{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T12:00:07Z","timestamp":1784203207427,"version":"3.55.0"},"reference-count":43,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"2","license":[{"start":{"date-parts":[[2022,3,1]],"date-time":"2022-03-01T00:00:00Z","timestamp":1646092800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2018YFB2004200"],"award-info":[{"award-number":["2018YFB2004200"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]},{"name":"National Natural Science Foundation for Distinguished Young Scholars","award":["62025602"],"award-info":[{"award-number":["62025602"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62172244"],"award-info":[{"award-number":["62172244"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U1803263"],"award-info":[{"award-number":["U1803263"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["11931015"],"award-info":[{"award-number":["11931015"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["81961138010"],"award-info":[{"award-number":["81961138010"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Frontier Science and Technology Innovation of China","award":["2016QY05X1002-2"],"award-info":[{"award-number":["2016QY05X1002-2"]}]},{"name":"Shandong Provincial Key Research and Development Program of China","award":["2019JZZY010132"],"award-info":[{"award-number":["2019JZZY010132"]}]},{"DOI":"10.13039\/501100007129","name":"Natural Science Foundation of Shandong Province","doi-asserted-by":"publisher","award":["ZR2020YQ06"],"award-info":[{"award-number":["ZR2020YQ06"]}],"id":[{"id":"10.13039\/501100007129","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100007129","name":"Natural Science Foundation of Shandong Province","doi-asserted-by":"publisher","award":["ZR2021MF132"],"award-info":[{"award-number":["ZR2021MF132"]}],"id":[{"id":"10.13039\/501100007129","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100004806","name":"Fok Ying Tong Education Foundation","doi-asserted-by":"publisher","award":["171105"],"award-info":[{"award-number":["171105"]}],"id":[{"id":"10.13039\/501100004806","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Key Technology Research and Development Program of Science and Technology-Scientific and Technological Innovation Team of Shaanxi Province","award":["2020TD-013"],"award-info":[{"award-number":["2020TD-013"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Netw. Sci. Eng."],"published-print":{"date-parts":[[2022,3,1]]},"DOI":"10.1109\/tnse.2021.3130602","type":"journal-article","created":{"date-parts":[[2021,11,25]],"date-time":"2021-11-25T20:29:13Z","timestamp":1637872153000},"page":"703-715","source":"Crossref","is-referenced-by-count":25,"title":["Detecting Semantic Attack in SCADA System: A Behavioral Model Based on Secondary Labeling of States-Duration Evolution Graph"],"prefix":"10.1109","volume":"9","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3386-4756","authenticated-orcid":false,"given":"Lijuan","family":"Xu","sequence":"first","affiliation":[{"name":"School of Computer Science and Technology, Harbin Institute of Technology, Weihai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Bailing","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Harbin Institute of Technology, Weihai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiaoming","family":"Wu","sequence":"additional","affiliation":[{"name":"Shandong Provincial Key Laboratory of Computer Networks, Shandong Computer Science Center (National Supercomputer Center in Jinan), Qilu University of Technology (Shandong Academy of Sciences), Jinan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1812-1316","authenticated-orcid":false,"given":"Dawei","family":"Zhao","sequence":"additional","affiliation":[{"name":"Shandong Provincial Key Laboratory of Computer Networks, Shandong Computer Science Center (National Supercomputer Center in Jinan), Qilu University of Technology (Shandong Academy of Sciences), Jinan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0235-8642","authenticated-orcid":false,"given":"Lei","family":"Zhang","sequence":"additional","affiliation":[{"name":"Shandong Provincial Key Laboratory of Computer Networks, Shandong Computer Science Center (National Supercomputer Center in Jinan), Qilu University of Technology (Shandong Academy of Sciences), Jinan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8182-2852","authenticated-orcid":false,"given":"Zhen","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Artificial Intelligence, Optics and Electronics (iOPEN), Northwestern Polytechnical University, Shaanxi, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/2664243.2664277"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2010.2099234"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1016\/j.jprocont.2015.04.005"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/TSG.2013.2258948"},{"issue":"011","key":"ref5","first-page":"2532","article-title":"An industrial control system anomaly detection algorithm fusion by information flow and state flow","volume":"055","author":"Yang","year":"2018","journal-title":"J. Comput. Res. Develop."},{"issue":"1","key":"ref6","first-page":"127","article-title":"Anomaly detection algorithm in ics based on mixed-order markov tree model","volume":"46","author":"Zhang","year":"2020","journal-title":"Acta Automatica Sinica"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijcip.2018.06.003"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/2732198.2732200"},{"issue":"3","key":"ref9","first-page":"726","article-title":"Anomaly detection on industrial time series based on correlation analysis","volume":"31","author":"Ding","year":"2020","journal-title":"J. Softw."},{"key":"ref10","article-title":"C. G. P. O. Staff, Critical foundations: Protecting Americas infrastructures","author":"C","year":"1998"},{"key":"ref11","article-title":"W32.stuxnet dossier","volume-title":"Symantec Secur. Response","author":"Falliere","year":"2011"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/AINA.2010.86"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1016\/j.ress.2019.03.020"},{"key":"ref14","first-page":"127","article-title":"Using model-based intrusion detection for SCADA networks","volume-title":"Proc. SCADA Secur. Sci. Symp.","author":"Cheung","year":"2007"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/ecrime.2010.5706699"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/ETFA.2012.6489745"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/TSG.2011.2159406"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/TSMC.2015.2415763"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/PES.2007.386243"},{"issue":"02","key":"ref20","first-page":"124","article-title":"MODBUS\/TCP communication control method based on deep function code inspection","volume":"45","author":"Wan","year":"2016","journal-title":"Inf. Control"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.4028\/www.scientific.net\/AMM.490-491.1745"},{"issue":"07","key":"ref22","first-page":"8","article-title":"Intrusion detection method of RST-SVMfor abnormal behavior in industrial control network","volume":"32","author":"Zhang","year":"2018","journal-title":"J. Electron. Meas. Instrum."},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-14379-3_12"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/586110.586146"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2014.07.005"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2015.2512522"},{"key":"ref27","article-title":"PLC-SEIFF: A programmable logic controller security incident forensics framework based on automatic construction of security constraints","volume-title":"Comput. Secur.","volume":"92","author":"Xu","year":"2020"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/2516930.2516947"},{"key":"ref29","first-page":"797","article-title":"Anomaly-based intrusion detection for SCADA systems","volume-title":"Proc. 5th Int. Topical Meeting Nucl. Plant Instrum. Controls, Human Mach. Interface Technol., Albuquerque","author":"Yang","year":"2006"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-04798-5_10"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-88523-0_8"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/1966913.1966959"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/2381896.2381904"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijcip.2013.05.001"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijcip.2015.05.001"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-11212-1_23"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.03.007"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2013.184"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-46145-0_17"},{"key":"ref40","first-page":"1","article-title":"Deep autoencoding gaussian mixture model for unsupervised anomaly detection","volume-title":"Proc. 6th Int. Conf. Learn. Representations","author":"Zong","year":"2018"},{"key":"ref41","first-page":"1100","article-title":"Deep structured energy based models for anomaly detection","volume-title":"Proc. 33rd Int. Conf. Mach. Learn.","author":"Zhai","year":"2016"},{"key":"ref42","first-page":"89","article-title":"Long short term memory networks for anomaly detection in time series","volume-title":"Proc. 23rd Eur. Symp. Artif. Neural Netw. Comput. Intell. Mach. Learn.","author":"Malhotra","year":"2015"},{"key":"ref43","article-title":"LSTM-based encoder-decoder for multi-sensor anomaly detection","author":"Malhotra","year":"2016"}],"container-title":["IEEE Transactions on Network Science and Engineering"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6488902\/9740232\/09627525.pdf?arnumber=9627525","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,1,24]],"date-time":"2024-01-24T01:17:59Z","timestamp":1706059079000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9627525\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,3,1]]},"references-count":43,"journal-issue":{"issue":"2"},"URL":"https:\/\/doi.org\/10.1109\/tnse.2021.3130602","relation":{},"ISSN":["2327-4697","2334-329X"],"issn-type":[{"value":"2327-4697","type":"electronic"},{"value":"2334-329X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,3,1]]}}}