{"id":"https://openalex.org/W4415353346","doi":"https://doi.org/10.1109/tdsc.2025.3623299","title":"Hierarchical GNN Message Passing for Node-Level Anomaly Detection in Industrial Control Systems","display_name":"Hierarchical GNN Message Passing for Node-Level Anomaly Detection in Industrial Control Systems","publication_year":2025,"publication_date":"2025-10-20","ids":{"openalex":"https://openalex.org/W4415353346","doi":"https://doi.org/10.1109/tdsc.2025.3623299"},"language":null,"primary_location":{"id":"doi:10.1109/tdsc.2025.3623299","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2025.3623299","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5117461804","display_name":"Shuaiyi Lyu","orcid":null},"institutions":[{"id":"https://openalex.org/I204983213","display_name":"Harbin Institute of Technology","ror":"https://ror.org/01yqg2h08","country_code":"CN","type":"education","lineage":["https://openalex.org/I204983213"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shuaiyi Lyu","raw_affiliation_strings":["Faculty of Computing, Harbin Institute of Technology, Harbin, China","Faculty of Computing, Harbin Institute of Technology, China"],"raw_orcid":"https://orcid.org/0000-0001-6003-1368","affiliations":[{"raw_affiliation_string":"Faculty of Computing, Harbin Institute of Technology, Harbin, China","institution_ids":["https://openalex.org/I204983213"]},{"raw_affiliation_string":"Faculty of Computing, Harbin Institute of Technology, China","institution_ids":["https://openalex.org/I204983213"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100437115","display_name":"Kai Wang","orcid":"https://orcid.org/0000-0003-3044-9047"},"institutions":[{"id":"https://openalex.org/I204983213","display_name":"Harbin Institute of Technology","ror":"https://ror.org/01yqg2h08","country_code":"CN","type":"education","lineage":["https://openalex.org/I204983213"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kai Wang","raw_affiliation_strings":["School of Computer Science and Technology, Harbin Institute of Technology, Weihai, China"],"raw_orcid":"https://orcid.org/0000-0003-3044-9047","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Harbin Institute of Technology, Weihai, China","institution_ids":["https://openalex.org/I204983213"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101281532","display_name":"Yang Liu","orcid":null},"institutions":[{"id":"https://openalex.org/I204983213","display_name":"Harbin Institute of Technology","ror":"https://ror.org/01yqg2h08","country_code":"CN","type":"education","lineage":["https://openalex.org/I204983213"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yang Liu","raw_affiliation_strings":["School of Computer Science and Technology, Harbin Institute of Technology, Weihai, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Harbin Institute of Technology, Weihai, China","institution_ids":["https://openalex.org/I204983213"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5017871129","display_name":"Bailing Wang","orcid":"https://orcid.org/0000-0003-2973-8036"},"institutions":[{"id":"https://openalex.org/I4210112270","display_name":"Qingdao Academy of Intelligent Industries","ror":"https://ror.org/02a0rnh86","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210112270"]},{"id":"https://openalex.org/I4210158823","display_name":"Weihai Science and Technology Bureau","ror":"https://ror.org/05mx4xx46","country_code":"CN","type":"government","lineage":["https://openalex.org/I4210158823"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Bailing Wang","raw_affiliation_strings":["Harbin Institute of Technology (Weihai) Qingdao Research Institute, Qingdao, China","Shandong Key Laboratory of Industrial Network Security, Weihai, China"],"raw_orcid":"https://orcid.org/0000-0003-2973-8036","affiliations":[{"raw_affiliation_string":"Harbin Institute of Technology (Weihai) Qingdao Research Institute, Qingdao, China","institution_ids":["https://openalex.org/I4210112270"]},{"raw_affiliation_string":"Shandong Key Laboratory of Industrial Network Security, Weihai, China","institution_ids":["https://openalex.org/I4210158823"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":2645,"currency":"USD","value_usd":2645},"apc_paid":null,"fwci":1.2705,"has_fulltext":false,"cited_by_count":3,"citation_normalized_percentile":{"value":0.80307846,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":91,"max":98},"biblio":{"volume":"23","issue":"2","first_page":"1994","last_page":"2011"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9882000088691711,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9882000088691711,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9728999733924866,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.955299973487854,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6438999772071838},{"id":"https://openalex.org/keywords/message-passing","display_name":"Message passing","score":0.5911999940872192},{"id":"https://openalex.org/keywords/adjacency-matrix","display_name":"Adjacency matrix","score":0.45509999990463257},{"id":"https://openalex.org/keywords/node","display_name":"Node (physics)","score":0.42559999227523804},{"id":"https://openalex.org/keywords/block","display_name":"Block (permutation group theory)","score":0.4124000072479248},{"id":"https://openalex.org/keywords/preprocessor","display_name":"Preprocessor","score":0.40880000591278076},{"id":"https://openalex.org/keywords/semantics","display_name":"Semantics (computer science)","score":0.39250001311302185},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.3815000057220459}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8245999813079834},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6438999772071838},{"id":"https://openalex.org/C854659","wikidata":"https://www.wikidata.org/wiki/Q1859284","display_name":"Message passing","level":2,"score":0.5911999940872192},{"id":"https://openalex.org/C180356752","wikidata":"https://www.wikidata.org/wiki/Q727035","display_name":"Adjacency matrix","level":3,"score":0.45509999990463257},{"id":"https://openalex.org/C62611344","wikidata":"https://www.wikidata.org/wiki/Q1062658","display_name":"Node (physics)","level":2,"score":0.42559999227523804},{"id":"https://openalex.org/C2777210771","wikidata":"https://www.wikidata.org/wiki/Q4927124","display_name":"Block (permutation group theory)","level":2,"score":0.4124000072479248},{"id":"https://openalex.org/C34736171","wikidata":"https://www.wikidata.org/wiki/Q918333","display_name":"Preprocessor","level":2,"score":0.40880000591278076},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.39750000834465027},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.39250001311302185},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.38830000162124634},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.3815000057220459},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.3813999891281128},{"id":"https://openalex.org/C118505674","wikidata":"https://www.wikidata.org/wiki/Q42586063","display_name":"Encoder","level":2,"score":0.3637000024318695},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.34630000591278076},{"id":"https://openalex.org/C110484373","wikidata":"https://www.wikidata.org/wiki/Q264398","display_name":"Adjacency list","level":2,"score":0.3398999869823456},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.30059999227523804},{"id":"https://openalex.org/C186644900","wikidata":"https://www.wikidata.org/wiki/Q194152","display_name":"Parsing","level":2,"score":0.298799991607666},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.2953000068664551},{"id":"https://openalex.org/C27458966","wikidata":"https://www.wikidata.org/wiki/Q1187693","display_name":"Control flow graph","level":2,"score":0.2896000146865845},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.2847000062465668},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.2639000117778778},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.2615000009536743},{"id":"https://openalex.org/C179518139","wikidata":"https://www.wikidata.org/wiki/Q5140297","display_name":"Coding (social sciences)","level":2,"score":0.25529998540878296},{"id":"https://openalex.org/C761482","wikidata":"https://www.wikidata.org/wiki/Q118093","display_name":"Transmission (telecommunications)","level":2,"score":0.251800000667572},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.25110000371932983},{"id":"https://openalex.org/C2779136372","wikidata":"https://www.wikidata.org/wiki/Q10283002","display_name":"Information flow","level":2,"score":0.2506999969482422}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tdsc.2025.3623299","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2025.3623299","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2104380316","display_name":null,"funder_award_id":"62272129","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7521143322","display_name":null,"funder_award_id":"tsqn202408112","funder_id":"https://openalex.org/F4320326189","funder_display_name":"Taishan Scholar Project of Shandong Province"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320326189","display_name":"Taishan Scholar Project of Shandong Province","ror":null}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":56,"referenced_works":["https://openalex.org/W2021702566","https://openalex.org/W2035095458","https://openalex.org/W2089944128","https://openalex.org/W2122301654","https://openalex.org/W2290145898","https://openalex.org/W2296719434","https://openalex.org/W2501509689","https://openalex.org/W2512362618","https://openalex.org/W2541315509","https://openalex.org/W2743138268","https://openalex.org/W2765669192","https://openalex.org/W2768947629","https://openalex.org/W2792268710","https://openalex.org/W2807219356","https://openalex.org/W2902955734","https://openalex.org/W2949488362","https://openalex.org/W2954713741","https://openalex.org/W2963307331","https://openalex.org/W2967956546","https://openalex.org/W2980035252","https://openalex.org/W2999693458","https://openalex.org/W3040266635","https://openalex.org/W3048942180","https://openalex.org/W3093906213","https://openalex.org/W3113693716","https://openalex.org/W3117098906","https://openalex.org/W3119781401","https://openalex.org/W3133528530","https://openalex.org/W3137639243","https://openalex.org/W3156449551","https://openalex.org/W3169450514","https://openalex.org/W3173856251","https://openalex.org/W3178367256","https://openalex.org/W3184099553","https://openalex.org/W3184127157","https://openalex.org/W3187582314","https://openalex.org/W3193365863","https://openalex.org/W3207886734","https://openalex.org/W3208773001","https://openalex.org/W4200037416","https://openalex.org/W4212795178","https://openalex.org/W4221014584","https://openalex.org/W4224248050","https://openalex.org/W4225161501","https://openalex.org/W4280633207","https://openalex.org/W4282943426","https://openalex.org/W4289755406","https://openalex.org/W4290943650","https://openalex.org/W4298161912","https://openalex.org/W4304587309","https://openalex.org/W4312767611","https://openalex.org/W4367669895","https://openalex.org/W4385237350","https://openalex.org/W4388937010","https://openalex.org/W4390492464","https://openalex.org/W4409049929"],"related_works":[],"abstract_inverted_index":{"Advances":[0],"in":[1,10,31,42,87,105,166,190,199,242],"Graph":[2],"Neural":[3],"Networks":[4],"(GNNs)":[5],"have":[6],"prompted":[7],"remarkable":[8],"progress":[9],"anomaly":[11,122,161,245],"detection":[12],"for":[13,158,213],"securing":[14],"the":[15,21,34,84,93,130,173,191,202,207,218,237],"Industrial":[16],"Control":[17],"Systems":[18],"(ICSs).":[19],"As":[20],"core":[22],"functioning":[23],"block":[24],"of":[25,33],"a":[26,44,75,136,143,150,169,211],"GNN":[27],"network,":[28],"message":[29,138,197],"passing":[30,139,198],"most":[32],"current":[35],"frameworks":[36],"is":[37,48],"conducted":[38],"via":[39],"local":[40],"aggregation,":[41],"which":[43],"node's":[45,76],"vector":[46],"representation":[47],"updated":[49],"with":[50,201],"messages":[51,187],"from":[52,206],"its":[53,59,167],"directly":[54],"connected":[55],"neighbours.":[56],"However,":[57],"despite":[58],"efficiency":[60],"over":[61,221],"numerous":[62],"application":[63],"scenarios,":[64],"such":[65,91,117],"neighbouring":[66],"aggregation":[67,192],"mechanism":[68],"tends":[69],"to":[70,113,154],"be":[71,110],"highly":[72],"biased":[73],"towards":[74],"locality,":[77],"and":[78,98,148,210,225,240],"hence":[79],"may":[80,108],"not":[81,109],"accurately":[82],"profile":[83],"hierarchical":[85],"semantics":[86],"layered":[88],"ICS":[89,121,160,244],"architectures,":[90],"as":[92,118],"supervisory":[94,145],"relations":[95],"among":[96],"controllers":[97],"field":[99],"devices.":[100],"The":[101],"resulting":[102],"node":[103,179],"embeddings,":[104],"this":[106,126],"case,":[107],"knowledgeable":[111],"enough":[112],"instruct":[114],"downstream":[115],"tasks":[116],"fine-grained":[119],"device-wise":[120,243],"detection.":[123,162,246],"To":[124],"address":[125],"issue,":[127],"we":[128],"introduce":[129],"Hierarchical":[131],"Message":[132],"Analyzer":[133],"(the":[134],"HMA),":[135],"new":[137],"scheme":[140],"that":[141,171,184],"explores":[142],"network's":[144],"structural":[146],"features":[147],"regulates":[149,185],"message's":[151],"transmission":[152],"paths":[153],"create":[155],"balanced":[156],"embeddings":[157],"node-level":[159],"This":[163],"model":[164],"comprises":[165],"architecture":[168],"Preprocessor":[170],"condenses":[172],"original":[174],"data":[175],"flow":[176],"into":[177],"initial":[178],"vectors,":[180],"an":[181,194],"Adjacency":[182,208],"Parser":[183],"how":[186],"are":[188],"transmitted":[189],"process,":[193],"Encoder":[195],"performing":[196],"compliance":[200],"adjacency":[203],"info":[204],"obtained":[205],"Parser,":[209],"Decoder":[212],"label":[214],"inference.":[215],"We":[216],"assess":[217],"HMA's":[219,238],"performance":[220],"multiple":[222,234],"evaluation":[223],"metrics":[224],"compare":[226],"it":[227],"against":[228],"various":[229],"state-of-the-art":[230],"baselines.":[231],"Results":[232],"on":[233],"datasets":[235],"certify":[236],"validity":[239],"superiority":[241]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":1}],"updated_date":"2026-08-27T14:10:00.468798","created_date":"2025-10-21T00:00:00"}