{"id":"https://openalex.org/W4407315417","doi":"https://doi.org/10.1109/tii.2025.3528559","title":"STMBAD: Spatio-Temporal Multimodal Behavior Anomaly Detector for Industrial Control Systems","display_name":"STMBAD: Spatio-Temporal Multimodal Behavior Anomaly Detector for Industrial Control Systems","publication_year":2025,"publication_date":"2025-02-10","ids":{"openalex":"https://openalex.org/W4407315417","doi":"https://doi.org/10.1109/tii.2025.3528559"},"language":"en","primary_location":{"id":"doi:10.1109/tii.2025.3528559","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tii.2025.3528559","pdf_url":null,"source":{"id":"https://openalex.org/S184777250","display_name":"IEEE Transactions on Industrial Informatics","issn_l":"1551-3203","issn":["1551-3203","1941-0050"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Industrial Informatics","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5017488654","display_name":"Jianzhen Luo","orcid":"https://orcid.org/0000-0002-5123-1306"},"institutions":[{"id":"https://openalex.org/I4210122543","display_name":"Guangdong Polytechnic Normal University","ror":"https://ror.org/02pcb5m77","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210122543"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jianzhen Luo","raw_affiliation_strings":["School of Cyberspace Security, Guangdong Polytechnic Normal University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-5123-1306","affiliations":[{"raw_affiliation_string":"School of Cyberspace Security, Guangdong Polytechnic Normal University, Guangzhou, China","institution_ids":["https://openalex.org/I4210122543"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5112250347","display_name":"Cai Yan","orcid":"https://orcid.org/0009-0004-0336-6291"},"institutions":[{"id":"https://openalex.org/I4210122543","display_name":"Guangdong Polytechnic Normal University","ror":"https://ror.org/02pcb5m77","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210122543"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yan Cai","raw_affiliation_strings":["School of Cyberspace Security, Guangdong Polytechnic Normal University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0009-0004-0336-6291","affiliations":[{"raw_affiliation_string":"School of Cyberspace Security, Guangdong Polytechnic Normal University, Guangzhou, China","institution_ids":["https://openalex.org/I4210122543"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100743430","display_name":"Jun Cai","orcid":"https://orcid.org/0000-0003-1695-483X"},"institutions":[{"id":"https://openalex.org/I4210122543","display_name":"Guangdong Polytechnic Normal University","ror":"https://ror.org/02pcb5m77","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210122543"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jun Cai","raw_affiliation_strings":["School of Cyberspace Security, Guangdong Polytechnic Normal University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0000-0003-1695-483X","affiliations":[{"raw_affiliation_string":"School of Cyberspace Security, Guangdong Polytechnic Normal University, Guangzhou, China","institution_ids":["https://openalex.org/I4210122543"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5108714541","display_name":"Wanhan Fang","orcid":"https://orcid.org/0009-0006-1071-7680"},"institutions":[{"id":"https://openalex.org/I4210122543","display_name":"Guangdong Polytechnic Normal University","ror":"https://ror.org/02pcb5m77","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210122543"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wanhan Fang","raw_affiliation_strings":["School of Cyberspace Security, Guangdong Polytechnic Normal University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0009-0006-1071-7680","affiliations":[{"raw_affiliation_string":"School of Cyberspace Security, Guangdong Polytechnic Normal University, Guangzhou, China","institution_ids":["https://openalex.org/I4210122543"]}]},{"author_position":"last","author":{"id":null,"display_name":"Wenwei Zheng","orcid":"https://orcid.org/0009-0001-4156-7332"},"institutions":[{"id":"https://openalex.org/I4210122543","display_name":"Guangdong Polytechnic Normal University","ror":"https://ror.org/02pcb5m77","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210122543"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wenwei Zheng","raw_affiliation_strings":["School of Cyberspace Security, Guangdong Polytechnic Normal University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0009-0001-4156-7332","affiliations":[{"raw_affiliation_string":"School of Cyberspace Security, Guangdong Polytechnic Normal University, Guangzhou, China","institution_ids":["https://openalex.org/I4210122543"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I4210122543"],"apc_list":null,"apc_paid":null,"fwci":13.2065,"has_fulltext":false,"cited_by_count":8,"citation_normalized_percentile":{"value":0.98390998,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":97,"max":99},"biblio":{"volume":"21","issue":"5","first_page":"3746","last_page":"3755"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9861999750137329,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12205","display_name":"Time Series Analysis and Forecasting","score":0.9842000007629395,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6398292183876038},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.5574135780334473},{"id":"https://openalex.org/keywords/detector","display_name":"Detector","score":0.5489797592163086},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.5298606753349304},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.43931978940963745},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.3350754380226135},{"id":"https://openalex.org/keywords/physics","display_name":"Physics","score":0.14618495106697083},{"id":"https://openalex.org/keywords/telecommunications","display_name":"Telecommunications","score":0.09116163849830627}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6398292183876038},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5574135780334473},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.5489797592163086},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.5298606753349304},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.43931978940963745},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.3350754380226135},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.14618495106697083},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.09116163849830627},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tii.2025.3528559","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tii.2025.3528559","pdf_url":null,"source":{"id":"https://openalex.org/S184777250","display_name":"IEEE Transactions on Industrial Informatics","issn_l":"1551-3203","issn":["1551-3203","1941-0050"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Industrial Informatics","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":39,"referenced_works":["https://openalex.org/W2535751405","https://openalex.org/W2604247107","https://openalex.org/W2768947629","https://openalex.org/W2785362611","https://openalex.org/W2807219356","https://openalex.org/W3107123323","https://openalex.org/W3204586135","https://openalex.org/W4206466268","https://openalex.org/W4225526013","https://openalex.org/W4307049147","https://openalex.org/W4319004607","https://openalex.org/W4321793224","https://openalex.org/W4361265577","https://openalex.org/W4361761466","https://openalex.org/W4364322549","https://openalex.org/W4381785391","https://openalex.org/W4383750732","https://openalex.org/W4385245566","https://openalex.org/W4385380338","https://openalex.org/W4385638651","https://openalex.org/W4385702953","https://openalex.org/W4386379708","https://openalex.org/W4387693742","https://openalex.org/W4388334594","https://openalex.org/W4388430419","https://openalex.org/W4388676625","https://openalex.org/W4389076372","https://openalex.org/W4389859971","https://openalex.org/W4390405429","https://openalex.org/W4391377427","https://openalex.org/W4392826040","https://openalex.org/W4392828127","https://openalex.org/W4394006473","https://openalex.org/W4394606408","https://openalex.org/W4396941583","https://openalex.org/W4396952366","https://openalex.org/W6845625448","https://openalex.org/W6846825190","https://openalex.org/W6857279128"],"related_works":["https://openalex.org/W2806741695","https://openalex.org/W4290647774","https://openalex.org/W3189286258","https://openalex.org/W3207797160","https://openalex.org/W3210364259","https://openalex.org/W4300558037","https://openalex.org/W2667207928","https://openalex.org/W2912112202","https://openalex.org/W4377864969","https://openalex.org/W2033914206"],"abstract_inverted_index":{"Modern":[0],"cyber":[1],"attacks":[2],"against":[3],"industrial":[4,77],"control":[5],"systems":[6],"(ICSs)":[7],"are":[8,18],"highly":[9],"stealthy,":[10],"persistent,":[11],"and":[12,29,89,104,123,128,135,146,175,187,208],"targeted.":[13],"Existing":[14],"anomaly":[15,54,68],"detection":[16,33,171,177],"methods":[17,207],"mainly":[19],"based":[20,56,138],"on":[21,57,139],"a":[22,50,82,192],"set":[23],"of":[24,66,85,116,149,159,164],"rules":[25],"defining":[26],"correct":[27],"behaviors":[28,88],"use":[30],"loosely":[31],"bounded":[32],"thresholds,":[34],"which":[35],"can":[36,152],"be":[37,153],"exploited":[38],"by":[39,108,191],"attackers":[40],"to":[41,62,80,93,131,155,180],"evade":[42],"detection.":[43,69],"In":[44],"this":[45],"article,":[46],"we":[47],"propose":[48],"STMBAD,":[49],"spatio-temporal":[51,58,161],"multimodal":[52,78,162],"behavior":[53,60,163],"detector":[55],"ICS":[59,67,87],"analysis":[61],"improve":[63],"the":[64,72,91,125,140,157,160,201,205,210],"performance":[65],"STMBAD":[70,112],"leverages":[71],"rich":[73],"information":[74],"available":[75],"in":[76],"data":[79,99],"achieve":[81],"deep":[83],"understanding":[84],"complex":[86],"enhance":[90],"ability":[92],"detect":[94],"stealthy":[95],"attacks.":[96],"To":[97],"avoid":[98],"processing":[100],"cross":[101],"heterogeneous":[102],"type/structure":[103],"temporal":[105,143],"confusion":[106],"caused":[107,190],"unsynchronized":[109],"time":[110,114],"series,":[111],"embeds":[113],"series":[115],"individual":[117],"modality":[118],"separately":[119],"into":[120],"variate":[121],"tokens":[122],"applies":[124],"attention":[126,141],"mechanism":[127,172],"feedforward":[129],"network":[130],"capture":[132],"multivariate":[133],"correlations":[134],"interdependencies.":[136],"Meanwhile,":[137],"mechanisms,":[142],"evolution":[144],"law":[145],"spatial":[147],"correlation":[148],"different":[150,185],"modalities":[151],"captured":[154],"model":[156],"characteristics":[158],"ICS.":[165],"When":[166],"detecting":[167],"attacks,":[168],"an":[169],"adaptive":[170],"combining":[173],"global":[174,194],"local":[176],"is":[178],"proposed":[179,202],"utilize":[181],"dynamic":[182],"thresholds":[183],"at":[184],"levels":[186],"reduce":[188],"errors":[189],"loose":[193],"threshold.":[195],"The":[196],"simulation":[197],"results":[198],"show":[199],"that":[200],"method":[203],"outperforms":[204],"baseline":[206],"yields":[209],"highest":[211],"F1":[212],"score,":[213],"reaching":[214],"95%.":[215]},"counts_by_year":[{"year":2026,"cited_by_count":4},{"year":2025,"cited_by_count":4}],"updated_date":"2026-06-26T08:34:08.712188","created_date":"2025-10-10T00:00:00"}