# Anomaly Detection for Industrial Control Systems Using Sequence-to-Sequence Neural Networks

arXiv: https://arxiv.org/abs/1911.04831 · HTML: https://mlsanity.com/paper/1911.04831/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 12 Nov 2019.

## Built on by (most cited first, 5 of 5)

- [Local Evaluation of Time Series Anomaly Detection Algorithms](https://mlsanity.com/paper/2206.13167/) (2022)
- [Spatio-Temporal Anomaly Detection with Graph Networks for Data Quality Monitoring of the Hadron Calorimeter](https://mlsanity.com/paper/2311.04190/) (2023)
- [Code Integrity Attestation for PLCs using Black Box Neural Network Predictions](https://mlsanity.com/paper/2106.07851/) (2021)
- [ICSML: Industrial Control Systems ML Framework for native inference using IEC 61131-3 code](https://mlsanity.com/paper/2202.10075/) (2022)
- [Robustness of Anomaly Detection Models for Industrial Control Systems under Training-Time Data Contamination](https://mlsanity.com/paper/2608.23547/) (2026)

## Abstract (arXiv)

This study proposes an anomaly detection method for operational data of industrial control systems (ICSs). Sequence-to-sequence neural networks were applied to train and predict ICS operational data and interpret their time-series characteristic. The proposed method requires only a normal dataset to understand ICS's normal state and detect outliers. This method was evaluated with SWaT (secure water treatment) dataset, and 29 out of 36 attacks were detected. The reported method also detects the attack points, and 25 out of 53 points were detected. This study provides a detailed analysis of false positives and false negatives of the experimental results.