{"id":"https://openalex.org/W7125953790","doi":"https://doi.org/10.1109/access.2026.3659034","title":"Alarm-Budgeted Event-Level Evaluation Of Ics Anomaly Detection: Lessons From Swat And Wadi","display_name":"Alarm-Budgeted Event-Level Evaluation Of Ics Anomaly Detection: Lessons From Swat And Wadi","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7125953790","doi":"https://doi.org/10.1109/access.2026.3659034"},"language":"en","primary_location":{"id":"doi:10.1109/access.2026.3659034","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3659034","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/access.2026.3659034","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5019154470","display_name":"Vahid Heydari","orcid":"https://orcid.org/0000-0002-6181-6826"},"institutions":[{"id":"https://openalex.org/I83909951","display_name":"Morgan State University","ror":"https://ror.org/017d8gk22","country_code":"US","type":"education","lineage":["https://openalex.org/I83909951"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Vahid Heydari","raw_affiliation_strings":["Department of Computer Science, Morgan State University, Baltimore, MD, USA"],"raw_orcid":"https://orcid.org/0000-0002-6181-6826","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Morgan State University, Baltimore, MD, USA","institution_ids":["https://openalex.org/I83909951"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5027268747","display_name":"Kofi Nyarko","orcid":"https://orcid.org/0000-0002-7481-5080"},"institutions":[{"id":"https://openalex.org/I83909951","display_name":"Morgan State University","ror":"https://ror.org/017d8gk22","country_code":"US","type":"education","lineage":["https://openalex.org/I83909951"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kofi Nyarko","raw_affiliation_strings":["Department of Electrical and Computer Engineering, Morgan State University, Baltimore, MD, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Electrical and Computer Engineering, Morgan State University, Baltimore, MD, USA","institution_ids":["https://openalex.org/I83909951"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I83909951"],"apc_list":{"value":2075,"currency":"USD","value_usd":2075},"apc_paid":{"value":2075,"currency":"USD","value_usd":2075},"fwci":7.2067,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":{"value":0.95900983,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":97,"max":98},"biblio":{"volume":"14","issue":null,"first_page":"17585","last_page":"17609"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9580000042915344,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9580000042915344,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11807","display_name":"Infrastructure Resilience and Vulnerability Analysis","score":0.006800000090152025,"subfield":{"id":"https://openalex.org/subfields/2205","display_name":"Civil and Structural Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.0052999998442828655,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/testbed","display_name":"Testbed","score":0.7879999876022339},{"id":"https://openalex.org/keywords/detector","display_name":"Detector","score":0.7476000189781189},{"id":"https://openalex.org/keywords/constant-false-alarm-rate","display_name":"Constant false alarm rate","score":0.7102000117301941},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6952000260353088},{"id":"https://openalex.org/keywords/workload","display_name":"Workload","score":0.5788999795913696},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.5310999751091003},{"id":"https://openalex.org/keywords/wadi","display_name":"Wadi","score":0.5108000040054321}],"concepts":[{"id":"https://openalex.org/C31395832","wikidata":"https://www.wikidata.org/wiki/Q1318674","display_name":"Testbed","level":2,"score":0.7879999876022339},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.7476000189781189},{"id":"https://openalex.org/C77052588","wikidata":"https://www.wikidata.org/wiki/Q644307","display_name":"Constant false alarm rate","level":2,"score":0.7102000117301941},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6952000260353088},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6417999863624573},{"id":"https://openalex.org/C2778476105","wikidata":"https://www.wikidata.org/wiki/Q628539","display_name":"Workload","level":2,"score":0.5788999795913696},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.5310999751091003},{"id":"https://openalex.org/C200965112","wikidata":"https://www.wikidata.org/wiki/Q187971","display_name":"Wadi","level":2,"score":0.5108000040054321},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.506600022315979},{"id":"https://openalex.org/C21200559","wikidata":"https://www.wikidata.org/wiki/Q7451068","display_name":"Sensitivity (control systems)","level":2,"score":0.5023000240325928},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.47200000286102295},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.47200000286102295},{"id":"https://openalex.org/C2776836416","wikidata":"https://www.wikidata.org/wiki/Q1364844","display_name":"False alarm","level":2,"score":0.4666000008583069},{"id":"https://openalex.org/C2779119184","wikidata":"https://www.wikidata.org/wiki/Q294350","display_name":"ALARM","level":2,"score":0.4212000072002411},{"id":"https://openalex.org/C137635306","wikidata":"https://www.wikidata.org/wiki/Q182667","display_name":"Pareto principle","level":2,"score":0.39489999413490295},{"id":"https://openalex.org/C200601418","wikidata":"https://www.wikidata.org/wiki/Q2193887","display_name":"Reliability engineering","level":1,"score":0.3749000132083893},{"id":"https://openalex.org/C2778484313","wikidata":"https://www.wikidata.org/wiki/Q1172540","display_name":"Data stream","level":2,"score":0.2897999882698059},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.25859999656677246},{"id":"https://openalex.org/C176217482","wikidata":"https://www.wikidata.org/wiki/Q860554","display_name":"Metric (unit)","level":2,"score":0.2578999996185303},{"id":"https://openalex.org/C141353440","wikidata":"https://www.wikidata.org/wiki/Q182221","display_name":"Fuse (electrical)","level":2,"score":0.25589999556541443}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/access.2026.3659034","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3659034","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:e71142bca7a44970ace3b6495b954201","is_oa":false,"landing_page_url":"https://doaj.org/article/e71142bca7a44970ace3b6495b954201","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 14, Pp 17585-17609 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2026.3659034","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3659034","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.5607434511184692,"id":"https://metadata.un.org/sdg/9","display_name":"Industry, innovation and infrastructure"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":19,"referenced_works":["https://openalex.org/W2132870739","https://openalex.org/W2296719434","https://openalex.org/W2407991977","https://openalex.org/W2514905426","https://openalex.org/W2584499795","https://openalex.org/W2604247107","https://openalex.org/W2768947629","https://openalex.org/W2810107741","https://openalex.org/W2947820052","https://openalex.org/W3133931288","https://openalex.org/W4298082496","https://openalex.org/W4311165941","https://openalex.org/W4386881452","https://openalex.org/W4388877174","https://openalex.org/W4399192926","https://openalex.org/W4404512982","https://openalex.org/W4410596003","https://openalex.org/W4412785153","https://openalex.org/W4413426279"],"related_works":[],"abstract_inverted_index":{"Industrial":[0],"control":[1],"systems":[2],"(ICS)":[3],"operate":[4],"critical":[5],"infrastructure;":[6],"however,":[7],"anomaly":[8,52],"detectors":[9,97],"for":[10,175,183],"these":[11],"environments":[12],"are":[13,98,162],"typically":[14],"reported":[15],"using":[16,88],"unconstrained,":[17],"threshold-free":[18],"metrics.":[19],"Operators":[20],"have":[21],"a":[22,71,108,171],"limited":[23],"capacity":[24],"during":[25],"deployment.":[26],"A":[27],"detector":[28,55,116],"that":[29,150],"appears":[30],"strong":[31],"under":[32,146,153],"such":[33],"metrics":[34,155],"can":[35,156],"be":[36,157],"unusable":[37],"if":[38],"it":[39],"generates":[40],"too":[41],"many":[42],"alarm":[43,66,185],"events.":[44],"This":[45],"study":[46,165],"examinesbudgeted,":[47],"event-level":[48,82],"evaluations":[49],"of":[50],"industrial":[51],"detection.":[53],"Each":[54],"was":[56],"calibrated":[57],"on":[58,100,119,131],"the":[59,64,81,142],"nominal":[60],"stream":[61,76],"to":[62,126],"satisfy":[63],"target":[65],"event":[67],"rate":[68,84],"(events/h)":[69],"with":[70],"duty-cycle":[72],"guardrail.":[73],"An":[74],"attacked":[75],"is":[77],"then":[78],"evaluated,":[79],"reporting":[80],"missed-incident":[83],"and":[85,94,107,180],"detection":[86],"delay":[87],"attack-interval":[89],"uncertainty.":[90],"Six":[91],"representative":[92],"unsupervised":[93],"weakly":[95],"supervised":[96],"compared":[99],"two":[101],"water-sector":[102],"benchmarks":[103],"(a":[104],"water-treatment":[105],"testbed":[106],"water-distribution":[109],"testbed).":[110],"Under":[111],"matched":[112],"alert":[113,144],"budgets,":[114],"no":[115],"dominated":[117],"consistently:":[118],"SWaT,":[120],"Miss":[121,137],"rates":[122],"ranged":[123],"from":[124],"0.62":[125],"0.97":[127],"atB=":[128],"0.5,":[129],"while":[130],"WADI":[132],"some":[133],"methods":[134],"achieved":[135],"near-zero":[136],"but":[138],"incurred":[139],"over":[140],"10\u00d7":[141],"intended":[143],"workload":[145,160],"attack.":[147],"Accordingly,":[148],"rankings":[149],"appear":[151],"clear":[152],"unconstrained":[154],"reversed":[158],"once":[159],"constraints":[161],"enforced.":[163],"The":[164],"further":[166],"provides":[167],"Pareto":[168],"trade\u2013off":[169],"analysis,":[170],"stakeholder\u2013weighted":[172],"decision":[173],"layer":[174],"selecting":[176],"actionable":[177],"operating":[178],"points,":[179],"sensitivity":[181],"checks":[182],"common":[184],"post\u2013processing":[186],"choices.":[187],"These":[188],"analyses":[189],"caution":[190],"against":[191],"over\u2013interpreting":[192],"marginal":[193],"performance":[194],"differences,":[195],"particularly":[196],"in":[197],"small\u2013attack":[198],"or":[199],"intermediate\u2013budget":[200],"regimes.":[201]},"counts_by_year":[{"year":2026,"cited_by_count":2}],"updated_date":"2026-08-29T07:29:34.045763","created_date":"2026-01-29T00:00:00"}