{"id":"https://openalex.org/W2959428502","doi":"https://doi.org/10.1109/access.2019.2925838","title":"HML-IDS: A Hybrid-Multilevel Anomaly Prediction Approach for Intrusion Detection in SCADA Systems","display_name":"HML-IDS: A Hybrid-Multilevel Anomaly Prediction Approach for Intrusion Detection in SCADA Systems","publication_year":2019,"publication_date":"2019-01-01","ids":{"openalex":"https://openalex.org/W2959428502","doi":"https://doi.org/10.1109/access.2019.2925838","mag":"2959428502"},"language":"en","primary_location":{"id":"doi:10.1109/access.2019.2925838","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2019.2925838","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/access.2019.2925838","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5037432123","display_name":"Izhar Ahmed Khan","orcid":"https://orcid.org/0000-0001-7180-8179"},"institutions":[{"id":"https://openalex.org/I9842412","display_name":"Nanjing University of Aeronautics and Astronautics","ror":"https://ror.org/01scyh794","country_code":"CN","type":"education","lineage":["https://openalex.org/I9842412"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Izhar Ahmed Khan","raw_affiliation_strings":["College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing, China"],"raw_orcid":"https://orcid.org/0000-0001-7180-8179","affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing, China","institution_ids":["https://openalex.org/I9842412"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5088602677","display_name":"Dechang Pi","orcid":"https://orcid.org/0000-0002-6593-4563"},"institutions":[{"id":"https://openalex.org/I9842412","display_name":"Nanjing University of Aeronautics and Astronautics","ror":"https://ror.org/01scyh794","country_code":"CN","type":"education","lineage":["https://openalex.org/I9842412"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Dechang Pi","raw_affiliation_strings":["College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing, China","institution_ids":["https://openalex.org/I9842412"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102924003","display_name":"Zaheer Ullah Khan","orcid":"https://orcid.org/0000-0003-2263-6109"},"institutions":[{"id":"https://openalex.org/I9842412","display_name":"Nanjing University of Aeronautics and Astronautics","ror":"https://ror.org/01scyh794","country_code":"CN","type":"education","lineage":["https://openalex.org/I9842412"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zaheer Ullah Khan","raw_affiliation_strings":["College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing, China","institution_ids":["https://openalex.org/I9842412"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5079604389","display_name":"Yasir Hussain","orcid":"https://orcid.org/0000-0001-7318-8137"},"institutions":[{"id":"https://openalex.org/I9842412","display_name":"Nanjing University of Aeronautics and Astronautics","ror":"https://ror.org/01scyh794","country_code":"CN","type":"education","lineage":["https://openalex.org/I9842412"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yasir Hussain","raw_affiliation_strings":["College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing, China","institution_ids":["https://openalex.org/I9842412"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5102833276","display_name":"Asif Nawaz","orcid":"https://orcid.org/0000-0003-0877-2219"},"institutions":[{"id":"https://openalex.org/I9842412","display_name":"Nanjing University of Aeronautics and Astronautics","ror":"https://ror.org/01scyh794","country_code":"CN","type":"education","lineage":["https://openalex.org/I9842412"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Asif Nawaz","raw_affiliation_strings":["College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing, China","institution_ids":["https://openalex.org/I9842412"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":5,"corresponding_author_ids":["https://openalex.org/A5037432123"],"corresponding_institution_ids":["https://openalex.org/I9842412"],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":15.0524,"has_fulltext":false,"cited_by_count":152,"citation_normalized_percentile":{"value":0.99219061,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":90,"max":100},"biblio":{"volume":"7","issue":null,"first_page":"89507","last_page":"89521"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/scada","display_name":"SCADA","score":0.876812219619751},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.8076051473617554},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7932114601135254},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7586114406585693},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5757354497909546},{"id":"https://openalex.org/keywords/anomaly-based-intrusion-detection-system","display_name":"Anomaly-based intrusion detection system","score":0.5007314682006836},{"id":"https://openalex.org/keywords/filter","display_name":"Filter (signal processing)","score":0.4666118025779724},{"id":"https://openalex.org/keywords/industrial-control-system","display_name":"Industrial control system","score":0.4365572929382324},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.28417253494262695},{"id":"https://openalex.org/keywords/control","display_name":"Control (management)","score":0.17137378454208374},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.11372935771942139}],"concepts":[{"id":"https://openalex.org/C113863187","wikidata":"https://www.wikidata.org/wiki/Q17498","display_name":"SCADA","level":2,"score":0.876812219619751},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.8076051473617554},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7932114601135254},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7586114406585693},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5757354497909546},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.5007314682006836},{"id":"https://openalex.org/C106131492","wikidata":"https://www.wikidata.org/wiki/Q3072260","display_name":"Filter (signal processing)","level":2,"score":0.4666118025779724},{"id":"https://openalex.org/C40071531","wikidata":"https://www.wikidata.org/wiki/Q2513962","display_name":"Industrial control system","level":3,"score":0.4365572929382324},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.28417253494262695},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.17137378454208374},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.11372935771942139},{"id":"https://openalex.org/C119599485","wikidata":"https://www.wikidata.org/wiki/Q43035","display_name":"Electrical engineering","level":1,"score":0.0},{"id":"https://openalex.org/C31972630","wikidata":"https://www.wikidata.org/wiki/Q844240","display_name":"Computer vision","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/access.2019.2925838","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2019.2925838","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:1b90f5af0a2e493aa1f3f2d01814767b","is_oa":true,"landing_page_url":"https://doaj.org/article/1b90f5af0a2e493aa1f3f2d01814767b","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 7, Pp 89507-89521 (2019)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2019.2925838","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2019.2925838","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Industry, innovation and infrastructure","score":0.6299999952316284,"id":"https://metadata.un.org/sdg/9"}],"awards":[{"id":"https://openalex.org/G3210365191","display_name":null,"funder_award_id":"U1433116","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G4890131602","display_name":null,"funder_award_id":"NP2017208","funder_id":"https://openalex.org/F4320335787","funder_display_name":"Fundamental Research Funds for the Central Universities"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320335787","display_name":"Fundamental Research Funds for the Central Universities","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":71,"referenced_works":["https://openalex.org/W38537450","https://openalex.org/W98432259","https://openalex.org/W172260869","https://openalex.org/W1551909886","https://openalex.org/W1554944419","https://openalex.org/W1557652964","https://openalex.org/W1571403844","https://openalex.org/W1591261915","https://openalex.org/W1640811473","https://openalex.org/W1745557255","https://openalex.org/W1775772884","https://openalex.org/W1930624869","https://openalex.org/W1970856950","https://openalex.org/W1974853427","https://openalex.org/W1976262362","https://openalex.org/W1988790447","https://openalex.org/W1992705187","https://openalex.org/W2008704879","https://openalex.org/W2012477354","https://openalex.org/W2021702566","https://openalex.org/W2023585250","https://openalex.org/W2069285803","https://openalex.org/W2087432251","https://openalex.org/W2122111042","https://openalex.org/W2122217421","https://openalex.org/W2127918528","https://openalex.org/W2132051774","https://openalex.org/W2141050228","https://openalex.org/W2148143831","https://openalex.org/W2158698691","https://openalex.org/W2161630727","https://openalex.org/W2164117960","https://openalex.org/W2171033594","https://openalex.org/W2293378006","https://openalex.org/W2473769720","https://openalex.org/W2514905426","https://openalex.org/W2515440025","https://openalex.org/W2515572503","https://openalex.org/W2520381575","https://openalex.org/W2527840540","https://openalex.org/W2541841318","https://openalex.org/W2584408238","https://openalex.org/W2587789887","https://openalex.org/W2599354622","https://openalex.org/W2611645847","https://openalex.org/W2615699342","https://openalex.org/W2753352458","https://openalex.org/W2762776925","https://openalex.org/W2766736793","https://openalex.org/W2783741806","https://openalex.org/W2892141954","https://openalex.org/W2895822464","https://openalex.org/W2908941882","https://openalex.org/W2963061824","https://openalex.org/W2963215781","https://openalex.org/W2963541464","https://openalex.org/W3005645996","https://openalex.org/W6601553728","https://openalex.org/W6606982846","https://openalex.org/W6636776254","https://openalex.org/W6638021444","https://openalex.org/W6667864987","https://openalex.org/W6679046919","https://openalex.org/W6682610290","https://openalex.org/W6720862309","https://openalex.org/W6725797840","https://openalex.org/W6735108248","https://openalex.org/W6737780747","https://openalex.org/W6751751914","https://openalex.org/W6755477246","https://openalex.org/W6761412877"],"related_works":["https://openalex.org/W2337148208","https://openalex.org/W2516092834","https://openalex.org/W3004832009","https://openalex.org/W2309980522","https://openalex.org/W1971929717","https://openalex.org/W3036013726","https://openalex.org/W1724519426","https://openalex.org/W2351051591","https://openalex.org/W2369534771","https://openalex.org/W2187618570"],"abstract_inverted_index":{"Critical":[0],"infrastructures,":[1],"e.g.,":[2],"electricity":[3],"generation":[4],"and":[5,11,16,21,37,51,64,76,139,161,183],"dispersal":[6],"networks,":[7],"chemical":[8],"processing":[9],"plants,":[10],"gas":[12,271],"distribution,":[13],"are":[14,192],"governed":[15],"monitored":[17],"by":[18,119,214,224],"supervisory":[19],"control":[20,53],"data":[22],"acquisition":[23],"systems":[24,41,50],"(SCADA).":[25],"Detecting":[26],"intrusion":[27,39,103,111],"is":[28,106,117,222],"a":[29,120,152,219,229,254,264,270],"prevalent":[30],"area":[31],"of":[32,92,123,158,164,198,235,289],"study":[33],"for":[34,48,89,145,228,257],"numerous":[35],"years,":[36,58],"several":[38],"detection":[40,104,143,247],"have":[42,69,85],"been":[43],"suggested":[44],"in":[45,79,95,100,172],"the":[46,59,87,90,93,146,159,185,188,196,211,216,226,233,277,282],"literature":[47],"cyber-physical":[49],"industrial":[52],"system":[54,227,274],"(ICS).":[55],"In":[56],"recent":[57],"viruses":[60],"seismic":[61],"net,":[62],"duqu,":[63],"flame":[65],"against":[66],"ICS":[67,94,173],"attacks":[68,84],"caused":[70],"tremendous":[71],"damage":[72],"to":[73,107,134,181,194,209,238,252],"nuclear":[74],"facilities":[75],"critical":[77],"infrastructure":[78],"some":[80,178],"countries.":[81,97],"These":[82],"intensified":[83],"sounded":[86],"alarm":[88],"security":[91],"many":[96],"The":[98,260],"challenge":[99],"constructing":[101],"an":[102,132,141,204,286],"framework":[105],"deal":[108,135],"with":[109,136,248,263,285],"unbalanced":[110],"datasets,":[112],"i.e.":[113],"when":[114],"one":[115],"class":[116],"signified":[118],"lesser":[121],"amount":[122],"instances":[124],"(minority":[125],"class).":[126],"To":[127],"this":[128,137],"end,":[129],"we":[130,176,202,242],"outline":[131],"approach":[133,150,279],"issue":[138],"propose":[140],"anomaly":[142,199,258],"method":[144,256],"ICS.":[147],"Our":[148],"proposed":[149,278],"uses":[151],"hybrid":[153,255],"model":[154],"that":[155,167,276],"takes":[156],"advantage":[157],"anticipated":[160],"consistent":[162],"nature":[163],"communication":[165],"patterns":[166],"occur":[168],"among":[169],"ground":[170],"devices":[171],"setups.":[174],"First,":[175],"applied":[177,193],"preprocessing":[179],"techniques":[180],"standardize":[182],"scale":[184],"data.":[186],"Second,":[187],"dimensionality":[189],"reduction":[190],"algorithms":[191],"improve":[195],"process":[197],"detection.":[200,259],"Third,":[201],"employed":[203],"edited":[205],"nearest-neighbor":[206],"rule":[207],"algorithm":[208],"balance":[210],"dataset.":[212],"Fourth,":[213],"using":[215],"Bloom":[217],"filter,":[218],"signature":[220],"database":[221],"created":[223],"noting":[225],"specific":[230],"period":[231],"lacking":[232],"occurrence":[234],"abnormalities.":[236],"Finally,":[237],"detect":[239],"new":[240],"attacks,":[241],"combined":[243],"our":[244],"package":[245],"contents-level":[246],"another":[249],"instance-based":[250],"learner":[251],"make":[253],"experimental":[261],"results":[262],"real":[265],"large-scale":[266],"dataset":[267],"generated":[268],"from":[269],"pipeline":[272],"SCADA":[273],"show":[275],"HML-IDS":[280],"outperforms":[281],"benchmark":[283],"models":[284],"accuracy":[287],"rate":[288],"97%.":[290]},"counts_by_year":[{"year":2026,"cited_by_count":5},{"year":2025,"cited_by_count":23},{"year":2024,"cited_by_count":20},{"year":2023,"cited_by_count":23},{"year":2022,"cited_by_count":25},{"year":2021,"cited_by_count":36},{"year":2020,"cited_by_count":19},{"year":2019,"cited_by_count":1}],"updated_date":"2026-05-06T08:25:59.206177","created_date":"2025-10-10T00:00:00"}