{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,21]],"date-time":"2026-05-21T12:08:38Z","timestamp":1779365318840,"version":"3.53.0"},"reference-count":44,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,4,27]],"date-time":"2026-04-27T00:00:00Z","timestamp":1777248000000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0\/"}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Computer Networks"],"published-print":{"date-parts":[[2026,7]]},"DOI":"10.1016\/j.comnet.2026.112339","type":"journal-article","created":{"date-parts":[[2026,4,27]],"date-time":"2026-04-27T16:47:59Z","timestamp":1777308479000},"page":"112339","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["CUTIE: Component-specific Unsupervised Technique for In-node Examination"],"prefix":"10.1016","volume":"284","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-0273-1056","authenticated-orcid":false,"given":"Andrea","family":"Vignali","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Nicola","family":"d\u2019Ambrosio","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.comnet.2026.112339_b1","doi-asserted-by":"crossref","DOI":"10.1016\/j.comcom.2025.108252","article-title":"Securing ICS networks: SDN-based automated traffic control and MTD defensive framework against DDoS attacks","volume":"241","author":"Qin","year":"2025","journal-title":"Comput. Commun."},{"key":"10.1016\/j.comnet.2026.112339_b2","doi-asserted-by":"crossref","DOI":"10.1016\/j.comnet.2024.110655","article-title":"CGAN-based cyber deception framework against reconnaissance attacks in ICS","volume":"251","author":"Qin","year":"2024","journal-title":"Comput. Netw."},{"issue":"4","key":"10.1016\/j.comnet.2026.112339_b3","doi-asserted-by":"crossref","first-page":"834","DOI":"10.1080\/01402390.2025.2481447","article-title":"Stuxnet revisited: From cyber warfare to secret statecraft","volume":"48","author":"Lindsay","year":"2025","journal-title":"J. Strat. Stud."},{"key":"10.1016\/j.comnet.2026.112339_b4","doi-asserted-by":"crossref","unstructured":"F. Kurt, N. Saxena, V. Kumar, G. Theodorakopoulos, POSTER: Automating ICS Malware Analysis with MITRE ATT&CK, in: Proceedings of the 20th ACM Asia Conference on Computer and Communications Security, 2025, pp. 1806\u20131808.","DOI":"10.1145\/3708821.3735345"},{"issue":"4","key":"10.1016\/j.comnet.2026.112339_b5","doi-asserted-by":"crossref","first-page":"2248","DOI":"10.1109\/COMST.2021.3094360","article-title":"A survey on industrial control system testbeds and datasets for security research","volume":"23","author":"Conti","year":"2021","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"10.1016\/j.comnet.2026.112339_b6","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2025.104382","article-title":"Empowered Cyber\u2013Physical Systems security using both network and physical data","volume":"152","author":"Canonico","year":"2025","journal-title":"Comput. Secur."},{"issue":"1","key":"10.1016\/j.comnet.2026.112339_b7","doi-asserted-by":"crossref","first-page":"20","DOI":"10.1007\/s10207-024-00916-x","article-title":"Using machine learning to detect network intrusions in industrial control systems: a survey","volume":"24","author":"Termanini","year":"2025","journal-title":"Int. J. Inf. Secur."},{"key":"10.1016\/j.comnet.2026.112339_b8","series-title":"2025 IEEE 30th International Conference on Emerging Technologies and Factory Automation","first-page":"1","article-title":"Flow-Based vs Packet-Level Intrusion Detection for IoT Networks: A Comparative Resource and Performance Analysis","author":"Asulba","year":"2025"},{"issue":"4","key":"10.1016\/j.comnet.2026.112339_b9","doi-asserted-by":"crossref","first-page":"778","DOI":"10.3390\/electronics14040778","article-title":"Fine-grained encrypted traffic classification using dual embedding and graph neural networks","volume":"14","author":"Liu","year":"2025","journal-title":"Electronics"},{"key":"10.1016\/j.comnet.2026.112339_b10","series-title":"2025 IEEE International Symposium on Parallel and Distributed Processing with Applications","first-page":"329","article-title":"PF-eBPF: In-Kernel Packet-Flow Feature Inference for Real-Time Network Intrusion Detection","author":"Zhang","year":"2025"},{"key":"10.1016\/j.comnet.2026.112339_b11","doi-asserted-by":"crossref","DOI":"10.1016\/j.comcom.2025.108087","article-title":"An anomaly-based approach for cyber\u2013physical threat detection using network and sensor data","volume":"234","author":"Canonico","year":"2025","journal-title":"Comput. Commun."},{"key":"10.1016\/j.comnet.2026.112339_b12","doi-asserted-by":"crossref","DOI":"10.1109\/TNSM.2025.3591533","article-title":"Semi-supervised learning for anomaly traffic detection via bidirectional normalizing flows","author":"Dang","year":"2025","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"issue":"2","key":"10.1016\/j.comnet.2026.112339_b13","doi-asserted-by":"crossref","first-page":"1397","DOI":"10.1007\/s10586-019-03008-x","article-title":"An integrated rule based intrusion detection system: analysis on UNSW-NB15 data set and the real time online dataset","volume":"23","author":"Kumar","year":"2020","journal-title":"Clust. Comput."},{"key":"10.1016\/j.comnet.2026.112339_b14","series-title":"Lisa","first-page":"229","article-title":"Snort: Lightweight intrusion detection for networks.","author":"Roesch","year":"1999"},{"key":"10.1016\/j.comnet.2026.112339_b15","doi-asserted-by":"crossref","unstructured":"R. Sommer, V. Paxson, Enhancing byte-level network intrusion detection signatures with context, in: Proceedings of the 10th ACM Conference on Computer and Communications Security, 2003, pp. 262\u2013271.","DOI":"10.1145\/948109.948145"},{"key":"10.1016\/j.comnet.2026.112339_b16","doi-asserted-by":"crossref","first-page":"12502","DOI":"10.1109\/ACCESS.2025.3530902","article-title":"Machine learning-based detection of anomalies, intrusions, and threats in industrial control systems","volume":"13","author":"Benka","year":"2025","journal-title":"IEEE Access"},{"issue":"1","key":"10.1016\/j.comnet.2026.112339_b17","doi-asserted-by":"crossref","first-page":"26575","DOI":"10.1038\/s41598-025-89650-5","article-title":"Interdisciplinary framework for cyber-attacks and anomaly detection in industrial control systems using deep learning","volume":"15","author":"Gulzar","year":"2025","journal-title":"Sci. Rep."},{"key":"10.1016\/j.comnet.2026.112339_b18","series-title":"2020 IEEE International Conference on Big Data (Big Data)","first-page":"2333","article-title":"Machine learning methods for anomaly detection in industrial control systems","author":"Tai","year":"2020"},{"key":"10.1016\/j.comnet.2026.112339_b19","series-title":"Handbook of Big Data Privacy","first-page":"219","article-title":"Anomaly detection in cyber-physical systems using machine learning","author":"Mohammadi Rouzbahani","year":"2020"},{"key":"10.1016\/j.comnet.2026.112339_b20","doi-asserted-by":"crossref","first-page":"81","DOI":"10.1016\/j.comcom.2022.02.022","article-title":"IADF-CPS: Intelligent anomaly detection framework towards cyber physical systems","volume":"188","author":"Nagarajan","year":"2022","journal-title":"Comput. Commun."},{"key":"10.1016\/j.comnet.2026.112339_b21","doi-asserted-by":"crossref","DOI":"10.1016\/j.conengprac.2024.106164","article-title":"Anomaly detection using invariant rules in industrial control systems","volume":"154","author":"Zhu","year":"2025","journal-title":"Control Eng. Pract."},{"key":"10.1016\/j.comnet.2026.112339_b22","doi-asserted-by":"crossref","DOI":"10.1016\/j.comnet.2025.111729","article-title":"Network traffic anomaly detection method based on stacked fusion time features","author":"Hou","year":"2025","journal-title":"Comput. Netw."},{"key":"10.1016\/j.comnet.2026.112339_b23","article-title":"Transformers model for DDoS attack detection: A survey","volume":"270","author":"Junior","year":"2025","journal-title":"Comput. Netw."},{"key":"10.1016\/j.comnet.2026.112339_b24","doi-asserted-by":"crossref","DOI":"10.1016\/j.comnet.2026.112129","article-title":"Robust Intrusion Detection in CPS: A Pre-training-based multi-view Feature Collaboration and Correlation Analysis Method","author":"Chen","year":"2026","journal-title":"Comput. Netw."},{"key":"10.1016\/j.comnet.2026.112339_b25","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2023.103167","article-title":"Network anomaly detection methods in IoT environments via deep learning: A fair comparison of performance and robustness","volume":"128","author":"Bovenzi","year":"2023","journal-title":"Comput. Secur."},{"key":"10.1016\/j.comnet.2026.112339_b26","doi-asserted-by":"crossref","DOI":"10.1016\/j.comnet.2024.110937","article-title":"DUdetector: A dual-granularity unsupervised model for network anomaly detection","volume":"257","author":"Geng","year":"2025","journal-title":"Comput. Netw."},{"key":"10.1016\/j.comnet.2026.112339_b27","doi-asserted-by":"crossref","DOI":"10.1016\/j.neunet.2025.107400","article-title":"A lightweight All-MLP time\u2013frequency anomaly detection for IIoT time series","volume":"187","author":"Chen","year":"2025","journal-title":"Neural Netw."},{"issue":"1","key":"10.1016\/j.comnet.2026.112339_b28","article-title":"Resource-Efficient Anomaly Detection in Industrial Control Systems With Quantized Recurrent Variational Autoencoder","volume":"7","author":"F\u00e4hrmann","year":"2025","journal-title":"IET Collab. Intell. Manuf."},{"key":"10.1016\/j.comnet.2026.112339_b29","series-title":"2025 IEEE Future Networks World Forum","first-page":"1","article-title":"Interpretable Network Intrusion Detection Framework using Hybrid DL and ML Models","author":"Koravanavar","year":"2025"},{"key":"10.1016\/j.comnet.2026.112339_b30","doi-asserted-by":"crossref","unstructured":"J. Audibert, P. Michiardi, F. Guyard, S. Marti, M.A. Zuluaga, USAD: Unsupervised anomaly detection on multivariate time series, in: Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, 2020, pp. 3395\u20133404.","DOI":"10.1145\/3394486.3403392"},{"key":"10.1016\/j.comnet.2026.112339_b31","doi-asserted-by":"crossref","DOI":"10.1016\/j.eswa.2023.119587","article-title":"RPConvformer: A novel Transformer-based deep neural networks for traffic flow prediction","volume":"218","author":"Wen","year":"2023","journal-title":"Expert Syst. Appl."},{"issue":"1","key":"10.1016\/j.comnet.2026.112339_b32","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1186\/s42400-021-00077-7","article-title":"A critical review of intrusion detection systems in the internet of things: techniques, deployment strategy, validation strategy, attacks, public datasets and challenges","volume":"4","author":"Khraisat","year":"2021","journal-title":"Cybersecurity"},{"key":"10.1016\/j.comnet.2026.112339_b33","doi-asserted-by":"crossref","DOI":"10.1038\/s41598-025-34166-1","article-title":"An enhanced deep learning framework for intrusion classification enterprise network using multi-branch CNN-attention architecture","author":"Biyouki","year":"2025","journal-title":"Sci. Rep."},{"key":"10.1016\/j.comnet.2026.112339_b34","series-title":"International Conference on Critical Information Infrastructures Security","first-page":"88","article-title":"A dataset to support research in the design of secure water treatment systems","author":"Goh","year":"2016"},{"key":"10.1016\/j.comnet.2026.112339_b35","doi-asserted-by":"crossref","DOI":"10.1016\/j.comnet.2024.110617","article-title":"Evaluating ML-based anomaly detection across datasets of varied integrity: A case study","volume":"251","author":"Pekar","year":"2024","journal-title":"Comput. Netw."},{"issue":"3","key":"10.1016\/j.comnet.2026.112339_b36","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3734694","article-title":"Discovering Attack Signature and Its Travel Path using Graphical Model in CPS: A Case Study","volume":"9","author":"Maganti","year":"2025","journal-title":"ACM Trans. Cyber-Physical Syst."},{"key":"10.1016\/j.comnet.2026.112339_b37","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2023.110949","article-title":"A traffic anomaly detection approach based on unsupervised learning for industrial cyber\u2013physical system","volume":"279","author":"Yang","year":"2023","journal-title":"Knowl.-Based Syst."},{"key":"10.1016\/j.comnet.2026.112339_b38","series-title":"2020 IEEE Security and Privacy Workshops","first-page":"208","article-title":"Detecting adversarial examples in learning-enabled cyber-physical systems using variational autoencoder for regression","author":"Cai","year":"2020"},{"issue":"2","key":"10.1016\/j.comnet.2026.112339_b39","doi-asserted-by":"crossref","first-page":"63","DOI":"10.1109\/IOTM.001.2100128","article-title":"Deep learning for secure communication in cyber-physical systems","volume":"5","author":"Ma","year":"2022","journal-title":"IEEE Internet Things Mag."},{"key":"10.1016\/j.comnet.2026.112339_b40","series-title":"2022 IEEE 19th International Conference on Mobile Ad Hoc and Smart Systems","first-page":"530","article-title":"Anomaly detection for CPS via memory-augmented reconstruction and time series prediction","author":"Sun","year":"2022"},{"issue":"1","key":"10.1016\/j.comnet.2026.112339_b41","doi-asserted-by":"crossref","first-page":"8507","DOI":"10.1038\/s41598-026-38317-w","article-title":"Anomaly-based intrusion detection on benchmark datasets for network security: a comprehensive evaluation","volume":"16","author":"Kumar","year":"2026","journal-title":"Sci. Rep."},{"issue":"1","key":"10.1016\/j.comnet.2026.112339_b42","doi-asserted-by":"crossref","first-page":"198","DOI":"10.1080\/10618600.2025.2520577","article-title":"When Tukey meets Chauvenet: A new boxplot criterion for outlier detection","volume":"35","author":"Lin","year":"2026","journal-title":"J. Comput. Graph. Statist."},{"key":"10.1016\/j.comnet.2026.112339_b43","series-title":"Benchmarking Python PCAP Parsers: dpkt vs scapy vs pyshark and finding 100x Speed Improvements","author":"fyx(me)","year":"2026"},{"key":"10.1016\/j.comnet.2026.112339_b44","series-title":"2024 20th International Conference on Network and Service Management","first-page":"1","article-title":"Securing industrial systems: A testbed for cyber-defense evaluation and data collection","author":"Cuorvo","year":"2024"}],"container-title":["Computer Networks"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S1389128626003518?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S1389128626003518?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,5,21]],"date-time":"2026-05-21T11:34:23Z","timestamp":1779363263000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S1389128626003518"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7]]},"references-count":44,"alternative-id":["S1389128626003518"],"URL":"https:\/\/doi.org\/10.1016\/j.comnet.2026.112339","relation":{},"ISSN":["1389-1286"],"issn-type":[{"value":"1389-1286","type":"print"}],"subject":[],"published":{"date-parts":[[2026,7]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"CUTIE: Component-specific Unsupervised Technique for In-node Examination","name":"articletitle","label":"Article Title"},{"value":"Computer Networks","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.comnet.2026.112339","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 The Authors. Published by Elsevier B.V.","name":"copyright","label":"Copyright"}],"article-number":"112339"}}