{"id":"https://openalex.org/W7133343621","doi":"https://doi.org/10.1109/tps-isa67132.2025.00051","title":"A Multi-Layered Embedded Intrusion Detection Framework for Programmable Logic Controllers","display_name":"A Multi-Layered Embedded Intrusion Detection Framework for Programmable Logic Controllers","publication_year":2025,"publication_date":"2025-11-12","ids":{"openalex":"https://openalex.org/W7133343621","doi":"https://doi.org/10.1109/tps-isa67132.2025.00051"},"language":null,"primary_location":{"id":"doi:10.1109/tps-isa67132.2025.00051","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tps-isa67132.2025.00051","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE 7th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Rishabh Das","orcid":"https://orcid.org/0000-0003-0649-6898"},"institutions":[{"id":"https://openalex.org/I4210106879","display_name":"Ohio University","ror":"https://ror.org/01jr3y717","country_code":"US","type":"education","lineage":["https://openalex.org/I4210106879"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Rishabh Das","raw_affiliation_strings":["J. Warren McClure School of Emerging Communication Technologies, Ohio University,Athens,USA"],"raw_orcid":"https://orcid.org/0000-0003-0649-6898","affiliations":[{"raw_affiliation_string":"J. Warren McClure School of Emerging Communication Technologies, Ohio University,Athens,USA","institution_ids":["https://openalex.org/I4210106879"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5127944905","display_name":"Aaron Werth","orcid":null},"institutions":[{"id":"https://openalex.org/I82495205","display_name":"University of Alabama in Huntsville","ror":"https://ror.org/02zsxwr40","country_code":"US","type":"education","lineage":["https://openalex.org/I82495205"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Aaron Werth","raw_affiliation_strings":["The University of Alabama in Huntsville,Electrical and Computer Engineering,Huntsville,USA"],"raw_orcid":"https://orcid.org/0000-0003-1936-5627","affiliations":[{"raw_affiliation_string":"The University of Alabama in Huntsville,Electrical and Computer Engineering,Huntsville,USA","institution_ids":["https://openalex.org/I82495205"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5050382531","display_name":"Tommy Morris","orcid":null},"institutions":[{"id":"https://openalex.org/I82495205","display_name":"University of Alabama in Huntsville","ror":"https://ror.org/02zsxwr40","country_code":"US","type":"education","lineage":["https://openalex.org/I82495205"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Tommy Morris","raw_affiliation_strings":["The University of Alabama in Huntsville,Electrical and Computer Engineering,Huntsville,USA"],"raw_orcid":"https://orcid.org/0000-0002-4854-5419","affiliations":[{"raw_affiliation_string":"The University of Alabama in Huntsville,Electrical and Computer Engineering,Huntsville,USA","institution_ids":["https://openalex.org/I82495205"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.70837893,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"419","last_page":"426"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.21719999611377716,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.21719999611377716,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.20080000162124634,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12122","display_name":"Physical Unclonable Functions (PUFs) and Hardware Security","score":0.13729999959468842,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/programmable-logic-controller","display_name":"Programmable logic controller","score":0.7896000146865845},{"id":"https://openalex.org/keywords/testbed","display_name":"Testbed","score":0.6430000066757202},{"id":"https://openalex.org/keywords/industrial-control-system","display_name":"Industrial control system","score":0.5648000240325928},{"id":"https://openalex.org/keywords/field-programmable-gate-array","display_name":"Field-programmable gate array","score":0.5335999727249146},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5288000106811523},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.44999998807907104},{"id":"https://openalex.org/keywords/latency","display_name":"Latency (audio)","score":0.4244000017642975},{"id":"https://openalex.org/keywords/programmable-logic-device","display_name":"Programmable logic device","score":0.41510000824928284},{"id":"https://openalex.org/keywords/detector","display_name":"Detector","score":0.3804999887943268}],"concepts":[{"id":"https://openalex.org/C37374048","wikidata":"https://www.wikidata.org/wiki/Q188674","display_name":"Programmable logic controller","level":2,"score":0.7896000146865845},{"id":"https://openalex.org/C31395832","wikidata":"https://www.wikidata.org/wiki/Q1318674","display_name":"Testbed","level":2,"score":0.6430000066757202},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6097000241279602},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.5871999859809875},{"id":"https://openalex.org/C40071531","wikidata":"https://www.wikidata.org/wiki/Q2513962","display_name":"Industrial control system","level":3,"score":0.5648000240325928},{"id":"https://openalex.org/C42935608","wikidata":"https://www.wikidata.org/wiki/Q190411","display_name":"Field-programmable gate array","level":2,"score":0.5335999727249146},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5288000106811523},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.44999998807907104},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.4300000071525574},{"id":"https://openalex.org/C82876162","wikidata":"https://www.wikidata.org/wiki/Q17096504","display_name":"Latency (audio)","level":2,"score":0.4244000017642975},{"id":"https://openalex.org/C206274596","wikidata":"https://www.wikidata.org/wiki/Q1063837","display_name":"Programmable logic device","level":2,"score":0.41510000824928284},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.3804999887943268},{"id":"https://openalex.org/C17500928","wikidata":"https://www.wikidata.org/wiki/Q959968","display_name":"Control system","level":2,"score":0.36820000410079956},{"id":"https://openalex.org/C203479927","wikidata":"https://www.wikidata.org/wiki/Q5165939","display_name":"Controller (irrigation)","level":2,"score":0.35199999809265137},{"id":"https://openalex.org/C44986683","wikidata":"https://www.wikidata.org/wiki/Q1411875","display_name":"Ladder logic","level":3,"score":0.3513999879360199},{"id":"https://openalex.org/C9390403","wikidata":"https://www.wikidata.org/wiki/Q3966","display_name":"Computer hardware","level":1,"score":0.3441999852657318},{"id":"https://openalex.org/C172707124","wikidata":"https://www.wikidata.org/wiki/Q423488","display_name":"Actuator","level":2,"score":0.3370000123977661},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.31200000643730164},{"id":"https://openalex.org/C145804949","wikidata":"https://www.wikidata.org/wiki/Q478123","display_name":"Situation awareness","level":2,"score":0.3109000027179718},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.3066999912261963},{"id":"https://openalex.org/C67953723","wikidata":"https://www.wikidata.org/wiki/Q192525","display_name":"Workstation","level":2,"score":0.3027999997138977},{"id":"https://openalex.org/C98025372","wikidata":"https://www.wikidata.org/wiki/Q477538","display_name":"Systems architecture","level":3,"score":0.28619998693466187},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.272599995136261},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.2705000042915344},{"id":"https://openalex.org/C2778156585","wikidata":"https://www.wikidata.org/wiki/Q174053","display_name":"Relay","level":3,"score":0.27000001072883606},{"id":"https://openalex.org/C34370810","wikidata":"https://www.wikidata.org/wiki/Q3961319","display_name":"Simple programmable logic device","level":5,"score":0.26089999079704285},{"id":"https://openalex.org/C115901376","wikidata":"https://www.wikidata.org/wiki/Q184199","display_name":"Automation","level":2,"score":0.2603999972343445},{"id":"https://openalex.org/C157922185","wikidata":"https://www.wikidata.org/wiki/Q173198","display_name":"Logic synthesis","level":3,"score":0.25999999046325684},{"id":"https://openalex.org/C46637626","wikidata":"https://www.wikidata.org/wiki/Q6693015","display_name":"Low latency (capital markets)","level":2,"score":0.2574999928474426}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tps-isa67132.2025.00051","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tps-isa67132.2025.00051","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE 7th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G8386200534","display_name":"Virtual Industrial Control Systems for Cybersecurity Engineering Education","funder_award_id":"1623657","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":29,"referenced_works":["https://openalex.org/W1941748144","https://openalex.org/W2112663892","https://openalex.org/W2167710876","https://openalex.org/W2521150000","https://openalex.org/W2694044524","https://openalex.org/W2765773944","https://openalex.org/W2803414046","https://openalex.org/W2806846006","https://openalex.org/W2885205990","https://openalex.org/W2904461755","https://openalex.org/W2999309192","https://openalex.org/W3042964862","https://openalex.org/W3095389896","https://openalex.org/W3111767900","https://openalex.org/W3111964154","https://openalex.org/W3138598418","https://openalex.org/W3165066055","https://openalex.org/W3209929740","https://openalex.org/W4226272917","https://openalex.org/W4254182148","https://openalex.org/W4283219743","https://openalex.org/W4293763833","https://openalex.org/W4295308778","https://openalex.org/W4383426601","https://openalex.org/W4386710224","https://openalex.org/W4389145067","https://openalex.org/W4390416781","https://openalex.org/W4395097460","https://openalex.org/W4399381491"],"related_works":[],"abstract_inverted_index":{"Industrial":[0],"control":[1],"system":[2,50,68],"(ICS)":[3],"operations":[4],"use":[5],"trusted":[6,32],"endpoints":[7],"like":[8],"human":[9],"machine":[10],"interfaces":[11],"(HMIs)":[12],"and":[13,39,56,62,74,115,132],"workstations":[14],"to":[15,18,60,64,103],"relay":[16],"commands":[17,38],"programmable":[19],"logic":[20],"controllers":[21],"(PLCs).":[22],"Because":[23],"most":[24],"PLCs":[25],"lack":[26],"layered":[27],"defenses,":[28],"compromise":[29],"of":[30,126,129,152],"a":[31,70,75,84,124,143],"endpoint":[33],"can":[34],"drive":[35],"unsafe":[36],"actuator":[37],"risk":[40],"safety-critical":[41],"operation.":[42],"This":[43],"research":[44],"presents":[45],"an":[46,153],"embedded":[47,121,145],"intrusion":[48],"detection":[49],"that":[51,147],"runs":[52],"inside":[53],"the":[54,81,149],"controller":[55],"uses":[57],"header-level":[58],"telemetry":[59],"detect":[61],"respond":[63],"network":[65],"attacks.":[66],"The":[67,95,107,120,139],"combines":[69],"semisupervised":[71],"anomaly":[72,96],"detector":[73,97],"supervised":[76,108],"attack":[77],"classifier.":[78],"We":[79],"evaluate":[80],"approach":[82],"on":[83],"midstream":[85],"oil-terminal":[86],"testbed":[87],"using":[88],"three":[89],"datasets":[90],"collected":[91],"during":[92],"tanker-truck":[93],"loading.":[94],"achieves":[98],"zero":[99],"missed":[100],"attacks,":[101],"corresponding":[102],"0.998":[104],"Matthews":[105],"correlation.":[106],"stage":[109],"attains":[110],"97.37":[111],"percent":[112,117],"hold-out":[113],"accuracy":[114],"97.03":[116],"external":[118],"accuracy.":[119],"design":[122],"adds":[123],"median":[125],"2,031":[127],"microseconds":[128],"end-to-end":[130],"latency":[131],"does":[133],"not":[134],"impact":[135],"PLC's":[136],"cycle":[137],"time.":[138],"proposed":[140],"architecture":[141],"provides":[142],"multi-layer":[144],"security":[146],"meets":[148],"real-time":[150],"requirements":[151],"industrial":[154],"system.":[155]},"counts_by_year":[],"updated_date":"2026-08-06T08:24:18.245995","created_date":"2026-03-04T00:00:00"}