{"id":"https://openalex.org/W4225499819","doi":"https://doi.org/10.1109/icmlc54886.2021.9737267","title":"A Comparison of Unsupervised Learning Algorithms for Intrusion Detection in IEC 104 SCADA Protocol","display_name":"A Comparison of Unsupervised Learning Algorithms for Intrusion Detection in IEC 104 SCADA Protocol","publication_year":2021,"publication_date":"2021-12-04","ids":{"openalex":"https://openalex.org/W4225499819","doi":"https://doi.org/10.1109/icmlc54886.2021.9737267"},"language":"en","primary_location":{"id":"doi:10.1109/icmlc54886.2021.9737267","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icmlc54886.2021.9737267","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2021 International Conference on Machine Learning and Cybernetics (ICMLC)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"http://urn.kb.se/resolve?urn=urn:nbn:se:bth-22856","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5060188632","display_name":"Mahwish Anwar","orcid":null},"institutions":[{"id":"https://openalex.org/I52719799","display_name":"Blekinge Institute of Technology","ror":"https://ror.org/0093a8w51","country_code":"SE","type":"education","lineage":["https://openalex.org/I52719799"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Mahwish Anwar","raw_affiliation_strings":["Blekinge Tekniska Högskola,Department of Computer Science,Karlskrona,Sweden"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Blekinge Tekniska Högskola,Department of Computer Science,Karlskrona,Sweden","institution_ids":["https://openalex.org/I52719799"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5046863989","display_name":"Anton Borg","orcid":"https://orcid.org/0000-0002-8929-7220"},"institutions":[{"id":"https://openalex.org/I52719799","display_name":"Blekinge Institute of Technology","ror":"https://ror.org/0093a8w51","country_code":"SE","type":"education","lineage":["https://openalex.org/I52719799"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Anton Borg","raw_affiliation_strings":["Blekinge Tekniska Högskola,Department of Computer Science,Karlskrona,Sweden"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Blekinge Tekniska Högskola,Department of Computer Science,Karlskrona,Sweden","institution_ids":["https://openalex.org/I52719799"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101593386","display_name":"Lars Lundberg","orcid":"https://orcid.org/0000-0002-5031-8215"},"institutions":[{"id":"https://openalex.org/I52719799","display_name":"Blekinge Institute of Technology","ror":"https://ror.org/0093a8w51","country_code":"SE","type":"education","lineage":["https://openalex.org/I52719799"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Lars Lundberg","raw_affiliation_strings":["Blekinge Tekniska Högskola,Department of Computer Science,Karlskrona,Sweden"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Blekinge Tekniska Högskola,Department of Computer Science,Karlskrona,Sweden","institution_ids":["https://openalex.org/I52719799"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I52719799"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":9,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"8"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9976999759674072,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.7942299246788025},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7516568899154663},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6535618901252747},{"id":"https://openalex.org/keywords/unsupervised-learning","display_name":"Unsupervised learning","score":0.6009202003479004},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.5874069929122925},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5283941626548767},{"id":"https://openalex.org/keywords/support-vector-machine","display_name":"Support vector machine","score":0.4943227767944336},{"id":"https://openalex.org/keywords/protocol","display_name":"Protocol (science)","score":0.45788800716400146},{"id":"https://openalex.org/keywords/scada","display_name":"SCADA","score":0.44844964146614075},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.41768524050712585},{"id":"https://openalex.org/keywords/algorithm","display_name":"Algorithm","score":0.3465346097946167},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.12762689590454102}],"concepts":[{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.7942299246788025},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7516568899154663},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6535618901252747},{"id":"https://openalex.org/C8038995","wikidata":"https://www.wikidata.org/wiki/Q1152135","display_name":"Unsupervised learning","level":2,"score":0.6009202003479004},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5874069929122925},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5283941626548767},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.4943227767944336},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.45788800716400146},{"id":"https://openalex.org/C113863187","wikidata":"https://www.wikidata.org/wiki/Q17498","display_name":"SCADA","level":2,"score":0.44844964146614075},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.41768524050712585},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.3465346097946167},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.12762689590454102},{"id":"https://openalex.org/C119599485","wikidata":"https://www.wikidata.org/wiki/Q43035","display_name":"Electrical engineering","level":1,"score":0.0},{"id":"https://openalex.org/C204787440","wikidata":"https://www.wikidata.org/wiki/Q188504","display_name":"Alternative medicine","level":2,"score":0.0},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.0},{"id":"https://openalex.org/C142724271","wikidata":"https://www.wikidata.org/wiki/Q7208","display_name":"Pathology","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/icmlc54886.2021.9737267","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icmlc54886.2021.9737267","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2021 International Conference on Machine Learning and Cybernetics (ICMLC)","raw_type":"proceedings-article"},{"id":"pmh:oai:DiVA.org:bth-22856","is_oa":true,"landing_page_url":"http://urn.kb.se/resolve?urn=urn:nbn:se:bth-22856","pdf_url":null,"source":{"id":"https://openalex.org/S4306401559","display_name":"KTH Publication Database DiVA (KTH Royal Institute of Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/conferenceObject"}],"best_oa_location":{"id":"pmh:oai:DiVA.org:bth-22856","is_oa":true,"landing_page_url":"http://urn.kb.se/resolve?urn=urn:nbn:se:bth-22856","pdf_url":null,"source":{"id":"https://openalex.org/S4306401559","display_name":"KTH Publication Database DiVA (KTH Royal Institute of Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/conferenceObject"},"sustainable_development_goals":[{"score":0.6399999856948853,"display_name":"Industry, innovation and infrastructure","id":"https://metadata.un.org/sdg/9"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":16,"referenced_works":["https://openalex.org/W1562171576","https://openalex.org/W1565746575","https://openalex.org/W1970856950","https://openalex.org/W1995443851","https://openalex.org/W2105497548","https://openalex.org/W2122646361","https://openalex.org/W2155272489","https://openalex.org/W2158698691","https://openalex.org/W2336788611","https://openalex.org/W2623293810","https://openalex.org/W2744890864","https://openalex.org/W2999309192","https://openalex.org/W3017165746","https://openalex.org/W3096249931","https://openalex.org/W6633539205","https://openalex.org/W6703470281"],"related_works":["https://openalex.org/W2615977515","https://openalex.org/W2115760278","https://openalex.org/W2146396794","https://openalex.org/W2807864071","https://openalex.org/W2387580700","https://openalex.org/W2746581472","https://openalex.org/W60934498","https://openalex.org/W2899285606","https://openalex.org/W4285233543","https://openalex.org/W4230838436"],"abstract_inverted_index":{"The":[0,23,38,134],"power":[1],"grid":[2],"is":[3],"a":[4,7],"build-up":[5],"of":[6,9,11,25,79,140],"mesh":[8],"thousands":[10],"sensors,":[12],"embedded":[13],"devices,":[14],"and":[15,27,47,94,119,125,131,153],"terminal":[16],"units":[17],"that":[18],"communicate":[19],"over":[20],"different":[21,42,83],"media.":[22],"heterogeneity":[24],"modern":[26],"legacy":[28],"equipment":[29],"calls":[30],"for":[31,85,146],"attention":[32],"towards":[33],"diverse":[34],"network":[35],"security":[36,43],"measures.":[37],"critical":[39],"infrastructure":[40],"employs":[41],"measures":[44],"to":[45,59,68],"detect":[46],"prevent":[48],"adversaries,":[49],"e.g.,":[50],"through":[51],"signature-based":[52],"tools.":[53],"These":[54],"approaches":[55,145],"lack":[56],"the":[57,66,77,107,115,122,141],"potential":[58,102],"identify":[60],"unknown":[61],"attacks.":[62],"Machine":[63],"learning":[64,80,98,144],"has":[65],"prospective":[67],"address":[69],"novel":[70],"attack":[71],"vectors.":[72],"This":[73],"paper":[74],"systematically":[75],"evaluates":[76],"efficacy":[78],"algorithms":[81],"from":[82],"families":[84],"intrusion":[86],"detection":[87,148,160],"in":[88,121,149],"IEC":[89,108,150],"60870-5-104":[90],"protocol.":[91],"One-class":[92],"SVM":[93],"k-Nearest":[95],"Neighbour":[96],"unsupervised":[97,143],"models":[99],"show":[100],"small":[101],"when":[103],"being":[104],"tested":[105],"on":[106],"104":[109,151],"unseen":[110],"dataset":[111],"with":[112,157],"Area":[113],"Under":[114],"Curve":[116],"score":[117],"0.64":[118],"0.59,":[120],"same":[123],"order;":[124],"Matthews":[126],"Correlation":[127],"Coefficient":[128],"value":[129],"0.3":[130],"0.2,":[132],"respectively.":[133],"experimental":[135],"results":[136],"suggest":[137],"little":[138],"feasibility":[139],"evaluated":[142],"anomaly":[147,159],"communication":[152],"recommend":[154],"coupling":[155],"it":[156],"other":[158],"techniques.":[161]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":4},{"year":2024,"cited_by_count":1},{"year":2023,"cited_by_count":1},{"year":2022,"cited_by_count":2}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}