{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,5]],"date-time":"2026-08-05T07:44:02Z","timestamp":1785915842743,"version":"3.56.0"},"reference-count":35,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100001381","name":"National Research Foundation","doi-asserted-by":"publisher","award":["NRF-NCR25-NSOE05-0001"],"award-info":[{"award-number":["NRF-NCR25-NSOE05-0001"]}],"id":[{"id":"10.13039\/501100001381","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["International Journal of Critical Infrastructure Protection"],"published-print":{"date-parts":[[2026,9]]},"DOI":"10.1016\/j.ijcip.2026.100868","type":"journal-article","created":{"date-parts":[[2026,6,17]],"date-time":"2026-06-17T06:41:34Z","timestamp":1781678494000},"page":"100868","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["An invariant mining approach for anomaly detection in industrial control system"],"prefix":"10.1016","volume":"54","author":[{"ORCID":"https:\/\/orcid.org\/0009-0008-3509-762X","authenticated-orcid":false,"given":"Abdul","family":"Samiah","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2059-5681","authenticated-orcid":false,"given":"Muhammad Azmi","family":"Umer","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3547-0307","authenticated-orcid":false,"given":"Shama","family":"Siddiqui","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"issue":"2","key":"10.1016\/j.ijcip.2026.100868_b1","doi-asserted-by":"crossref","first-page":"189","DOI":"10.1002\/sys.21509","article-title":"Conceptualizing the key features of cyber-physical systems in a multi-layered representation for safety and security analysis","volume":"23","author":"Carreras Guzman","year":"2020","journal-title":"Syst. Eng."},{"key":"10.1016\/j.ijcip.2026.100868_b2","series-title":"CRITIS","first-page":"88","article-title":"A dataset to support research in the design of secure water treatment systems","author":"Goh","year":"2017"},{"key":"10.1016\/j.ijcip.2026.100868_b3","doi-asserted-by":"crossref","DOI":"10.1016\/j.ijcip.2022.100516","article-title":"Machine learning for intrusion detection in industrial control systems: Applications, challenges, and recommendations","volume":"38","author":"Umer","year":"2022","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"10.1016\/j.ijcip.2026.100868_b4","series-title":"Proceedings of the 1st ACM Workshop on Security of Ad Hoc and Sensor Networks","first-page":"125","article-title":"A specification-based intrusion detection system for AODV","author":"Tseng","year":"2003"},{"key":"10.1016\/j.ijcip.2026.100868_b5","series-title":"International Conference on Advanced Network Technologies and Intelligent Computing","first-page":"73","article-title":"An intelligent behavior-based system to recognize and detect the malware variants based on their characteristics using machine learning techniques","author":"Pai","year":"2022"},{"issue":"6","key":"10.1016\/j.ijcip.2026.100868_b6","doi-asserted-by":"crossref","first-page":"867","DOI":"10.3390\/electronics11060867","article-title":"Advanced intrusion detection combining signature-based and behavior-based detection methods","volume":"11","author":"Kwon","year":"2022","journal-title":"Electronics"},{"issue":"7","key":"10.1016\/j.ijcip.2026.100868_b7","doi-asserted-by":"crossref","first-page":"810","DOI":"10.1109\/TC.2002.1017701","article-title":"Multivariate statistical analysis of audit trails for host-based intrusion detection","volume":"51","author":"Ye","year":"2002","journal-title":"IEEE Trans. Comput."},{"issue":"1","key":"10.1016\/j.ijcip.2026.100868_b8","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1007\/s12046-020-1290-y","article-title":"Predictive safety assessment for storage tanks of water cyber physical systems using machine learning","volume":"45","author":"Junejo","year":"2020","journal-title":"S\u0101dhan\u0101"},{"key":"10.1016\/j.ijcip.2026.100868_b9","series-title":"ICMD","first-page":"207","article-title":"Mining association rules between sets of items in large databases","volume":"22","author":"Agrawal","year":"1993"},{"key":"10.1016\/j.ijcip.2026.100868_b10","series-title":"Proceedings of the 2017 Workshop on Cyber-Physical Systems Security and PrivaCy","first-page":"131","article-title":"Integrating design and data centric approaches to generate invariants for distributed attack detection","author":"Umer","year":"2017"},{"key":"10.1016\/j.ijcip.2026.100868_b11","doi-asserted-by":"crossref","DOI":"10.1016\/j.ijcip.2020.100341","article-title":"Generating invariants using design and data-centric approaches for distributed attack detection","volume":"28","author":"Umer","year":"2020","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"10.1016\/j.ijcip.2026.100868_b12","series-title":"Machine Intelligence for Cybersecurity Applications","first-page":"397","article-title":"Machine learning for CPS security: Applications, challenges and recommendations","author":"Ahmed","year":"2021"},{"key":"10.1016\/j.ijcip.2026.100868_b13","doi-asserted-by":"crossref","unstructured":"Danish Hudani, Muhammad Haseeb, Muhammad Taufiq, Muhammad Azmi Umer, Nandha Kumar Kandasamy, A Data-Centric Approach to Generate Invariants for a Smart Grid Using Machine Learning, in: Proceedings of the 2022 ACM Workshop on Secure and Trustworthy Cyber-Physical Systems, 2022, pp. 31\u201336.","DOI":"10.1145\/3510547.3517927"},{"key":"10.1016\/j.ijcip.2026.100868_b14","doi-asserted-by":"crossref","unstructured":"Muhammad Azmi Umer, Aditya Mathur, Muhammad Taha Jilani, Effect of time patterns in mining process invariants for industrial control systems: an experimental study, in: Proceedings of the 2nd International Workshop on Software Engineering and AI for Data Quality in Cyber-Physical Systems\/Internet of Things, 2022, pp. 10\u201317.","DOI":"10.1145\/3549037.3561274"},{"key":"10.1016\/j.ijcip.2026.100868_b15","doi-asserted-by":"crossref","unstructured":"Muhammad Azmi Umer, Chuadhry Mujeeb Ahmed, Muhammad Taha Jilani, Aditya P. Mathur, Attack rules: an adversarial approach to generate attacks for Industrial Control Systems using machine learning, in: Proceedings of the 2th Workshop on CPS&IoT Security and Privacy, 2021, pp. 35\u201340.","DOI":"10.1145\/3462633.3483976"},{"issue":"1","key":"10.1016\/j.ijcip.2026.100868_b16","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s42400-021-00069-7","article-title":"Deriving invariant checkers for critical infrastructure using axiomatic design principles","volume":"4","author":"Yoong","year":"2021","journal-title":"Cybersecurity"},{"key":"10.1016\/j.ijcip.2026.100868_b17","series-title":"Network and Distributed Systems Security (NDSS) Symposium","first-page":"24","article-title":"A systematic framework to generate invariants for anomaly detection in industrial control systems","author":"Feng","year":"2019"},{"key":"10.1016\/j.ijcip.2026.100868_b18","first-page":"1","article-title":"Mitigating adversarial attacks on data-driven invariant checkers for cyber-physical systems","author":"Maiti","year":"2022","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"10.1016\/j.ijcip.2026.100868_b19","series-title":"2017 IEEE 18th International Symposium on High Assurance Systems Engineering","first-page":"124","article-title":"Effectiveness of association rules mining for invariants generation in cyber-physical systems","author":"Pal","year":"2017"},{"key":"10.1016\/j.ijcip.2026.100868_b20","series-title":"Learning invariant rules from data for interpretable anomaly detection","author":"Feng","year":"2022"},{"key":"10.1016\/j.ijcip.2026.100868_b21","series-title":"Proceedings of the European Symposium on Research in Computer Security (ESORICS 2023 Workshops)","first-page":"101","article-title":"IM-DISCO: Invariant Mining for Detecting IntrusionS in Critical Operations","volume":"vol. 14516","author":"Saraiva","year":"2024"},{"key":"10.1016\/j.ijcip.2026.100868_b22","series-title":"IECON 2021 \u2013 47th Annual Conference of the IEEE Industrial Electronics Society","first-page":"1","article-title":"A machine learning approach to intrusion detection in water distribution systems \u2013 a review","author":"Mboweni","year":"2021"},{"issue":"2","key":"10.1016\/j.ijcip.2026.100868_b23","doi-asserted-by":"crossref","first-page":"246","DOI":"10.1109\/ICJECE.2021.3053231","article-title":"A novel intrusion detection system for RPL-based cyber\u2013physical systems","volume":"44","author":"Sharma","year":"2021","journal-title":"IEEE Can. J. Electr. Comput. Eng."},{"issue":"2","key":"10.1016\/j.ijcip.2026.100868_b24","doi-asserted-by":"crossref","DOI":"10.3390\/a16020085","article-title":"Detection of cyberattacks and anomalies in cyber-physical systems: approaches, data sources, evaluation","volume":"16","author":"Tushkanova","year":"2023","journal-title":"Algorithms"},{"issue":"C","key":"10.1016\/j.ijcip.2026.100868_b25","article-title":"Cyber-attacks detection in industrial systems using artificial intelligence-driven methods","volume":"38","author":"Wang","year":"2022","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"10.1016\/j.ijcip.2026.100868_b26","doi-asserted-by":"crossref","unstructured":"Mahalakshmi M, Ramkumar M. P, Emil Selvan G. S. R, SCADA Intrusion Detection System using Cost Sensitive Machine Learning and SMOTE-SVM, in: 2022 4th International Conference on Advances in Computing, Communication Control and Networking, ICAC3N, 2022, pp. 332\u2013337.","DOI":"10.1109\/ICAC3N56670.2022.10074251"},{"key":"10.1016\/j.ijcip.2026.100868_b27","doi-asserted-by":"crossref","first-page":"81","DOI":"10.1016\/j.comcom.2022.02.022","article-title":"IADF-CPS: Intelligent anomaly detection framework towards cyber physical systems","volume":"188","author":"0001","year":"2022","journal-title":"Comput. Commun."},{"key":"10.1016\/j.ijcip.2026.100868_b28","doi-asserted-by":"crossref","first-page":"190403","DOI":"10.1109\/ACCESS.2020.3032251","article-title":"Behavioural intrusion detection in water distribution systems using neural networks","volume":"8","author":"Ramotsoela","year":"2020","journal-title":"IEEE Access"},{"key":"10.1016\/j.ijcip.2026.100868_b29","doi-asserted-by":"crossref","DOI":"10.1109\/TPWRS.2022.3150084","article-title":"Intrusion detection and identification using tree-based machine learning algorithms on DCS network in the oil refinery","author":"Kim","year":"2022","journal-title":"IEEE Trans. Power Syst."},{"key":"10.1016\/j.ijcip.2026.100868_b30","doi-asserted-by":"crossref","unstructured":"Riccardo Colelli, Filippo Magri, Stefano Panzieri, Federica Pascucci, Anomaly-Based Intrusion Detection System for Cyber-Physical System Security, in: 2021 29th Mediterranean Conference on Control and Automation, MED, 2021, pp. 428\u2013434.","DOI":"10.1109\/MED51440.2021.9480182"},{"issue":"1","key":"10.1016\/j.ijcip.2026.100868_b31","doi-asserted-by":"crossref","first-page":"6","DOI":"10.1186\/s42400-021-00069-7","article-title":"Deriving invariant checkers for critical infrastructure using axiomatic design principles","volume":"4","author":"Cheah","year":"2021","journal-title":"Cybersecurity"},{"issue":"4","key":"10.1016\/j.ijcip.2026.100868_b32","first-page":"37","article-title":"Machine learning for automated industrial IoT attack detection: An efficiency-complexity trade-off","volume":"12","author":"Chakraborty","year":"2021","journal-title":"ACM Trans. Manag. Inf. Syst. (TMIS)"},{"key":"10.1016\/j.ijcip.2026.100868_b33","series-title":"CysWater","first-page":"25","article-title":"WADI: A water distribution testbed for research in the design of secure cyber physical systems","author":"Ahmed","year":"2017"},{"key":"10.1016\/j.ijcip.2026.100868_b34","series-title":"SWaT: Secure Water Treatment Testbed","author":"iTrust","year":"2015"},{"key":"10.1016\/j.ijcip.2026.100868_b35","series-title":"Water distribution testbed","author":"iTrust","year":"2023"}],"container-title":["International Journal of Critical Infrastructure Protection"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S1874548226000405?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S1874548226000405?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,8,5]],"date-time":"2026-08-05T06:46:18Z","timestamp":1785912378000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S1874548226000405"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9]]},"references-count":35,"alternative-id":["S1874548226000405"],"URL":"https:\/\/doi.org\/10.1016\/j.ijcip.2026.100868","relation":{},"ISSN":["1874-5482"],"issn-type":[{"value":"1874-5482","type":"print"}],"subject":[],"published":{"date-parts":[[2026,9]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"An invariant mining approach for anomaly detection in industrial control system","name":"articletitle","label":"Article Title"},{"value":"International Journal of Critical Infrastructure Protection","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.ijcip.2026.100868","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier B.V. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"100868"}}