Cyber-Physical Attack Detection in Water Distribution Systems Using a Hybrid Ensemble of XGBoost, Isolation Forest, and LSTM Autoencoder on the BATADAL Dataset

Rigorous Evaluation of Machine Learning Intrusion Detection for Water Treatment Systems on SWaT Network Traffic

Intrusion detection systems (IDSs) for industrial control networks are commonly evaluated using random stratified splits, placing rows from every recorded attack in both training and test sets. Although convenient, this practice measures a model’s ability to recognise repetitions of patterns it has already seen rather than its ability to detect novel attacks. We revisit supervised and unsupervised machine-learning IDSs on the Secure Water Treatment (SWaT) dataset’s network-traffic modality, extending a prior conference study, and quantify the effect of more rigorous evaluation protocols. We evaluate five model families (XGBoost, a convolutional–MLP hybrid, a bidirectional LSTM classifier, an unsupervised LSTM-Autoencoder, and a temporal convolutional network) under three protocols: stratified random, attack-held-out, and leave-one-attack-out (LOO). Under LOO on a 30-file subsample, every supervised classifier scores below random on the majority of held-out attacks; the unsupervised LSTM-Autoencoder retains the best solo mean of 0.550 with a strongly bimodal per-attack distribution spanning 0.046 to 0.894. A sign-adjusted oracle-bound ensemble flips members whose per-attack AUROC inverts achieves a mean LOO AUROC of 0.844; adding the TCN as a fourth ensemble member does not improve the result, providing evidence that what is needed is an additional detection mode rather than another supervised classifier. We additionally report recall at a 5% false-positive-rate budget, paired Wilcoxon significance tests, and bootstrap confidence intervals. The full preprocessing, evaluation, and ensemble pipeline is released, and we argue that attack-held-out and LOO should be standard protocols for network-traffic IDS benchmarks on SWaT.

Imbalance-resistant multiclass attack classification in real-time IoT water networks using SMOTE-enhanced random forests

The implementation of smart water distribution systems that rely on the Internet of Things (IoT) has substantially increased the need for intrusion detection systems capable of distinguishing among various categories of attackers. Such granularity is essential for timely and appropriate incident response. The nature of telemetry streams in operational settings is imbalanced: normal traffic is prevalent, whereas the rare but important classes of attacks are represented by a small number of attacks. In such circumstances, the traditional type of classifier can achieve high overall accuracy but fails to identify minority threats of greatest operational interest. This paper introduces a multi-class attack classification model that is robust to class imbalance and operates in real time on the IoT water network, classifying samples using the Synthetic Minority Over-sampling Technique (SMOTE) combined with a Random Forest (RF) ensemble classifier. The data used in the study is a collection of 1,048,575 telemetry records that simulate smart water infrastructure behavior by combining network indicators such as AnomalyScore, DataRate, and Protocol with physical-process indicators such as WaterFlowRate (Lpm), thereby covering cyber-physical interactions. An RF model trained on the original imbalanced dataset is compared with one trained on SMOTE-balanced data and evaluated on an unseen imbalanced test set. Even though the baseline achieves 99.3% accuracy, its recall is 0% for the rare DoS and DDoS classes. However, in comparison, the SMOTE-enhanced model obtains 99.88% accuracy and a higher recall of 92.31% for DoS and 99.66% for DDoS, and the macro- averaged F1-score rises from 0.60 to 0.93. The most discriminative features are recognized as AnomalyScore, DataRate, and WaterFlowRate (Lpm), which support interpretability and informed decision-making in sustainability-sensitive smart water infrastructure.

Machine Learning-Based Intrusion Detection for Smart City Internet of Things Networks

This study investigates the effectiveness of supervised machine learning techniques for detecting cyberattacks in IoT-based smart city networks using the TON_IoT dataset, finding that advanced ensemble learning combined with robust feature engineering provides a reliable and scalable solution for securing smart city IoT networks.

Intelligent Intrusion Detection System Using Hybrid Swin Transformer-RNN for Efficient Cyber Threat Mitigation

Due to the rising frequency as well as complexity of Cyber-attacks the real-time Intrusion Detection Systems (IDS) have a greater demand for reliable. Conventional IDS techniques frequently encounter performance limitations when dealing with high-dimensional data as well as temporal patterns. In order to efficiently detect and prevent cyber-attacks, this research offers a hybrid Swin Transformer and Recurrent Neural Network (RNN) model with Principal Component Analysis (PCA) for dimensionality reduction. To identify time-dependent patterns and spatial linkages in network traffic, spatial and temporal learning modules are used. To handle complicated data and retain high predicted accuracy, a hybrid model that combines the advantages of the Swin Transformer and RNN is used for training. Using Network Intrusion dataset (CIC-IDS-2017) from kaggle delivers accuracy, precision, F1-score, as well as AUC-ROC measures for the proposed method is of 99.9%. Method delivers an accessible as well as effective resolution for contemporary cyber security requirements by addressing the difficulties of real-time detection in high-dimensional datasets.

AI-Driven Security: Detecting Cyber Attacks in IoT Networks

LSTM had good detection for frequent attacks and slow-changing patterns, which shows its capacity in learning long-lasting dependencies, which shows its capacity in learning long-lasting dependencies.

Cyber-Resilient Directional Overcurrent Relays in Distribution Systems Under Data Scarcity