{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,28]],"date-time":"2026-07-28T14:15:04Z","timestamp":1785248104985,"version":"3.55.0"},"reference-count":36,"publisher":"MDPI AG","issue":"2","license":[{"start":{"date-parts":[[2023,1,17]],"date-time":"2023-01-17T00:00:00Z","timestamp":1673913600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Natural Science Foundation of Shandong Province","award":["ZR2021MF132"],"award-info":[{"award-number":["ZR2021MF132"]}]},{"name":"Natural Science Foundation of Shandong Province","award":["ZR2020YQ06"],"award-info":[{"award-number":["ZR2020YQ06"]}]},{"name":"Natural Science Foundation of Shandong Province","award":["2021KJ001"],"award-info":[{"award-number":["2021KJ001"]}]},{"name":"Natural Science Foundation of Shandong Province","award":["2022JBZ01-01"],"award-info":[{"award-number":["2022JBZ01-01"]}]},{"name":"Natural Science Foundation of Shandong Province","award":["2021RZB01002"],"award-info":[{"award-number":["2021RZB01002"]}]},{"name":"Natural Science Foundation of Shandong Province","award":["2022TSGC2098"],"award-info":[{"award-number":["2022TSGC2098"]}]},{"name":"Young innovation team of colleges and universities in Shandong province","award":["ZR2021MF132"],"award-info":[{"award-number":["ZR2021MF132"]}]},{"name":"Young innovation team of colleges and universities in Shandong province","award":["ZR2020YQ06"],"award-info":[{"award-number":["ZR2020YQ06"]}]},{"name":"Young innovation team of colleges and universities in Shandong province","award":["2021KJ001"],"award-info":[{"award-number":["2021KJ001"]}]},{"name":"Young innovation team of colleges and universities in Shandong province","award":["2022JBZ01-01"],"award-info":[{"award-number":["2022JBZ01-01"]}]},{"name":"Young innovation team of colleges and universities in Shandong province","award":["2021RZB01002"],"award-info":[{"award-number":["2021RZB01002"]}]},{"name":"Young innovation team of colleges and universities in Shandong province","award":["2022TSGC2098"],"award-info":[{"award-number":["2022TSGC2098"]}]},{"name":"Pilot Project for Integrated Innovation of Science, Education, and Industry of Qilu University of Technology (Shandong Academy of Sciences)","award":["ZR2021MF132"],"award-info":[{"award-number":["ZR2021MF132"]}]},{"name":"Pilot Project for Integrated Innovation of Science, Education, and Industry of Qilu University of Technology (Shandong Academy of Sciences)","award":["ZR2020YQ06"],"award-info":[{"award-number":["ZR2020YQ06"]}]},{"name":"Pilot Project for Integrated Innovation of Science, Education, and Industry of Qilu University of Technology (Shandong Academy of Sciences)","award":["2021KJ001"],"award-info":[{"award-number":["2021KJ001"]}]},{"name":"Pilot Project for Integrated Innovation of Science, Education, and Industry of Qilu University of Technology (Shandong Academy of Sciences)","award":["2022JBZ01-01"],"award-info":[{"award-number":["2022JBZ01-01"]}]},{"name":"Pilot Project for Integrated Innovation of Science, Education, and Industry of Qilu University of Technology (Shandong Academy of Sciences)","award":["2021RZB01002"],"award-info":[{"award-number":["2021RZB01002"]}]},{"name":"Pilot Project for Integrated Innovation of Science, Education, and Industry of Qilu University of Technology (Shandong Academy of Sciences)","award":["2022TSGC2098"],"award-info":[{"award-number":["2022TSGC2098"]}]},{"name":"Key R &amp; D plan of Shandong Province (Soft Science Project)","award":["ZR2021MF132"],"award-info":[{"award-number":["ZR2021MF132"]}]},{"name":"Key R &amp; D plan of Shandong Province (Soft Science Project)","award":["ZR2020YQ06"],"award-info":[{"award-number":["ZR2020YQ06"]}]},{"name":"Key R &amp; D plan of Shandong Province (Soft Science Project)","award":["2021KJ001"],"award-info":[{"award-number":["2021KJ001"]}]},{"name":"Key R &amp; D plan of Shandong Province (Soft Science Project)","award":["2022JBZ01-01"],"award-info":[{"award-number":["2022JBZ01-01"]}]},{"name":"Key R &amp; D plan of Shandong Province (Soft Science Project)","award":["2021RZB01002"],"award-info":[{"award-number":["2021RZB01002"]}]},{"name":"Key R &amp; D plan of Shandong Province (Soft Science Project)","award":["2022TSGC2098"],"award-info":[{"award-number":["2022TSGC2098"]}]},{"name":"Innovation Ability Promotion Project for Small- and Medium-Sized Technology-Based Enterprise of Shandong Province","award":["ZR2021MF132"],"award-info":[{"award-number":["ZR2021MF132"]}]},{"name":"Innovation Ability Promotion Project for Small- and Medium-Sized Technology-Based Enterprise of Shandong Province","award":["ZR2020YQ06"],"award-info":[{"award-number":["ZR2020YQ06"]}]},{"name":"Innovation Ability Promotion Project for Small- and Medium-Sized Technology-Based Enterprise of Shandong Province","award":["2021KJ001"],"award-info":[{"award-number":["2021KJ001"]}]},{"name":"Innovation Ability Promotion Project for Small- and Medium-Sized Technology-Based Enterprise of Shandong Province","award":["2022JBZ01-01"],"award-info":[{"award-number":["2022JBZ01-01"]}]},{"name":"Innovation Ability Promotion Project for Small- and Medium-Sized Technology-Based Enterprise of Shandong Province","award":["2021RZB01002"],"award-info":[{"award-number":["2021RZB01002"]}]},{"name":"Innovation Ability Promotion Project for Small- and Medium-Sized Technology-Based Enterprise of Shandong Province","award":["2022TSGC2098"],"award-info":[{"award-number":["2022TSGC2098"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Entropy"],"abstract":"<jats:p>Anomaly detection in multivariate time series is an important problem with applications in several domains. However, the key limitation of the approaches that have been proposed so far lies in the lack of a highly parallel model that can fuse temporal and spatial features. In this paper, we propose TDRT, a three-dimensional ResNet and transformer-based anomaly detection method. TDRT can automatically learn the multi-dimensional features of temporal\u2013spatial data to improve the accuracy of anomaly detection. Using the TDRT method, we were able to obtain temporal\u2013spatial correlations from multi-dimensional industrial control temporal\u2013spatial data and quickly mine long-term dependencies. We compared the performance of five state-of-the-art algorithms on three datasets (SWaT, WADI, and BATADAL). TDRT achieves an average anomaly detection F1 score higher than 0.98 and a recall of 0.98, significantly outperforming five state-of-the-art anomaly detection methods.<\/jats:p>","DOI":"10.3390\/e25020180","type":"journal-article","created":{"date-parts":[[2023,1,17]],"date-time":"2023-01-17T03:41:52Z","timestamp":1673926912000},"page":"180","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":16,"title":["A Three-Dimensional ResNet and Transformer-Based Approach to Anomaly Detection in Multivariate Temporal\u2013Spatial Data"],"prefix":"10.3390","volume":"25","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3386-4756","authenticated-orcid":false,"given":"Lijuan","family":"Xu","sequence":"first","affiliation":[{"name":"Shandong Provincial Key Laboratory of Computer Networks, Shandong Computer Science Center (National Supercomputer Center in Jinan), Qilu University of Technology (Shandong Academy of Sciences), Jinan 250014, China"},{"name":"Computer Science and Technology, Harbin Institute of Technology, Weihai 264209, China"},{"name":"Technology Research Institute of Cyberspace Security of Harbin Institute, Harbin 150001, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1459-7963","authenticated-orcid":false,"given":"Xiao","family":"Ding","sequence":"additional","affiliation":[{"name":"Shandong Provincial Key Laboratory of Computer Networks, Shandong Computer Science Center (National Supercomputer Center in Jinan), Qilu University of Technology (Shandong Academy of Sciences), Jinan 250014, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1812-1316","authenticated-orcid":false,"given":"Dawei","family":"Zhao","sequence":"additional","affiliation":[{"name":"Shandong Provincial Key Laboratory of Computer Networks, Shandong Computer Science Center (National Supercomputer Center in Jinan), Qilu University of Technology (Shandong Academy of Sciences), Jinan 250014, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Alex X.","family":"Liu","sequence":"additional","affiliation":[{"name":"Shandong Provincial Key Laboratory of Computer Networks, Shandong Computer Science Center (National Supercomputer Center in Jinan), Qilu University of Technology (Shandong Academy of Sciences), Jinan 250014, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhen","family":"Zhang","sequence":"additional","affiliation":[{"name":"Shandong Provincial Key Laboratory of Computer Networks, Shandong Computer Science Center (National Supercomputer Center in Jinan), Qilu University of Technology (Shandong Academy of Sciences), Jinan 250014, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2023,1,17]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"893","DOI":"10.1109\/TIFS.2015.2512522","article-title":"An efficient data-driven clustering technique to detect attacks in SCADA systems","volume":"11","author":"Almalawi","year":"2015","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Chen, Y.S., and Chen, Y.M. (2009, January 28). Combining incremental hidden Markov model and Adaboost algorithm for anomaly intrusion detection. Proceedings of the ACM SIGKDD Workshop on Cybersecurity and Intelligence Informatics, Paris, France.","DOI":"10.1145\/1599272.1599276"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Du, M., Li, F., Zheng, G., and Srikumar, V. (November, January 30). Deeplog: Anomaly detection and diagnosis from system logs through deep learning. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, Dallas, TX, USA.","DOI":"10.1145\/3133956.3134015"},{"key":"ref_4","first-page":"13016","article-title":"Timeseries anomaly detection using temporal hierarchical one-class network","volume":"33","author":"Shen","year":"2020","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Audibert, J., Michiardi, P., Guyard, F., Marti, S., and Zuluaga, M.A. (2020, January 23\u201327). Usad: Unsupervised anomaly detection on multivariate time series. Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, Virtual Event, CA, USA.","DOI":"10.1145\/3394486.3403392"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Mathur, A.P., and Tippenhauer, N.O. (2016, January 11). SWaT: A water treatment testbed for research and training on ICS security. Proceedings of the 2016 International Workshop on Cyber-Physical Systems for Smart Water Networks (CySWater), Vienna, Austria.","DOI":"10.1109\/CySWater.2016.7469060"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"101749","DOI":"10.1016\/j.cose.2020.101749","article-title":"PLC-SEIFF: A programmable logic controller security incident forensics framework based on automatic construction of security constraints","volume":"92","author":"Xu","year":"2020","journal-title":"Comput. Secur."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"703","DOI":"10.1109\/TNSE.2021.3130602","article-title":"Detecting Semantic Attack in SCADA System: A Behavioral Model Based on Secondary Labeling of States-Duration Evolution Graph","volume":"9","author":"Xu","year":"2021","journal-title":"IEEE Trans. Netw. Sci. Eng."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Kravchik, M., and Shabtai, A. (2018, January 19). Detecting cyber attacks in industrial control systems using convolutional neural networks. Proceedings of the 2018 Workshop on Cyber-Physical Systems Security and Privacy, Toronto, ON, Canada.","DOI":"10.1145\/3264888.3264896"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"1755","DOI":"10.1109\/TIFS.2018.2885254","article-title":"Virus propagation and patch distribution in multiplex networks: Modeling, analysis, and optimal allocation","volume":"14","author":"Zhao","year":"2018","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_11","unstructured":"Sipple, J. (2020, January 13\u201318). Interpretable, multidimensional, multimodal anomaly detection with negative sampling for detection of device failure. Proceedings of the International Conference on Machine Learning. PMLR, Virtual Event."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"1455","DOI":"10.1109\/TIFS.2019.2940890","article-title":"Temporal execution behavior for host anomaly detection in programmable logic controllers","volume":"15","author":"Formby","year":"2019","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"2157","DOI":"10.1109\/TIFS.2021.3050605","article-title":"Random partitioning forest for point-wise and collective anomaly detection\u2014application to network intrusion detection","volume":"16","author":"Marteau","year":"2021","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Siffer, A., Fouque, P.A., Termier, A., and Largouet, C. (2017, January 13\u201317). Anomaly detection in streams with extreme value theory. Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Halifax, NS, Canada.","DOI":"10.1145\/3097983.3098144"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Yoon, S., Lee, J.G., and Lee, B.S. (2020, January 6\u201310). Ultrafast local outlier detection from a data stream with stationary region skipping. Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, Virtual Event.","DOI":"10.1145\/3394486.3403171"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Song, H., Li, P., and Liu, H. (2021, January 14\u201318). Deep Clustering based Fair Outlier Detection. Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, Singapore.","DOI":"10.1145\/3447548.3467225"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Su, Y., Zhao, Y., Niu, C., Liu, R., Sun, W., and Pei, D. (2019, January 4\u20138). Robust anomaly detection for multivariate time series through stochastic recurrent neural network. Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, Anchorage, AK, USA.","DOI":"10.1145\/3292500.3330672"},{"key":"ref_18","unstructured":"Ester, M., Kriegel, H.P., Sander, J., and Xu, X. (1996, January 2). A density-based algorithm for discovering clusters in large spatial databases with noise. Proceedings of the KDD, Portland, Oregon."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Paparrizos, J., and Gravano, L. (June, January 31). k-shape: Efficient and accurate clustering of time series. Proceedings of the 2015 ACM SIGMOD International Conference on Management of Data, Victoria, Australia.","DOI":"10.1145\/2723372.2737793"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"1717","DOI":"10.14778\/3467861.3467863","article-title":"SAND: Streaming subsequence anomaly detection","volume":"14","author":"Boniol","year":"2021","journal-title":"Proc. VLDB Endow."},{"key":"ref_21","first-page":"2316","article-title":"Architectures for detecting interleaved multi-stage network attacks using hidden Markov models","volume":"18","author":"Shawly","year":"2019","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_22","first-page":"1136","article-title":"Multi-view anomaly detection via robust probabilistic latent variable models","volume":"29","author":"Iwata","year":"2016","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Melnyk, I., Banerjee, A., Matthews, B., and Oza, N. (2016, January 13\u201317). Semi-Markov switching vector autoregressive model-based anomaly detection in aviation systems. Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, San Francisco, CA, USA.","DOI":"10.1145\/2939672.2939789"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"3538","DOI":"10.1109\/TIFS.2021.3083422","article-title":"Conditional variational auto-encoder and extreme value theory aided two-stage learning approach for intelligent fine-grained known\/unknown intrusion detection","volume":"16","author":"Yang","year":"2021","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_25","first-page":"2333","article-title":"Multi-Mode Attack Detection and Evaluation of Abnormal States for Industrial Control Network","volume":"11","author":"Xu","year":"2021","journal-title":"Comput. Res. Dev."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"3540","DOI":"10.1109\/TIFS.2020.2991876","article-title":"A method of few-shot network intrusion detection based on meta-learning framework","volume":"15","author":"Xu","year":"2020","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Li, Z., Zhao, Y., Han, J., Su, Y., Jiao, R., Wen, X., and Pei, D. (2021, January 14\u201318). Multivariate time series anomaly detection and interpretation using hierarchical inter-metric and temporal embedding. Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, Singapore.","DOI":"10.1145\/3447548.3467075"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Du, M., Chen, Z., Liu, C., Oak, R., and Song, D. (2019, January 11\u201315). Lifelong anomaly detection through unlearning. Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, London, UK.","DOI":"10.1145\/3319535.3363226"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Zerveas, G., Jayaraman, S., Patel, D., Bhamidipaty, A., and Eickhoff, C. (2021, January 14\u201318). A transformer-based framework for multivariate time series representation learning. Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, Singapore.","DOI":"10.1145\/3447548.3467401"},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Zhang, X., Gao, Y., Lin, J., and Lu, C.T. (2020, January 7\u201312). Tapnet: Multivariate time series classification with attentional prototypical network. Proceedings of the AAAI Conference on Artificial Intelligence, New York, NY, USA.","DOI":"10.1609\/aaai.v34i04.6165"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Li, D., Chen, D., Jin, B., Shi, L., Goh, J., and Ng, S.K. (2019, January 17\u201319). MAD-GAN: Multivariate anomaly detection for time series data with generative adversarial networks. Proceedings of the International Conference on Artificial Neural Networks, Munich, Germany.","DOI":"10.1007\/978-3-030-30490-4_56"},{"key":"ref_32","unstructured":"Chen, W., Tian, L., Chen, B., Dai, L., Duan, Z., and Zhou, M. (2022, January 17\u201323). Deep Variational Graph Convolutional Recurrent Network for Multivariate Time Series Anomaly Detection. Proceedings of the International Conference on Machine Learning. PMLR, Baltimore, MA, USA."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Tuli, S., Casale, G., and Jennings, N.R. (2022). TranAD: Deep transformer networks for anomaly detection in multivariate time series data. arXiv.","DOI":"10.14778\/3514061.3514067"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Han, S., and Woo, S.S. (2022, January 14\u201318). Learning Sparse Latent Graph Representations for Anomaly Detection in Multivariate Time Series. Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Washington, DC, USA.","DOI":"10.1145\/3534678.3539117"},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"2179","DOI":"10.1109\/TDSC.2021.3050101","article-title":"Efficient cyber attack detection in industrial control systems using lightweight neural networks and pca","volume":"19","author":"Kravchik","year":"2021","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Feng, C., and Tian, P. (2021, January 14\u201318). Time series anomaly detection for cyber-physical systems via neural system identification and bayesian filtering. Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, Singapore.","DOI":"10.1145\/3447548.3467137"}],"container-title":["Entropy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1099-4300\/25\/2\/180\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T18:08:01Z","timestamp":1760119681000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1099-4300\/25\/2\/180"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,1,17]]},"references-count":36,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2023,2]]}},"alternative-id":["e25020180"],"URL":"https:\/\/doi.org\/10.3390\/e25020180","relation":{},"ISSN":["1099-4300"],"issn-type":[{"value":"1099-4300","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,1,17]]}}}