# Time is of the Essence: Machine Learning-based Intrusion Detection in Industrial Time Series Data

arXiv: https://arxiv.org/abs/1809.07500 · HTML: https://mlsanity.com/paper/1809.07500/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 20 Sep 2018.

## Built on by (most cited first, 6 of 6)

- [Error-bounded Approximate Time Series Joins Using Compact Dictionary Representations of Time Series](https://mlsanity.com/paper/2112.12965/) (2021)
- [Sketching Multidimensional Time Series for Fast Discord Mining](https://mlsanity.com/paper/2311.03393/) (2023)
- [Temporal Analysis of NetFlow Datasets for Network Intrusion Detection Systems](https://mlsanity.com/paper/2503.04404/) (2025)
- [Robust Time Series Chain Discovery with Incremental Nearest Neighbors](https://mlsanity.com/paper/2211.02146/) (2022)
- [Impact of Recurrent Neural Networks and Deep Learning Frameworks on Real-time Lightweight Time Series Anomaly Detection](https://mlsanity.com/paper/2407.18439/) (2024)
- [Ego-Network Transformer for Subsequence Classification in Time Series Data](https://mlsanity.com/paper/2311.02561/) (2023)

## Abstract (arXiv)

The Industrial Internet of Things drastically increases connectivity of devices in industrial applications. In addition to the benefits in efficiency, scalability and ease of use, this creates novel attack surfaces. Historically, industrial networks and protocols do not contain means of security, such as authentication and encryption, that are made necessary by this development. Thus, industrial IT-security is needed. In this work, emulated industrial network data is transformed into a time series and analysed with three different algorithms. The data contains labeled attacks, so the performance can be evaluated. Matrix Profiles perform well with almost no parameterisation needed. Seasonal Autoregressive Integrated Moving Average performs well in the presence of noise, requiring parameterisation effort. Long Short Term Memory-based neural networks perform mediocre while requiring a high training- and parameterisation effort.