{"id":"https://openalex.org/W4411950284","doi":"https://doi.org/10.1109/usbereit65494.2025.11054098","title":"Graph-Based Anomaly Detection in Industrial Control Systems","display_name":"Graph-Based Anomaly Detection in Industrial Control Systems","publication_year":2025,"publication_date":"2025-05-12","ids":{"openalex":"https://openalex.org/W4411950284","doi":"https://doi.org/10.1109/usbereit65494.2025.11054098"},"language":"en","primary_location":{"id":"doi:10.1109/usbereit65494.2025.11054098","doi":"https://doi.org/10.1109/usbereit65494.2025.11054098","is_oa":false,"landing_page_url":"https://doi.org/10.1109/usbereit65494.2025.11054098","pdf_url":null,"source":{"id":"https://openalex.org/S4306498746","display_name":"Ural Symposium on Biomedical Engineering, Radioelectronics and Information Technology (USBEREIT)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE Ural-Siberian Conference on Biomedical Engineering, Radioelectronics and Information Technology (USBEREIT)","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5118792285","display_name":"Sofya Balaba","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I130823665","display_name":"Ural Federal University","ror":"https://ror.org/00hs7dr46","country_code":"RU","type":"education","lineage":["https://openalex.org/I130823665"]}],"countries":["RU"],"is_corresponding":false,"raw_author_name":"Sofya Balaba","raw_affiliation_strings":["Ural Federal University Named After First President of Russia B.N. Yeltsin Yekaterinburg,Russia LLC \"KIT\",Yekaterinburg,Russia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Ural Federal University Named After First President of Russia B.N. Yeltsin Yekaterinburg,Russia LLC \"KIT\",Yekaterinburg,Russia","institution_ids":["https://openalex.org/I130823665"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5091377701","display_name":"Yuri Chernyshov","orcid":"https://orcid.org/0000-0002-8973-9383","observed_orcids":["https://orcid.org/0000-0002-8973-9383"]},"institutions":[{"id":"https://openalex.org/I130823665","display_name":"Ural Federal University","ror":"https://ror.org/00hs7dr46","country_code":"RU","type":"education","lineage":["https://openalex.org/I130823665"]}],"countries":["RU"],"is_corresponding":false,"raw_author_name":"Yuri Chernyshov","raw_affiliation_strings":["Ural Federal University Named After First President of Russia B.N. Yeltsin Yekaterinburg,Russia LLC \"KIT\",Yekaterinburg,Russia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Ural Federal University Named After First President of Russia B.N. Yeltsin Yekaterinburg,Russia LLC \"KIT\",Yekaterinburg,Russia","institution_ids":["https://openalex.org/I130823665"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5092276791","display_name":"Andrey Skorohodov","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I130823665","display_name":"Ural Federal University","ror":"https://ror.org/00hs7dr46","country_code":"RU","type":"education","lineage":["https://openalex.org/I130823665"]}],"countries":["RU"],"is_corresponding":false,"raw_author_name":"Andrey Skorohodov","raw_affiliation_strings":["Ural Federal University Named After First President of Russia B.N. Yeltsin Yekaterinburg,Russia LLC \"KIT\",Yekaterinburg,Russia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Ural Federal University Named After First President of Russia B.N. Yeltsin Yekaterinburg,Russia LLC \"KIT\",Yekaterinburg,Russia","institution_ids":["https://openalex.org/I130823665"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5015420694","display_name":"Denis Komarov","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I130823665","display_name":"Ural Federal University","ror":"https://ror.org/00hs7dr46","country_code":"RU","type":"education","lineage":["https://openalex.org/I130823665"]}],"countries":["RU"],"is_corresponding":false,"raw_author_name":"Denis Komarov","raw_affiliation_strings":["Ural Federal University Named After First President of Russia B.N. Yeltsin Yekaterinburg,Russia LLC \"KIT\",Yekaterinburg,Russia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Ural Federal University Named After First President of Russia B.N. Yeltsin Yekaterinburg,Russia LLC \"KIT\",Yekaterinburg,Russia","institution_ids":["https://openalex.org/I130823665"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I130823665"],"apc_list":null,"apc_paid":null,"fwci":1.5231,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":{"value":0.78650101,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":95},"biblio":{"volume":null,"issue":null,"first_page":"233","last_page":"236"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9907000064849854,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9907000064849854,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.005100000184029341,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12391","display_name":"Artificial Immune Systems Applications","score":0.00039999998989515007,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/industrial-cybersecurity","display_name":"industrial cybersecurity","score":0.7749999761581421},{"id":"https://openalex.org/keywords/network-intrusion-detection","display_name":"network intrusion detection","score":0.8700000047683716},{"id":"https://openalex.org/keywords/graph-anomaly-detection","display_name":"graph anomaly detection","score":0.8870000243186951},{"id":"https://openalex.org/keywords/saliency-maps","display_name":"saliency maps","score":0.7170000076293945},{"id":"https://openalex.org/keywords/reconstruction-error","display_name":"reconstruction error","score":0.9039999842643738},{"id":"https://openalex.org/keywords/digital-forensics","display_name":"digital forensics","score":0.7749999761581421},{"id":"https://openalex.org/keywords/attack-investigation","display_name":"attack investigation","score":0.38600000739097595},{"id":"https://openalex.org/keywords/network-protocol-vulnerabilities","display_name":"network protocol vulnerabilities","score":0.5230000019073486}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6749827861785889},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6272723078727722},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.46036139130592346},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.4572266638278961},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3496951460838318},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.2624054551124573},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/usbereit65494.2025.11054098","doi":"https://doi.org/10.1109/usbereit65494.2025.11054098","is_oa":false,"landing_page_url":"https://doi.org/10.1109/usbereit65494.2025.11054098","pdf_url":null,"source":{"id":"https://openalex.org/S4306498746","display_name":"Ural Symposium on Biomedical Engineering, Radioelectronics and Information Technology (USBEREIT)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE Ural-Siberian Conference on Biomedical Engineering, Radioelectronics and Information Technology (USBEREIT)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/9","score":0.5378999710083008,"display_name":"Industry, innovation and infrastructure"}],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":5,"referenced_works":["https://openalex.org/W3009253820","https://openalex.org/W3191490876","https://openalex.org/W3208773001","https://openalex.org/W4381687292","https://openalex.org/W4388894093"],"related_works":["https://openalex.org/W4416183163","https://openalex.org/W4394939075","https://openalex.org/W4406457647","https://openalex.org/W4405862560","https://openalex.org/W6912236302","https://openalex.org/W4409819098","https://openalex.org/W4400414908","https://openalex.org/W4283792867","https://openalex.org/W4403331590","https://openalex.org/W4415002932"],"abstract_inverted_index":{"In":[0],"Industrial":[1],"Control":[2],"Systems":[3],"(ICS),":[4],"the":[5,40,72,140,148,171],"number":[6],"of":[7,96,102,147,154,173],"targeted":[8],"cyberattacks":[9],"(APT)":[10],"on":[11,71,133],"critical":[12,142],"infrastructure,":[13,38],"such":[14],"as":[15],"Stuxnet":[16],"and":[17,35,46,78,145,167,182],"Industroyer,":[18],"is":[19],"increasing.":[20],"Particularly":[21],"concerning":[22],"are":[23],"complex":[24],"attacks":[25],"exploiting":[26],"vulnerabilities":[27],"in":[28,113],"network":[29,47],"protocols":[30],"(e.g.,":[31],"Modbus,":[32],"OPC":[33],"UA)":[34],"affecting":[36],"physical":[37],"highlighting":[39],"need":[41],"for":[42,61,150,164,178,186],"enhanced":[43],"protection":[44],"methods":[45,118,177],"intrusion":[48],"detection":[49],"systems":[50],"(NIDS).":[51],"Current":[52],"research":[53],"actively":[54],"employs":[55],"classical":[56],"machine":[57,175],"learning":[58,176],"(ML)":[59],"techniques":[60],"developing":[62],"NIDS.In":[63],"our":[64,89,107],"research,":[65],"we":[66],"developed":[67,122],"a":[68,93,129],"model":[69,90],"evaluated":[70],"open":[73,183],"CIC":[74],"Modbus":[75],"2023":[76],"dataset":[77],"compared":[79],"it":[80],"to":[81],"traditional":[82,117],"ML":[83],"models.":[84],"The":[85,152],"results":[86,169],"demonstrated":[87],"that":[88,116],"effectively":[91],"detects":[92],"wide":[94],"range":[95],"modern":[97],"attacks,":[98],"achieving":[99],"an":[100,123],"F1-score":[101],"0.98.":[103],"Unlike":[104],"sequence-based":[105],"methods,":[106],"graph-based":[108,174],"approach":[109],"identifies":[110],"meaningful":[111],"patterns":[112],"flow":[114],"relationships":[115],"often":[119],"miss.We":[120],"also":[121],"automated":[124],"digital":[125],"forensics":[126,155],"module":[127],"using":[128],"Saliency":[130],"map":[131,137],"based":[132],"reconstruction":[134],"error.":[135],"This":[136],"helps":[138],"identify":[139],"most":[141],"elements":[143],"(edges":[144],"nodes)":[146],"graph":[149],"decision-making.":[151],"automation":[153],"accelerates":[156],"attack":[157],"investigations,":[158],"providing":[159],"operators":[160],"with":[161],"efficient":[162],"tools":[163],"incident":[165],"analysis":[166],"interpretation.These":[168],"highlight":[170],"effectiveness":[172],"enhancing":[179],"ICS":[180],"security":[181],"new":[184],"avenues":[185],"future":[187],"research.":[188]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1}],"updated_date":"2026-10-29T09:56:32.521200","created_date":"2025-10-10T00:00:00"}