{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,30]],"date-time":"2026-04-30T05:36:56Z","timestamp":1777527416922,"version":"3.51.4"},"reference-count":35,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2024,1,14]],"date-time":"2024-01-14T00:00:00Z","timestamp":1705190400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"Project of Leading Talents in Science and Technology Innovation in Henan Province","award":["204200510021"],"award-info":[{"award-number":["204200510021"]}]},{"name":"Program for Henan Province Key Science and Technology","award":["222102210177, 222102210072, 212102210383"],"award-info":[{"award-number":["222102210177, 222102210072, 212102210383"]}]},{"name":"Henan Province University Key Scientific Research Project","award":["23A520008"],"award-info":[{"award-number":["23A520008"]}]},{"name":"Cloud Technology Endowed Professorship"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Cyber-Phys. Syst."],"published-print":{"date-parts":[[2024,1,31]]},"abstract":"<jats:p>Industrial Internet plays an important role in key critical infrastructure sectors and is the target of different security threats and risks. There are limitations in many existing attack detection approaches, such as function redundancy, overfitting, and low efficiency. A combinatorial optimization method\u2014Lagrange multiplier\u2014is designed to optimize the underlying feature screening algorithm. The optimized feature combination is fused with random forest and XG-Boost selected features to improve the accuracy and efficiency of attack feature analysis. Using both the UNSW-NB15 and natural gas pipeline datasets, we evaluate the performance of the proposed method. It is observed that the influence degrees of the different features associated with the attack behavior can result in the binary classification attack detection increasing to 0.93 and the attack detection time reducing by 6.96 times. The overall accuracy of multi-classification attack detection is also observed to improve by 0.11. We also observe that nine key features of attack behavior analysis are essential to the analysis and detection of general attacks targeting the system, and by focusing on these features one could potentially improve the effectiveness and efficiency of real-time critical industrial system security. In this article, the CICDDoS2019 and CICIDS2018 datasets are used to prove the generalization. The experimental results show that the proposed method has good generalization and can be extended to the same type of industrial anomaly datasets.<\/jats:p>","DOI":"10.1145\/3637554","type":"journal-article","created":{"date-parts":[[2023,12,16]],"date-time":"2023-12-16T06:58:29Z","timestamp":1702709909000},"page":"1-20","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":4,"title":["A Combinatorial Optimization Analysis Method for Detecting Malicious Industrial Internet Attack Behaviors"],"prefix":"10.1145","volume":"8","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6668-1625","authenticated-orcid":false,"given":"Kejing","family":"Zhao","sequence":"first","affiliation":[{"name":"Henan University of Science and Technology, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3061-7768","authenticated-orcid":false,"given":"Zhiyong","family":"Zhang","sequence":"additional","affiliation":[{"name":"Henan University of Science and Technology, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9208-5336","authenticated-orcid":false,"given":"Kim-Kwang","family":"Raymond Choo","sequence":"additional","affiliation":[{"name":"University of Texas at San Antonio, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5359-6248","authenticated-orcid":false,"given":"Zhongya","family":"Zhang","sequence":"additional","affiliation":[{"name":"Henan University of Science and Technology, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-3985-9994","authenticated-orcid":false,"given":"Tiantian","family":"Zhang","sequence":"additional","affiliation":[{"name":"Henan University of Science and Technology, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2024,1,14]]},"reference":[{"key":"e_1_3_1_2_2","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2013.211"},{"key":"e_1_3_1_3_2","doi-asserted-by":"publisher","DOI":"10.1145\/3569458"},{"key":"e_1_3_1_4_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSMC.2022.3189175"},{"key":"e_1_3_1_5_2","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2018.2802497"},{"key":"e_1_3_1_6_2","doi-asserted-by":"publisher","DOI":"10.13328\/j.cnki.jos.006062"},{"key":"e_1_3_1_7_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2019.2922958"},{"key":"e_1_3_1_8_2","doi-asserted-by":"publisher","DOI":"10.1145\/3579999"},{"key":"e_1_3_1_9_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2015.2443793"},{"key":"e_1_3_1_10_2","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2022.3157727"},{"key":"e_1_3_1_11_2","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.001.1800479"},{"key":"e_1_3_1_12_2","doi-asserted-by":"publisher","DOI":"10.7544\/issn1000-1239.20211152"},{"key":"e_1_3_1_13_2","doi-asserted-by":"publisher","DOI":"10.1109\/TCSS.2022.3180201"},{"key":"e_1_3_1_14_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jmsy.2022.05.005"},{"key":"e_1_3_1_15_2","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2021.3081741"},{"key":"e_1_3_1_16_2","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2018.2874896"},{"key":"e_1_3_1_17_2","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2020.2987688"},{"key":"e_1_3_1_18_2","doi-asserted-by":"publisher","DOI":"10.1145\/3364223"},{"issue":"2","key":"e_1_3_1_19_2","first-page":"69","article-title":"Traffic analysis based identification of attacks","volume":"5","author":"Novikov D.","year":"2008","unstructured":"D. Novikov, R. V. Yampolskiy, and L. Reznik. 2008. Traffic analysis based identification of attacks. Int. J. Comput. Sci. Appl. 5, 2 (Jan. 2008), 69\u201388.","journal-title":"Int. J. Comput. Sci. Appl."},{"key":"e_1_3_1_20_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2017.12.214"},{"key":"e_1_3_1_21_2","doi-asserted-by":"publisher","DOI":"10.1109\/IC2ECS57645.2022.10087960"},{"key":"e_1_3_1_22_2","doi-asserted-by":"publisher","DOI":"10.1109\/IPCCC47392.2019.8958717"},{"key":"e_1_3_1_23_2","doi-asserted-by":"publisher","DOI":"10.1109\/QRS-C.2019.00089"},{"key":"e_1_3_1_24_2","doi-asserted-by":"publisher","DOI":"10.1007\/s42979-021-00557-0"},{"key":"e_1_3_1_25_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.compind.2019.103165"},{"key":"e_1_3_1_26_2","doi-asserted-by":"publisher","DOI":"10.1155\/2021\/7154587"},{"key":"e_1_3_1_27_2","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2020.3032618"},{"key":"e_1_3_1_28_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2800287"},{"key":"e_1_3_1_29_2","doi-asserted-by":"publisher","DOI":"10.1145\/3460822"},{"key":"e_1_3_1_30_2","doi-asserted-by":"publisher","DOI":"10.1186\/s40537-021-00426-w"},{"key":"e_1_3_1_31_2","doi-asserted-by":"publisher","DOI":"10.1145\/3447548.3467159"},{"key":"e_1_3_1_32_2","doi-asserted-by":"publisher","DOI":"10.1145\/3561057"},{"key":"e_1_3_1_33_2","doi-asserted-by":"publisher","DOI":"10.1109\/TAC.2021.3131433"},{"key":"e_1_3_1_34_2","doi-asserted-by":"publisher","DOI":"10.1023\/A:1010933404324"},{"key":"e_1_3_1_35_2","doi-asserted-by":"publisher","DOI":"10.1145\/3444370.3444581"},{"key":"e_1_3_1_36_2","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2020.2987688"}],"container-title":["ACM Transactions on Cyber-Physical Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3637554","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3637554","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T00:04:24Z","timestamp":1750291464000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3637554"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,1,14]]},"references-count":35,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2024,1,31]]}},"alternative-id":["10.1145\/3637554"],"URL":"https:\/\/doi.org\/10.1145\/3637554","relation":{},"ISSN":["2378-962X","2378-9638"],"issn-type":[{"value":"2378-962X","type":"print"},{"value":"2378-9638","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,1,14]]},"assertion":[{"value":"2023-07-18","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-12-11","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-01-14","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}