\u0026ndash;577 (2024). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003e10.5220/0012264000003584\u003c/span\u003e\u003cspan address=\"10.5220/0012264000003584\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eBasnet, M., Poudyal, S., Ali, M. H. \u0026amp; Dasgupta, D. Ransomware detection using deep learning in the SCADA system of electric vehicle charging station. \u003cem\u003e2021 IEEE PES Innovative Smart Grid Technologies Conference - Latin America, ISGT Latin America\u003c/em\u003e (2021). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://doi.org/10.1109/ISGTLATINAMERICA52371.2021.9543031\u003c/span\u003e\u003cspan address=\"10.1109/ISGTLATINAMERICA52371.2021.9543031\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e (2021) doi:10.1109/ISGTLATINAMERICA52371.2021.9543031.\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eEshmawi, A. A., Aldrees, A. \u0026amp; Alharthi, R. Smart framework for industrial IoT and cloud computing network intrusion detection using a ConvLSTM-based deep learning model. \u003cem\u003eFront. Comput. Sci.\u003c/em\u003e \u003cb\u003e7\u003c/b\u003e, 1622382 (2025).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eAlsaiari, A., Ilyas, M. A. \u0026amp; Hybrid, C. N. N. L. S. T. M. Deep Learning Model for Intrusion Detection in Smart Grid. \u003cem\u003eSSRN Electron. J.\u003c/em\u003e \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://doi.org/10.2139/ssrn.5446576\u003c/span\u003e\u003cspan address=\"10.2139/ssrn.5446576\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e (2025).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eZhang, Y., Zhang, L. \u0026amp; Zheng, X. Enhanced Intrusion Detection for ICS Using MS1DCNN and Transformer to Tackle Data Imbalance. \u003cem\u003eSens. 2024\u003c/em\u003e. \u003cb\u003e24\u003c/b\u003e, 7883 (2024).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eHarrou, F., Bouyeddou, B., Dairi, A. \u0026amp; Sun, Y. Exploiting Autoencoder-Based Anomaly Detection to Enhance Cybersecurity in Power Grids. \u003cem\u003eFuture Internet 2024\u003c/em\u003e. \u003cb\u003e16\u003c/b\u003e, 184 (2024).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eMahi-Al-rashid, A., Hossain, F., Anwar, A. \u0026amp; Azam, S. False Data Injection Attack Detection in Smart Grid Using Energy Consumption Forecasting. \u003cem\u003eEnergies 2022\u003c/em\u003e. \u003cb\u003e15\u003c/b\u003e, 4877 (2022).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eMuhlburger, H., Wotawa, F. A. \u0026amp; Passive Testing Approach using a Semi-Supervised Intrusion Detection Model for SCADA Network Traffic. \u003cem\u003eProceedings \u0026ndash;\u0026thinsp;4th IEEE International Conference on Artificial Intelligence Testing, AITest 2022\u003c/em\u003e 42\u0026ndash;47 (2022). \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003e10.1109/AITEST55621.2022.00015\u003c/span\u003e\u003cspan address=\"10.1109/AITEST55621.2022.00015\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eChu, A., Lai, Y. \u0026amp; Liu, J. Industrial Control Intrusion Detection Approach Based on Multiclassification GoogLeNet-LSTM Model. \u003cem\u003eSecurity and Communication Networks\u003c/em\u003e 6757685 (2019). (2019).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eAlam, M., Abid, F., Guangpei, C. \u0026amp; Yunrong, L. V. Social media sentiment analysis through parallel dilated convolutional neural network for smart city applications. \u003cem\u003eComput. Commun.\u003c/em\u003e \u003cb\u003e154\u003c/b\u003e, 129\u0026ndash;137 (2020).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eChauhan, V. K. \u0026amp; Kumar, A. Cascaded capsule twin attentional dilated convolutional network for malicious URL detection. \u003cem\u003eExpert Syst. Appl.\u003c/em\u003e \u003cb\u003e262\u003c/b\u003e, 125507 (2025).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eQi, G., Mao, J., Huang, K., You, Z. \u0026amp; Lin, J. Multi-Head Attention Enhanced Parallel Dilated Convolution and Residual Learning for Network Traffic Anomaly Detection. \u003cem\u003eComputers Mater. Continua\u003c/em\u003e. \u003cb\u003e82\u003c/b\u003e, 2159 (2025).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eHussen, N., Elghamrawy, S. M., Salem, M. \u0026amp; El-Desouky A. I. A Fully Streaming Big Data Framework for Cyber Security Based on Optimized Deep Learning Algorithm. \u003cem\u003eIEEE Access.\u003c/em\u003e \u003cb\u003e11\u003c/b\u003e, 65675\u0026ndash;65688 (2023).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eBjorck, N., Gomes, C. P., Selman, B. \u0026amp; Weinberger, K. Q. Understanding Batch Normalization. \u003cem\u003eAdv Neural Inf. Process. Syst\u003c/em\u003e \u003cb\u003e31\u003c/b\u003e, (2018).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eKumar, A., HybridNet \u0026amp; Convolutions, D. Advancing Deepfake Detection Through Residual, SE, and \u003cem\u003eIEEE Access.\u003c/em\u003e \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003ehttps://doi.org/10.1109/ACCESS.2025.3640106\u003c/span\u003e\u003cspan address=\"10.1109/ACCESS.2025.3640106\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e doi:10.1109/ACCESS.2025.3640106. (2025).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eKang, J., Jang, S., Li, S., Jeong, Y. S. \u0026amp; Sung, Y. Long short-term memory-based Malware classification method for information security. \u003cem\u003eComput. Electr. Eng.\u003c/em\u003e \u003cb\u003e77\u003c/b\u003e, 366\u0026ndash;375 (2019).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eHeddam, S. et al. A long short-term memory deep learning approach for river water temperature prediction. \u003cem\u003eCurrent Trends and Advances in Computer-Aided Intelligent Environmental Data Engineering: A\u003c/em\u003e. \u003cem\u003eIntell. Data-Centric Syst.\u003c/em\u003e 243\u0026ndash;270. \u003cspan class=\"ExternalRef\"\u003e\u003cspan class=\"RefSource\"\u003e10.1016/B978-0-323-85597-6.00015-X\u003c/span\u003e\u003cspan address=\"10.1016/B978-0-323-85597-6.00015-X\" targettype=\"DOI\" class=\"RefTarget\"\u003e\u003c/span\u003e\u003c/span\u003e (2022).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eLaghrissi, F. E., Douzi, S., Douzi, K. \u0026amp; Hssina, B. Intrusion detection systems using long short-term memory (LSTM). \u003cem\u003eJournal of Big Data 2021 8:1\u003c/em\u003e 8, 65- (2021).\u003c/span\u003e\u003c/li\u003e \u003cli\u003e\u003cspan\u003eZolanvari, M., Teixeira, M. A., Gupta, L., Khan, K. M. \u0026amp; Jain, R. Machine Learning-Based Network Vulnerability Analysis of Industrial Internet of Things. \u003cem\u003eIEEE Internet Things J.\u003c/em\u003e \u003cb\u003e6\u003c/b\u003e, 6822\u0026ndash;6834 (2019).\u003c/span\u003e\u003c/li\u003e\u003c/ol\u003e"}],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":true,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":false,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":false,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"SCADA Security, Anomaly Detection, Critical Infrastructure Systems, Hybrid Deep Learning, Cyber Attack Detection","lastPublishedDoi":"10.21203/rs.3.rs-8628547/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-8628547/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eIndustrial control networks based on Supervisory Control and Data Acquisition (SCADA) systems used in critical infrastructure systems require reliable, scalable, and generalisable attack detection mechanisms in the face of increasing cyber threats. However, a large portion of the datasets commonly used in the literature are based on general-purpose network traffic and do not adequately reflect the cyclical, deterministic, and process-oriented communication structure of industrial protocols such as Modbus/TCP. In this study, a completely isolated virtual SCADA environment was designed to address this limitation. A SCADA-specific, multi-class attack dataset called SCADANet has been created, containing nine different attack scenarios generated concurrently with legitimate network traffic. In this context, a hybrid deep learning architecture consisting of parallel dilated Convolutional Neural Network (CNN) structures, Residual-SE blocks, and Long Short-Term Memory (LSTM) layers, capable of modelling multi-scale spatial patterns and temporal dependencies together, has been recommended. To examine the generalisability of the proposed approach, the developed model was tested on both the SCADANet dataset and the WUSTL-IIoT-2021 dataset, which is widely used in the literature. Experimental results show that the proposed architecture achieves high accuracy and macro F1-score on both datasets, particularly demonstrating a significant increase in sensitivity in minority attack classes. Furthermore, the ablation study conducted reveals that each component in the architecture contributes meaningfully and complementarily to the overall performance. The findings demonstrate that the proposed deep learning-based approach can effectively model traffic characteristics specific to SCADA systems and exhibits stable attack detection performance across different data sources. In this respect, the study makes important methodological and experimental contributions to the literature on cyber attack detection in SCADA-based critical infrastructure systems.\u003c/p\u003e","manuscriptTitle":"A Multi-Component Deep Learning Approach for Cyber Attack Detection in Critical Infrastructure SCADA Systems","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2026-02-17 12:02:12","doi":"10.21203/rs.3.rs-8628547/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"2ae58d69-6867-4e0c-bac7-2fe509beef36","owner":[],"postedDate":"February 17th, 2026","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[{"id":62937943,"name":"Physical sciences/Engineering"},{"id":62937944,"name":"Physical sciences/Mathematics and computing"}],"tags":[],"updatedAt":"2026-03-26T05:40:51+00:00","versionOfRecord":[],"versionCreatedAt":"2026-02-17 12:02:12","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-8628547","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-8628547","identity":"rs-8628547","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}