TL;DR
A Digital Twin (DT)-enabled IDS framework that combines deep learning with real-time process simulation is proposed that consistently outperforms the evaluated representative baseline IDS methods under identical experimental conditions.
A DT-based IDS that jointly models physical relationships among decoded powertrain signals and identifies attacks through residuals between predicted and observed behavior shows promise for detecting stealthy payload-level CAN attacks that preserve normal communication patterns, supporting behavior-based cybersecurity for connected and automated vehicles.
Cyber-physical systems (CPSs) could cause actuation and safety risks. Intrusion detection is essential for preserving the system's integrity due to growing security issues. Nowadays, deep learning (DL) schemes have been deployed to enhance the detection of cyber-attacks, yet these models are prone to overfitting, which reduces detection performance. Hence, this research proposes a novel deep learning-based Intrusion Detection System (IDS) for CPS to address these limitations. The proposed methodology consists of four key stages, including preprocessing, feature extraction, feature selection, and intrusion detection. Data preprocessing is performed via cleansing, followed by the extraction of statistical [mean, median, and standard deviation (SD)], entropy-based, improved correlation, improved mutual information (MI), flow-based, and Improved Information Gain (IIG) features, which are derived to obtain the important features. The Archimedes Algorithm with Team Work Principle (AA_TWP), integrating the Archimedes Optimization Algorithm (AOA) and the Teamwork Optimization Algorithm (TOA), with modifications to the exploration phase, is employed to efficiently select the most relevant features. The selected features, along with preprocessed data, are fed into an ensemble of Deep Belief Networks (DBNs), Quantum Deep Neural Networks (QDNNs), and optimized Bidirectional Long Short-Term Memory (Bi-LSTM), with Bi-LSTM weights further tuned by AA_TWP. The ensemble outputs are averaged to produce the final intrusion decision. Experimental results demonstrate 91.52% accuracy and 91.76% Matthews Correlation coefficient (MCC), highlighting the effectiveness of the proposed approach, which outperforms existing techniques.
: The rapid growth of the Industrial Internet of Things (IIoT) has become a cornerstone of high-quality global economic development. By integrating sensor networks, edge computing, and cloud intelligence, IIoT has emerged as a key enabler for smart manufacturing and digital transformation across industries. However, this technological advancement introduces significant cybersecurity challenges that render traditional intrusion detection systems inadequate for IIoT environments. To address this critical gap, we propose a deep spiking Q-network (DSQN)-based intrusion detection system (DSQN-IDS) for the IIoT, formulating unknown intrusion detection as a Markov decision process (MDP). The system employs a hierarchical multi-stage decision-making framework integrating conditional variational autoencoders (CVAE) for feature extraction, deep Q-networks (DQN) for reinforcement learning-based decision-making, and spiking neural networks (SNNs) for energy-efficient classification. We train the DSQN using a multi-layer perceptron (MLP) to approximate the state-action value function, and leverage the event-driven nature of SNNs—where neurons only spike when their membrane potential exceeds a threshold—to minimize energy consumption. Extensive experiments on IIoT datasets demonstrate that our approach achieves superior performance in balancing detection accuracy, energy efficiency, and model stability when identifying unknown attacks compared to state-of-the-art methods.
As MNI becomes increasingly vulnerable to new kinds of attacks from the cyber world, accurate and timely detection of intrusions becomes a primary key to the power of cybersecurity. More complex attack patterns, complex traffic interactions within large scales are not very collaborable with the typical signature-based detection methods. A Transformer Based Network Anomaly Detection System for intelligent cyber security monitoring based on network flow analysis (NFAs) is proposed in the paper. This framework is derived from the CICIDS2017 data-set and proposes 78 of the statistical flow characteristics, where each flow characteristic impacts the behaviour of a packet, protocol, volume of traffic and temporal communication pattern. The model uses a Transformer Encoder network architecture along with multiple heads of self-attention, which provides greater understanding to deal with complex relationships between features from network traffic. LabelEncoder and StandardScaler have been applied to the columns with values that need to be encoded for categorical variables and scaled to fit the values for models training. A trained model is then applied to progress multiple different categories of cyberattacks including DDoS attacks, PortScan, Brute Force, Botnet, Web Based, etc. and different kinds of traffic, all traffic is considered benign traffic. For providing real-time predictions, confidence interval, prediction of class severity and alerts using trained model an API developed on flask to connect the trained model to a dashboard was built. The experimental results show that the Transformer-based learning could be very effective in achieving successful capturing of the network behavior and conducting realistic detection. The overall proposed system offers an intelligent, scalable and deployment-centric approach to improve the monitoring and proactive detection of threats in contemporary networks in the field of cybersecurity.
The convergence of Information Technology and Operational Technology has exposed Industrial Control Systems (ICS) to multi-stage cyberattacks that traverse software, network, and physical process layers simultaneously. Although Provenance-based Intrusion Detection Systems (PIDS) are effective in Information Technology (IT) environments, their applicability to Industrial Cyber-Physical Systems (CPS) remains largely unexplored because of the absence of datasets that jointly capture host-level causal behavior, industrial network semantics, and physical process state. To address this gap, we design an open-source, Hardware-in-the-Loop (HIL) CPS testbed that replicates an industrial chemical reactor control architecture across the Purdue model layers. Using this testbed, we propose ProvICS, a multimodal provenance dataset purpose-built for CPS intrusion detection, which synchronously captures four streams: whole-system provenance graphs from the supervisory host and the resource-constrained PLC, decoded Modbus deep-packet inspection records, and physical process telemetry. The collection comprises a 48-hour benign phase and a 22-hour attack phase across four campaigns covering 20 ICS ATT&CK techniques over 32 attack events, ranging from reconnaissance to physical process manipulation. Comparative analysis shows that ProvICS is among the few existing ICS/CPS benchmarks with multi-host kernel-level provenance, real PLC hardware-in-the-loop execution, decoded Modbus traffic, physical process-state measurements, and auxiliary raw PCAP traces in a time-synchronized collection. Baseline detection further confirms that cross-modal fusion can detect all 32 labeled attack events (F1 = 0.913, false-positive rate (FPR) = 1.40%), demonstrating the dataset's ability to expose complementary attack signals across modalities and addressing a gap not covered by prior benchmarks.