{"id":"https://openalex.org/W4416233775","doi":"https://doi.org/10.1109/camad67323.2025.11229892","title":"GraphLLM-CPS: LLM Node Embeddings for Anomaly Detection in Cyber-Physical Systems","display_name":"GraphLLM-CPS: LLM Node Embeddings for Anomaly Detection in Cyber-Physical Systems","publication_year":2025,"publication_date":"2025-10-14","ids":{"openalex":"https://openalex.org/W4416233775","doi":"https://doi.org/10.1109/camad67323.2025.11229892"},"language":null,"primary_location":{"id":"doi:10.1109/camad67323.2025.11229892","is_oa":false,"landing_page_url":"https://doi.org/10.1109/camad67323.2025.11229892","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE 30th International Workshop on Computer Aided Modeling and Design of Communication Links and Networks (CAMAD)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5010570937","display_name":"Georgios Fragkos","orcid":"https://orcid.org/0000-0003-0724-3366"},"institutions":[{"id":"https://openalex.org/I4210104735","display_name":"Sandia National Laboratories","ror":"https://ror.org/01apwpt12","country_code":"US","type":"facility","lineage":["https://openalex.org/I1330989302","https://openalex.org/I198811213","https://openalex.org/I4210104735"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Georgios Fragkos","raw_affiliation_strings":["Sandia National Laboratories,Albuquerque,NM,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Sandia National Laboratories,Albuquerque,NM,USA","institution_ids":["https://openalex.org/I4210104735"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Sidney Wright","orcid":null},"institutions":[{"id":"https://openalex.org/I4210104735","display_name":"Sandia National Laboratories","ror":"https://ror.org/01apwpt12","country_code":"US","type":"facility","lineage":["https://openalex.org/I1330989302","https://openalex.org/I198811213","https://openalex.org/I4210104735"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sidney Wright","raw_affiliation_strings":["Sandia National Laboratories,Albuquerque,NM,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Sandia National Laboratories,Albuquerque,NM,USA","institution_ids":["https://openalex.org/I4210104735"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5053496166","display_name":"C. Birk Jones","orcid":"https://orcid.org/0000-0003-4395-7964"},"institutions":[{"id":"https://openalex.org/I4210104735","display_name":"Sandia National Laboratories","ror":"https://ror.org/01apwpt12","country_code":"US","type":"facility","lineage":["https://openalex.org/I1330989302","https://openalex.org/I198811213","https://openalex.org/I4210104735"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"C. Birk Jones","raw_affiliation_strings":["Sandia National Laboratories,Albuquerque,NM,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Sandia National Laboratories,Albuquerque,NM,USA","institution_ids":["https://openalex.org/I4210104735"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I4210104735"],"apc_list":null,"apc_paid":null,"fwci":2.3336,"has_fulltext":false,"cited_by_count":3,"citation_normalized_percentile":{"value":0.89745757,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":98,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"7"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.6025000214576721,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.6025000214576721,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.08799999952316284,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.08100000023841858,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.8039000034332275},{"id":"https://openalex.org/keywords/node","display_name":"Node (physics)","score":0.6395000219345093},{"id":"https://openalex.org/keywords/resilience","display_name":"Resilience (materials science)","score":0.46869999170303345},{"id":"https://openalex.org/keywords/cyber-physical-system","display_name":"Cyber-physical system","score":0.4512999951839447},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.44130000472068787},{"id":"https://openalex.org/keywords/grid","display_name":"Grid","score":0.4023999869823456},{"id":"https://openalex.org/keywords/insider","display_name":"Insider","score":0.3970000147819519},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.38029998540878296}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.8039000034332275},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7192999720573425},{"id":"https://openalex.org/C62611344","wikidata":"https://www.wikidata.org/wiki/Q1062658","display_name":"Node (physics)","level":2,"score":0.6395000219345093},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.46869999170303345},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4537999927997589},{"id":"https://openalex.org/C179768478","wikidata":"https://www.wikidata.org/wiki/Q1120057","display_name":"Cyber-physical system","level":2,"score":0.4512999951839447},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.44130000472068787},{"id":"https://openalex.org/C187691185","wikidata":"https://www.wikidata.org/wiki/Q2020720","display_name":"Grid","level":2,"score":0.4023999869823456},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.3970000147819519},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.38029998540878296},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3743000030517578},{"id":"https://openalex.org/C146849305","wikidata":"https://www.wikidata.org/wiki/Q370766","display_name":"Ground truth","level":2,"score":0.31690001487731934},{"id":"https://openalex.org/C108801101","wikidata":"https://www.wikidata.org/wiki/Q15032","display_name":"Steganography","level":3,"score":0.31679999828338623},{"id":"https://openalex.org/C2779714256","wikidata":"https://www.wikidata.org/wiki/Q25305062","display_name":"Multiple Models","level":2,"score":0.30219998955726624},{"id":"https://openalex.org/C39399123","wikidata":"https://www.wikidata.org/wiki/Q1348989","display_name":"Earth observation","level":3,"score":0.2957000136375427},{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.2953999936580658},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.28060001134872437},{"id":"https://openalex.org/C29852176","wikidata":"https://www.wikidata.org/wiki/Q373338","display_name":"Critical infrastructure","level":2,"score":0.26759999990463257},{"id":"https://openalex.org/C172195944","wikidata":"https://www.wikidata.org/wiki/Q541265","display_name":"Ubiquitous computing","level":2,"score":0.26600000262260437},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2599000036716461},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.2578999996185303}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/camad67323.2025.11229892","is_oa":false,"landing_page_url":"https://doi.org/10.1109/camad67323.2025.11229892","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE 30th International Workshop on Computer Aided Modeling and Design of Communication Links and Networks (CAMAD)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":18,"referenced_works":["https://openalex.org/W2046206723","https://openalex.org/W4324142623","https://openalex.org/W4386648688","https://openalex.org/W4391514872","https://openalex.org/W4392902508","https://openalex.org/W4398202503","https://openalex.org/W4399801251","https://openalex.org/W4400721089","https://openalex.org/W4402594800","https://openalex.org/W4402835780","https://openalex.org/W4403343675","https://openalex.org/W4404135915","https://openalex.org/W4407163436","https://openalex.org/W4410235697","https://openalex.org/W4411010737","https://openalex.org/W4411232518","https://openalex.org/W4412763744","https://openalex.org/W4412904032"],"related_works":[],"abstract_inverted_index":{"Cyber-physical":[0],"systems":[1,211],"(CPS)":[2],"are":[3,110,129],"increasingly":[4],"integral":[5],"to":[6,18,31,53,60,74,90,112,132,203],"the":[7,23,48,69,119,125,156,173,187,191,198,205],"operation":[8],"of":[9,26,103,200,209],"critical":[10],"infrastructure,":[11],"blending":[12],"physical":[13,36],"processes":[14],"with":[15,167,179],"computational":[16],"intelligence":[17],"enable":[19],"advanced":[20],"functionality.":[21],"However,":[22],"interconnected":[24],"nature":[25],"CPS":[27,104,152],"makes":[28],"them":[29,178],"vulnerable":[30],"sophisticated":[32],"cyber":[33],"threats":[34],"and":[35,121,135,140,144,176,207],"anomalies,":[37],"necessitating":[38],"robust":[39],"anomaly":[40,95],"detection":[41,96],"mechanisms.":[42],"In":[43],"this":[44],"paper,":[45],"we":[46,171],"explore":[47],"IEEE":[49,157],"123":[50,158],"bus":[51,159],"system":[52],"detect":[54],"a":[55,61,82],"stealthy":[56,192],"insider":[57],"threat":[58],"resulting":[59],"volt-var":[62,70,193],"attack":[63],"targeting":[64],"photovoltaic":[65],"(PV)":[66],"systems,":[67],"where":[68],"control":[71],"is":[72,149],"disabled":[73],"disrupt":[75],"grid":[76],"voltage":[77],"operations.":[78],"We":[79],"propose":[80],"GraphLLM-CPS,":[81],"novel":[83],"framework":[84],"leveraging":[85],"Large":[86],"Language":[87],"Models":[88],"(LLMs)":[89],"generate":[91],"node":[92,115],"embeddings":[93,116,128,202],"for":[94,138],"in":[97,164],"CPS.":[98],"By":[99],"converting":[100],"graph-based":[101],"representations":[102],"data":[105],"into":[106,186],"textual":[107],"formats,":[108],"LLMs":[109],"employed":[111],"extract":[113],"meaningful":[114],"that":[117],"capture":[118],"structural":[120],"semantic":[122],"relationships":[123],"within":[124],"system.":[126],"These":[127],"then":[130],"utilized":[131],"train":[133],"supervised":[134],"unsupervised":[136],"classifiers":[137],"detecting":[139],"locating":[141,165],"anomalous":[142],"nodes":[143],"events.":[145],"The":[146,195],"proposed":[147],"approach":[148],"evaluated":[150],"on":[151],"datasets":[153],"derived":[154],"from":[155],"system,":[160],"demonstrating":[161],"its":[162],"effectiveness":[163],"anomalies":[166,175],"high":[168],"accuracy.":[169],"Furthermore,":[170],"visualize":[172],"detected":[174],"compare":[177],"ground":[180],"truth":[181],"impacted":[182],"nodes,":[183],"providing":[184],"insights":[185],"system\u2019s":[188],"behavior":[189],"during":[190],"attack.":[194],"results":[196],"highlight":[197],"potential":[199],"LLM-driven":[201],"enhance":[204],"security":[206],"resilience":[208],"cyber-physical":[210],"against":[212],"emerging":[213],"threats.":[214]},"counts_by_year":[{"year":2026,"cited_by_count":3}],"updated_date":"2025-11-28T08:51:10.372724","created_date":"2025-11-13T00:00:00"}