{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T00:05:09Z","timestamp":1782950709114,"version":"3.54.5"},"reference-count":22,"publisher":"MDPI AG","issue":"18","license":[{"start":{"date-parts":[[2024,9,23]],"date-time":"2024-09-23T00:00:00Z","timestamp":1727049600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Anomaly detection in industrial control system (ICS) data is one of the key technologies for ensuring the security monitoring of ICSs. ICS data are characterized as complex, multi-dimensional, and long-sequence time-series data that embody ICS business logic. Due to its complex and varying periodic characteristics, as well as the presence of long-distance and misaligned temporal associations among features, current anomaly detection methods in ICS are insufficient for feature extraction. This paper proposes an anomaly detection method named TFANet, based on time\u2013frequency fusion feature attention encoding. Considering that periodic variations are more concentrated in the frequency domain, this method first transforms the time-domain data into the frequency domain, obtaining both amplitude and phase data. Then, these data, together with the original time-series data, are used to extract features from two perspectives: long-term temporal changes and long-distance associations. Finally, the six features learned from both the time and frequency domains are fused, and the feature weights are calculated using an attention mechanism to complete the anomaly classification. In multi-classification tasks on three ICS datasets, the proposed method outperforms three popular time-series models\u2014iTransformer, Crossformer, and TimesNet\u2014across five metrics: accuracy, precision, recall, F1 score, and AUC-ROC, with average improvements of approximately 19%, 37%, 31%, 35%, and 22%, respectively.<\/jats:p>","DOI":"10.3390\/s24186131","type":"journal-article","created":{"date-parts":[[2024,9,24]],"date-time":"2024-09-24T08:56:06Z","timestamp":1727168166000},"page":"6131","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":9,"title":["Anomaly Detection Method for Industrial Control System Operation Data Based on Time\u2013Frequency Fusion Feature Attention Encoding"],"prefix":"10.3390","volume":"24","author":[{"given":"Jiayi","family":"Liu","sequence":"first","affiliation":[{"name":"Information Engineering College, Beijing Institute of Petrochemical Technology, Beijing 102617, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yun","family":"Sha","sequence":"additional","affiliation":[{"name":"Information Engineering College, Beijing Institute of Petrochemical Technology, Beijing 102617, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wenchang","family":"Zhang","sequence":"additional","affiliation":[{"name":"Information Engineering College, Beijing Institute of Petrochemical Technology, Beijing 102617, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yong","family":"Yan","sequence":"additional","affiliation":[{"name":"Information Engineering College, Beijing Institute of Petrochemical Technology, Beijing 102617, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xuejun","family":"Liu","sequence":"additional","affiliation":[{"name":"Information Engineering College, Beijing Institute of Petrochemical Technology, Beijing 102617, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2024,9,23]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Whitehead, D.E., Owens, K., Gammel, D., and Smith, J. (2017, January 3\u20136). Ukraine cyber-induced power outage: Analysis and practical mitigation strategies. Proceedings of the 2017 70th Annual Conference for Protective Relay Engineers (CPRE), College Station, TX, USA.","DOI":"10.1109\/CPRE.2017.8090056"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Sanchez, E.H., Serrurier, M., and Ortner, M. (2019, January 16\u201320). Learning disentangled representations of satellite image time series. Proceedings of the European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases (ECMLPKDD), W\u00fcrzburg, Germany.","DOI":"10.1007\/978-3-030-46133-1_19"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"17","DOI":"10.1016\/j.ins.2020.12.062","article-title":"A deep multi-task representation learning method for time series classification and retrieval","volume":"555","author":"Chen","year":"2021","journal-title":"Inf. Sci."},{"key":"ref_4","unstructured":"Franceschi, J.Y., Dieuleveut, A., and Jaggi, M. (2019). Unsupervised scalable representation learning for multivariate time series. Adv. Neural Inf. Process. Syst., 32."},{"key":"ref_5","unstructured":"Yang, L., and Hong, S. (2022, January 17\u201323). Unsupervised time-series representation learning with iterative bilinear temporal-spectral fusion. Proceedings of the International Conference on Machine Learning (ICML), Baltimore, MD, USA."},{"key":"ref_6","unstructured":"Fraikin, A., Bennetot, A., and Allassonni\u00e8re, S. (2023). T-Rep: Representation Learning for Time Series using Time-Embeddings. arXiv."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Lea, C., Flynn, M.D., Vidal, R., Reiter, A., and Hager, G.D. (2017, January 21\u201326). Temporal convolutional networks for action segmentation and detection. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Honolulu, HI, USA.","DOI":"10.1109\/CVPR.2017.113"},{"key":"ref_8","unstructured":"Tonekaboni, S., Li, C.L., Arik, S.O., Goldenberg, A., and Pfister, T. (2022, January 28\u201330). Decoupling local and global representations of time series. Proceedings of the International Conference on Artificial Intelligence and Statistics (AISTATS), Virtual Conference."},{"key":"ref_9","unstructured":"Li, Z., Rao, Z., Pan, L., Wang, P., and Xu, Z. (2023). Ti-mae: Self-supervised masked time series autoencoders. arXiv."},{"key":"ref_10","unstructured":"Dong, J., Wu, H., Zhang, H., Zhang, L., Wang, J., and Long, M. (2024). Simmtm: A simple pre-training framework for masked time-series modeling. Adv. Neural Inf. Process. Syst., 36."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Eldele, E., Ragab, M., Chen, Z., Wu, M., Kwoh, C.K., Li, X., and Guan, C. (2021). Time-series representation learning via temporal and contextual contrasting. arXiv.","DOI":"10.24963\/ijcai.2021\/324"},{"key":"ref_12","unstructured":"Tonekaboni, S., Eytan, D., and Goldenberg, A. (2021). Unsupervised representation learning for time series with temporal neighborhood coding. arXiv."},{"key":"ref_13","unstructured":"Liu, Y., Hu, T., Zhang, H., Wu, H., Wang, S., Ma, L., and Long, M. (2023). itransformer: Inverted transformers are effective for time series forecasting. arXiv."},{"key":"ref_14","unstructured":"Wu, H., Hu, T., Liu, Y., Zhou, H., Wang, J., and Long, M. (2022). Timesnet: Temporal 2d-variation modeling for general time series analysis. arXiv."},{"key":"ref_15","unstructured":"Zhang, Y., and Yan, J. (2023, January 1\u20135). Crossformer: Transformer utilizing cross-dimension dependency for multivariate time series forecasting. Proceedings of the 11th International Conference on Learning Representations (ICLR), Kigali, Rwanda."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"6457","DOI":"10.1109\/TII.2023.3347000","article-title":"Graph Structure Change-Based Anomaly Detection in Multivariate Time Series of Industrial Processes","volume":"20","author":"Zhang","year":"2024","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_17","unstructured":"Chen, K., Feng, M., and Wirjanto, T.S. (2023). Multivariate time series anomaly detection via dynamic graph forecasting. arXiv."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Zambon, D., Livi, L., and Alippi, C. (2022, January 18\u201323). Graph iForest: Isolation of anomalous and outlier graphs. Proceedings of the International Joint Conference on Neural Networks (IJCNN), Padua, Italy.","DOI":"10.1109\/IJCNN55064.2022.9892295"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"40967","DOI":"10.1109\/ACCESS.2022.3167640","article-title":"Hybrid anomaly detection via multihead dynamic graph attention networks for multivariate time series","volume":"10","author":"Zhou","year":"2022","journal-title":"IEEE Access"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Srinivas, S.S., Sarkar, R.K., and Runkana, V. (2022, January 13\u201316). Hypergraph Learning based Recommender System for Anomaly Detection, Control and Optimization. Proceedings of the IEEE International Conference on Big Data (Big Data), Kyoto, Japan.","DOI":"10.1109\/BigData55660.2022.10020888"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Goh, J., Adepu, S., Junejo, K.N., and Mathur, A. (2016, January 10\u201312). A dataset to support research in the design of secure water treatment systems. Proceedings of the Critical Information Infrastructures Security (CRITIS), Paris, France.","DOI":"10.1007\/978-3-319-71368-7_8"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Charilaou, C., Ioannou, C.I.C., and Vassiliou, V. (2022, January 1\u20133). System for operational technology attack detection in industrial IoT. Proceedings of the Mediterranean Communication and Computer Networking Conference (MedComNet), Paphos, Cyprus.","DOI":"10.1109\/MedComNet55087.2022.9810446"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/24\/18\/6131\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T16:02:39Z","timestamp":1760112159000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/24\/18\/6131"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,9,23]]},"references-count":22,"journal-issue":{"issue":"18","published-online":{"date-parts":[[2024,9]]}},"alternative-id":["s24186131"],"URL":"https:\/\/doi.org\/10.3390\/s24186131","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,9,23]]}}}