# Detecting Cyberattacks in Industrial Control Systems Using Convolutional Neural Networks

arXiv: https://arxiv.org/abs/1806.08110 · HTML: https://mlsanity.com/paper/1806.08110/

## Key facts

- Cited by 23 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 21 Jun 2018.

## Built on by (most cited first, 23 of 23)

- [Unsupervised Deep Anomaly Detection for Multi-Sensor Time-Series Signals](https://mlsanity.com/paper/2107.12626/) (2021)
- [Adversarial Attacks and Mitigation for Anomaly Detectors of Cyber-Physical Systems](https://mlsanity.com/paper/2105.10707/) (2021)
- [Digital Twin-based Anomaly Detection with Curriculum Learning in Cyber-physical Systems](https://mlsanity.com/paper/2309.15995/) (2023)
- [How Deep is your Guess? A Fresh Perspective on Deep Learning for Medical Time-Series Imputation](https://mlsanity.com/paper/2407.08442/) (2024)
- [Causal Digital Twins for Cyber-Physical Security: A Framework for Robust Anomaly Detection in Industrial Control Systems](https://mlsanity.com/paper/2510.09616/) (2025)
- [Deep Graph Stream SVDD: Anomaly Detection in Cyber-Physical Systems](https://mlsanity.com/paper/2302.12918/) (2023)
- [CSAI: Conditional Self-Attention Imputation for Healthcare Time-series](https://mlsanity.com/paper/2312.16713/) (2023)
- [Runtime Anomaly Detection for Drones: An Integrated Rule-Mining and Unsupervised-Learning Approach](https://mlsanity.com/paper/2505.01947/) (2025)
- [Adversarial Sample Generation for Anomaly Detection in Industrial Control Systems](https://mlsanity.com/paper/2505.03120/) (2025)
- [Code Integrity Attestation for PLCs using Black Box Neural Network Predictions](https://mlsanity.com/paper/2106.07851/) (2021)
- [Recurrent Auto-Encoder With Multi-Resolution Ensemble and Predictive Coding for Multivariate Time-Series Anomaly Detection](https://mlsanity.com/paper/2202.10001/) (2022)
- [Few-shot Detection of Anomalies in Industrial Cyber-Physical System via Prototypical Network and Contrastive Learning](https://mlsanity.com/paper/2302.10601/) (2023)
- [Two-phase Dual COPOD Method for Anomaly Detection in Industrial Control System](https://mlsanity.com/paper/2305.00982/) (2023)
- [Evaluation Strategy of Time-series Anomaly Detection with Decay Function](https://mlsanity.com/paper/2305.09691/) (2023)
- [Electrical Grid Anomaly Detection via Tensor Decomposition](https://mlsanity.com/paper/2310.08650/) (2023)
- [An Attention-Based Deep Generative Model for Anomaly Detection in Industrial Control Systems](https://mlsanity.com/paper/2405.05277/) (2024)
- [OIPR: Evaluation for Time-series Anomaly Detection Inspired by Operator Interest](https://mlsanity.com/paper/2503.01260/) (2025)
- [Spatio-Temporal Attention Graph Neural Network: Explaining Causalities With Attention](https://mlsanity.com/paper/2603.10676/) (2026)
- [PhaseNet++: Phase-Aware Frequency-Domain Anomaly Detection for Industrial Control Systems via Phase Coherence Graphs](https://mlsanity.com/paper/2605.00929/) (2026)
- [Attack Detection using Time Series Foundation Models](https://mlsanity.com/paper/2606.06347/) (2026)
- [Digital Twin Degradation: Detecting Cyber Physical Attacks via Temporal Inconsistencies](https://mlsanity.com/paper/2608.16159/) (2026)
- [Robustness of Anomaly Detection Models for Industrial Control Systems under Training-Time Data Contamination](https://mlsanity.com/paper/2608.23547/) (2026)
- [Physics-Attested Federated Learning: Securing Collaborative Anomaly Detection in Critical Water Infrastructure](https://mlsanity.com/paper/2609.34804/) (2026)

## Abstract (arXiv)

This paper presents a study on detecting cyberattacks on industrial control systems (ICS) using unsupervised deep neural networks, specifically, convolutional neural networks. The study was performed on a SecureWater Treatment testbed (SWaT) dataset, which represents a scaled-down version of a real-world industrial water treatment plant. e suggest a method for anomaly detection based on measuring the statistical deviation of the predicted value from the observed value.We applied the proposed method by using a variety of deep neural networks architectures including different variants of convolutional and recurrent networks. The test dataset from SWaT included 36 different cyberattacks. The proposed method successfully detects the vast majority of the attacks with a low false positive rate thus improving on previous works based on this data set. The results of the study show that 1D convolutional networks can be successfully applied to anomaly detection in industrial control systems and outperform more complex recurrent networks while being much smaller and faster to train.