# RNN-based Early Cyber-Attack Detection for the Tennessee Eastman Process

arXiv: https://arxiv.org/abs/1709.02232 · HTML: https://mlsanity.com/paper/1709.02232/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 7 Sep 2017.

## Built on by (most cited first, 6 of 6)

- [Unsupervised Deep Anomaly Detection for Multi-Sensor Time-Series Signals](https://mlsanity.com/paper/2107.12626/) (2021)
- [Applications of Recurrent Neural Network for Biometric Authentication & Anomaly Detection](https://mlsanity.com/paper/2109.05701/) (2021)
- [Adversarial Attacks and Mitigation for Anomaly Detectors of Cyber-Physical Systems](https://mlsanity.com/paper/2105.10707/) (2021)
- [Online Model-based Anomaly Detection in Multivariate Time Series: Taxonomy, Survey, Research Challenges and Future Directions](https://mlsanity.com/paper/2408.03747/) (2024)
- [A Novel Deep Parallel Time-series Relation Network for Fault Diagnosis](https://mlsanity.com/paper/2112.03405/) (2021)
- [Anomaly Detection for Electro-Hydrostatic Actuators using LSTM Autoencoder](https://mlsanity.com/paper/2606.05274/) (2026)

## Abstract (arXiv)

An RNN-based forecasting approach is used to early detect anomalies in industrial multivariate time series data from a simulated Tennessee Eastman Process (TEP) with many cyber-attacks. This work continues a previously proposed LSTM-based approach to the fault detection in simpler data. It is considered necessary to adapt the RNN network to deal with data containing stochastic, stationary, transitive and a rich variety of anomalous behaviours. There is particular focus on early detection with special NAB-metric. A comparison with the DPCA approach is provided. The generated data set is made publicly available.