{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T22:46:19Z","timestamp":1784241979236,"version":"3.55.0"},"reference-count":32,"publisher":"MDPI AG","issue":"20","license":[{"start":{"date-parts":[[2023,10,12]],"date-time":"2023-10-12T00:00:00Z","timestamp":1697068800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"National Natural Science Foundation of China","award":["62072319"],"award-info":[{"award-number":["62072319"]}]},{"name":"National Natural Science Foundation of China","award":["2023YFQ0022"],"award-info":[{"award-number":["2023YFQ0022"]}]},{"name":"National Natural Science Foundation of China","award":["2022YFG0041"],"award-info":[{"award-number":["2022YFG0041"]}]},{"name":"National Natural Science Foundation of China","award":["2022CDLZ-6"],"award-info":[{"award-number":["2022CDLZ-6"]}]},{"name":"Sichuan Science and Technology Program","award":["62072319"],"award-info":[{"award-number":["62072319"]}]},{"name":"Sichuan Science and Technology Program","award":["2023YFQ0022"],"award-info":[{"award-number":["2023YFQ0022"]}]},{"name":"Sichuan Science and Technology Program","award":["2022YFG0041"],"award-info":[{"award-number":["2022YFG0041"]}]},{"name":"Sichuan Science and Technology Program","award":["2022CDLZ-6"],"award-info":[{"award-number":["2022CDLZ-6"]}]},{"name":"Luzhou Science and Technology Innovation R&amp;D Program","award":["62072319"],"award-info":[{"award-number":["62072319"]}]},{"name":"Luzhou Science and Technology Innovation R&amp;D Program","award":["2023YFQ0022"],"award-info":[{"award-number":["2023YFQ0022"]}]},{"name":"Luzhou Science and Technology Innovation R&amp;D Program","award":["2022YFG0041"],"award-info":[{"award-number":["2022YFG0041"]}]},{"name":"Luzhou Science and Technology Innovation R&amp;D Program","award":["2022CDLZ-6"],"award-info":[{"award-number":["2022CDLZ-6"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>With the gradual integration of internet technology and the industrial control field, industrial control systems (ICSs) have begun to access public networks on a large scale. Attackers use these public network interfaces to launch frequent invasions of industrial control systems, thus resulting in equipment failure and downtime, production data leakage, and other serious harm. To ensure security, ICSs urgently need a mature intrusion detection mechanism. Most of the existing research on intrusion detection in ICSs focuses on improving the accuracy of intrusion detection, thereby ignoring the problem of limited equipment resources in industrial control environments, which makes it difficult to apply excellent intrusion detection algorithms in practice. In this study, we first use the spectral residual (SR) algorithm to process the data; we then propose the improved lightweight variational autoencoder (LVA) with autoregression to reconstruct the data, and we finally perform anomaly determination based on the permutation entropy (PE) algorithm. We construct a lightweight unsupervised intrusion detection model named LVA-SP. The model as a whole adopts a lightweight design with a simpler network structure and fewer parameters, which achieves a balance between the detection accuracy and the system resource overhead. Experimental results on the ICSs dataset show that our proposed LVA-SP model achieved an F1-score of 84.81% and has advantages in terms of time and memory overhead.<\/jats:p>","DOI":"10.3390\/s23208407","type":"journal-article","created":{"date-parts":[[2023,10,12]],"date-time":"2023-10-12T03:14:32Z","timestamp":1697080472000},"page":"8407","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":11,"title":["A Lightweight Unsupervised Intrusion Detection Model Based on Variational Auto-Encoder"],"prefix":"10.3390","volume":"23","author":[{"given":"Yi","family":"Ren","sequence":"first","affiliation":[{"name":"School of Computer Science, Sichuan University, Chengdu 610065, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kanghui","family":"Feng","sequence":"additional","affiliation":[{"name":"School of Computer Science, Sichuan University, Chengdu 610065, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Fei","family":"Hu","sequence":"additional","affiliation":[{"name":"School of Computer Science, Sichuan University, Chengdu 610065, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6166-890X","authenticated-orcid":false,"given":"Liangyin","family":"Chen","sequence":"additional","affiliation":[{"name":"School of Computer Science, Sichuan University, Chengdu 610065, China"},{"name":"Institute for Industrial Internet Research, Sichuan University, Chengdu 610065, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yanru","family":"Chen","sequence":"additional","affiliation":[{"name":"School of Computer Science, Sichuan University, Chengdu 610065, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2023,10,12]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.icte.2018.01.002","article-title":"FPGA-based network intrusion detection for IEC 61850-based industrial network","volume":"4","author":"Kim","year":"2018","journal-title":"ICT Express"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Vollmer, T., Alves-Foss, J., and Manic, M. (2011, January 11\u201315). Autonomous rule creation for intrusion detection. Proceedings of the 2011 IEEE Symposium on Computational Intelligence in Cyber Security (CICS), Paris, France.","DOI":"10.1109\/CICYBS.2011.5949394"},{"key":"ref_3","unstructured":"Denning, D., and Neumann, P.G. (1985). Requirements and Model for IDES-a Real-Time Intrusion-Detection Expert System, SRI International Menlo Park."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"810","DOI":"10.1109\/TC.2002.1017701","article-title":"Multivariate statistical analysis of audit trails for host-based intrusion detection","volume":"51","author":"Ye","year":"2002","journal-title":"IEEE Trans. Comput."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Estevez-Tapiador, J.M., Garcia-Teodoro, P., and Diaz-Verdejo, J.E. (2003, January 24). Stochastic protocol modeling for anomaly based network intrusion detection. Proceedings of the First IEEE International Workshop on Information Assurance, 2003. IWIAS 2003. Proceedings, Darmstadt, Germany.","DOI":"10.1109\/IWIAS.2003.1192454"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"352","DOI":"10.1504\/IJES.2019.099440","article-title":"IBBO-LSSVM-based network anomaly intrusion detection","volume":"11","author":"Zhou","year":"2019","journal-title":"Int. J. Embed. Syst."},{"key":"ref_7","first-page":"2125","article-title":"An intrusion detection model based on IPSO-SVM algorithm in wireless sensor network","volume":"19","author":"Liu","year":"2018","journal-title":"J. Internet Technol."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"6273","DOI":"10.1109\/JIOT.2020.3004469","article-title":"Industrial security solution for virtual reality","volume":"8","author":"Lv","year":"2020","journal-title":"IEEE Internet Things J."},{"key":"ref_9","first-page":"1","article-title":"APT attack detection algorithm based on spatio-temporal association analysis in industrial network","volume":"45","author":"Wang","year":"2020","journal-title":"J. Ambient. Intell. Humaniz. Comput."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3460976","article-title":"Extending isolation forest for anomaly detection in big data via K-means","volume":"5","author":"Laskar","year":"2021","journal-title":"ACM Trans. Cyber-Phys. Syst. (TCPS)"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Chang, C.P., Hsu, W.C., and Liao, I.E. (2019, January 19\u201321). Anomaly detection for industrial control systems using k-means and convolutional autoencoder. Proceedings of the 2019 International Conference on Software, Telecommunications and Computer Networks (SoftCOM), Split, Croatia.","DOI":"10.23919\/SOFTCOM.2019.8903886"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"5615","DOI":"10.1109\/TII.2020.3023430","article-title":"DeepFed: Federated deep learning for intrusion detection in industrial cyber\u2013physical systems","volume":"17","author":"Li","year":"2020","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"5790","DOI":"10.1109\/TII.2020.3047675","article-title":"Siamese neural network based few-shot learning for anomaly detection in industrial cyber-physical systems","volume":"17","author":"Zhou","year":"2020","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"103266","DOI":"10.1016\/j.jnca.2021.103266","article-title":"RANet: Network intrusion detection with group-gating convolutional neural network","volume":"198","author":"Zhang","year":"2022","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"F\u00e4hrmann, D., Damer, N., Kirchbuchner, F., and Kuijper, A. (2022). Lightweight long short-term memory variational auto-encoder for multivariate time series anomaly detection in industrial control systems. Sensors, 22.","DOI":"10.3390\/s22082886"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Li, D., Chen, D., Jin, B., Shi, L., Goh, J., and Ng, S.K. (2019, January 17\u201319). MAD-GAN: Multivariate anomaly detection for time series data with generative adversarial networks. Proceedings of the International Conference on Artificial Neural Networks, Munich, Germany.","DOI":"10.1007\/978-3-030-30490-4_56"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Chen, X., Deng, L., Huang, F., Zhang, C., Zhang, Z., Zhao, Y., and Zheng, K. (2021, January 19\u201322). Daemon: Unsupervised anomaly detection and interpretation for multivariate time series. Proceedings of the 2021 IEEE 37th International Conference on Data Engineering (ICDE), Chania, Greece.","DOI":"10.1109\/ICDE51399.2021.00228"},{"key":"ref_18","unstructured":"Audibert, J., Michiardi, P., Guyard, F., Marti, S., and Zuluaga, M.A. (2020, January 6\u201310). Usad: Unsupervised anomaly detection on multivariate time series. Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, Virtual Event."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Su, Y., Zhao, Y., Niu, C., Liu, R., Sun, W., and Pei, D. (2019, January 4\u20138). Robust anomaly detection for multivariate time series through stochastic recurrent neural network. Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, Anchorage, AK, USA.","DOI":"10.1145\/3292500.3330672"},{"key":"ref_20","unstructured":"Goh, J., Adepu, S., Junejo, K.N., and Mathur, A. (2016, January 10\u201312). A dataset to support research in the design of secure water treatment systems. Proceedings of the Critical Information Infrastructures Security: 11th International Conference, CRITIS 2016, Paris, France. Revised Selected Papers 11."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Liao, J., Duan, H., Feng, K., Zhao, W., Yang, Y., and Chen, L. (2023, January 18\u201322). A Light Weight Model for Active Speaker Detection. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Vancouver, BC, Canada.","DOI":"10.1109\/CVPR52729.2023.02196"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Hou, X., and Zhang, L. (2007, January 17\u201322). Saliency detection: A spectral residual approach. Proceedings of the 2007 IEEE Conference on Computer Vision and Pattern Recognition, Minneapolis, MN, USA.","DOI":"10.1109\/CVPR.2007.383267"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"1235","DOI":"10.1162\/neco_a_01199","article-title":"A review of recurrent neural networks: LSTM cells and network architectures","volume":"31","author":"Yu","year":"2019","journal-title":"Neural Comput."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Lai, G., Chang, W.C., Yang, Y., and Liu, H. (2018, January 8\u201312). Modeling long-and short-term temporal patterns with deep neural networks. Proceedings of the 41st International ACM SIGIR Conference on Research & Development in Information Retrieval, Anchorage, AK, USA.","DOI":"10.1145\/3209978.3210006"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"226","DOI":"10.1007\/s11633-016-1006-2","article-title":"Minimal gated unit for recurrent neural networks","volume":"13","author":"Zhou","year":"2016","journal-title":"Int. J. Autom. Comput."},{"key":"ref_26","first-page":"5443","article-title":"Posterior collapse and latent variable non-identifiability","volume":"34","author":"Wang","year":"2021","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_27","unstructured":"Bengio, Y., L\u00e9onard, N., and Courville, A. (2013). Estimating or propagating gradients through stochastic neurons for conditional computation. arXiv."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Ferreira, D.R., Scholz, T., and Prytz, R. (2020, January 19\u201323). Importance weighting of diagnostic trouble codes for anomaly detection. Proceedings of the Machine Learning, Optimization, and Data Science: 6th International Conference, LOD 2020, Siena, Italy. Revised Selected Papers; Part I 6.","DOI":"10.1007\/978-3-030-64583-0_37"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"2617","DOI":"10.1080\/01431161.2022.2061876","article-title":"Hyperspectral anomaly detection based on adaptive weighting method combined with autoencoder and convolutional neural network","volume":"43","author":"Hou","year":"2022","journal-title":"Int. J. Remote Sens."},{"key":"ref_30","unstructured":"Zimmerer, D., Kohl, S.A., Petersen, J., Isensee, F., and Maier-Hein, K.H. (2018). Context-encoding variational autoencoder for unsupervised anomaly detection. arXiv."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"174102","DOI":"10.1103\/PhysRevLett.88.174102","article-title":"Permutation entropy: A natural complexity measure for time series","volume":"88","author":"Bandt","year":"2002","journal-title":"Phys. Rev. Lett."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"2179","DOI":"10.1109\/TDSC.2021.3050101","article-title":"Efficient cyber attack detection in industrial control systems using lightweight neural networks and pca","volume":"19","author":"Kravchik","year":"2021","journal-title":"IEEE Trans. Dependable Secur. Comput."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/23\/20\/8407\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T21:05:23Z","timestamp":1760130323000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/23\/20\/8407"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,10,12]]},"references-count":32,"journal-issue":{"issue":"20","published-online":{"date-parts":[[2023,10]]}},"alternative-id":["s23208407"],"URL":"https:\/\/doi.org\/10.3390\/s23208407","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,10,12]]}}}