{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,12]],"date-time":"2026-09-12T05:07:12Z","timestamp":1789189632942,"version":"build-2803163510"},"reference-count":26,"publisher":"MDPI AG","issue":"18","license":[{"start":{"date-parts":[[2026,9,10]],"date-time":"2026-09-10T00:00:00Z","timestamp":1788998400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100021171","name":"Guangdong Basic and Applied Basic Research Foundation","doi-asserted-by":"crossref","award":["2023A1515110877"],"award-info":[{"award-number":["2023A1515110877"]}],"id":[{"id":"10.13039\/501100021171","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100021171","name":"Guangdong Basic and Applied Basic Research Foundation","doi-asserted-by":"crossref","award":["2023A1515110414"],"award-info":[{"award-number":["2023A1515110414"]}],"id":[{"id":"10.13039\/501100021171","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100007129","name":"Shandong Provincial Natural Science Foundation","doi-asserted-by":"publisher","award":["ZR2026QC0818"],"award-info":[{"award-number":["ZR2026QC0818"]}],"id":[{"id":"10.13039\/501100007129","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Industrial cyber-physical systems face increasing security threats from sophisticated cyber attacks. Traditional anomaly detectors generally require exact system models and noise statistics, which are often unavailable in practical industrial environments. To address this, this paper proposes a data-driven security detection framework based on the quantification of differences in generalized models (DGM). Utilizing only accessible operational data from the control layer, the method employs closed-loop subspace orthogonal projections to construct two detection variables: a static innovation sequence estimator and an extended dynamic Markov matrix estimator. The static estimator identifies fundamental model mismatches caused by standard denial-of-service and essential false data injection attacks. Meanwhile, the dynamic estimator successfully captures the structural distortions induced by advanced stealthy attacks that typically deceive Kullback\u2013Leibler divergence detectors. The proposed methods were validated using a hardware-in-the-loop platform featuring a two degree-of-freedom robot and a DC servo motor. Experimental results confirm that the DGM framework effectively detects multiple types of stealthy integrity and availability (IA) attacks without relying on system parameters or degrading optimal control performance.<\/jats:p>","DOI":"10.3390\/s26185750","type":"journal-article","created":{"date-parts":[[2026,9,10]],"date-time":"2026-09-10T11:38:39Z","timestamp":1789040319000},"page":"5750","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Data-Driven Detection of Stealthy IA Attacks in Industrial Cyber-Physical Systems via DGM Quantification"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6394-7128","authenticated-orcid":false,"given":"Jingzhao","family":"Chen","sequence":"first","affiliation":[{"name":"Henan Engineering Research Center of Intelligent Manufacturing and Digital Twin, SIAS University, Zhengzhou 451150, China"},{"name":"Engineering Research Center of Metallurgical Automation and Measurement Technology, Ministry of Education, Wuhan University of Science and Technology, Wuhan 430081, China"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"conceptualization","vocabulary":"credit"},{"role":"methodology","vocabulary":"credit"},{"role":"software","vocabulary":"credit"},{"role":"validation","vocabulary":"credit"},{"role":"investigation","vocabulary":"credit"},{"role":"data-curation","vocabulary":"credit"},{"role":"writing-original-draft","vocabulary":"credit"},{"role":"visualization","vocabulary":"credit"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2372-9024","authenticated-orcid":false,"given":"Bin","family":"Liu","sequence":"additional","affiliation":[{"name":"Engineering Research Center of Metallurgical Automation and Measurement Technology, Ministry of Education, Wuhan University of Science and Technology, Wuhan 430081, China"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"conceptualization","vocabulary":"credit"},{"role":"methodology","vocabulary":"credit"},{"role":"investigation","vocabulary":"credit"},{"role":"resources","vocabulary":"credit"},{"role":"supervision","vocabulary":"credit"},{"role":"project-administration","vocabulary":"credit"},{"role":"funding-acquisition","vocabulary":"credit"}]},{"given":"Zhiqun","family":"Jiang","sequence":"additional","affiliation":[{"name":"Henan Engineering Research Center of Intelligent Manufacturing and Digital Twin, SIAS University, Zhengzhou 451150, China"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"software","vocabulary":"credit"},{"role":"validation","vocabulary":"credit"},{"role":"data-curation","vocabulary":"credit"},{"role":"visualization","vocabulary":"credit"}]}],"member":"1968","published-online":{"date-parts":[[2026,9,10]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"104095","DOI":"10.1016\/j.cose.2024.104095","article-title":"A new generation cyber-physical system: A comprehensive review from security perspective","volume":"148","author":"Rani","year":"2025","journal-title":"Comput. Secur."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"2335","DOI":"10.1007\/s10845-024-02380-9","article-title":"Cyber-physical systems: A bibliometric analysis of literature","volume":"36","author":"Singh","year":"2025","journal-title":"J. Intell. Manuf."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"334","DOI":"10.1049\/cps2.12095","article-title":"Joint safety and security risk analysis in industrial cyber-physical systems: A survey","volume":"9","author":"Sun","year":"2024","journal-title":"IET Cyber-Phys. Syst. Theory Appl."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"104056","DOI":"10.1016\/j.compind.2023.104056","article-title":"Integrated process safety and process security risk assessment of industrial cyber-physical systems in chemical plants","volume":"155","author":"Yuan","year":"2024","journal-title":"Comput. Ind."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"493","DOI":"10.1007\/s00521-021-06400-0","article-title":"Asset criticality and risk prediction for an effective cybersecurity risk management of cyber-physical system","volume":"34","author":"Kure","year":"2022","journal-title":"Neural Comput. Appl."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"100521","DOI":"10.1016\/j.ijcip.2022.100521","article-title":"APT attacks on industrial control systems: A tale of three incidents","volume":"37","author":"Kumar","year":"2022","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"68","DOI":"10.1080\/23738871.2025.2492570","article-title":"Stuxnet, revisited (again): Producing the strategic relevance of cyber operations","volume":"10","author":"Aanonsen","year":"2025","journal-title":"J. Cyber Policy"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Cervini, J., Rubin, A., and Watkins, L. (2022, January 17\u201318). Don\u2019t drink the cyber: Extrapolating the possibilities of Oldsmar\u2019s water treatment cyberattack. Proceedings of the International Conference on Cyber Warfare and Security, Albany, NY, USA.","DOI":"10.34190\/iccws.17.1.29"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"1686","DOI":"10.1109\/TDSC.2024.3451129","article-title":"An attack exploiting cyber-arm industry","volume":"22","author":"Gan","year":"2025","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"784","DOI":"10.1109\/JAS.2022.105548","article-title":"A survey of cyber attacks on cyber physical systems: Recent advances and challenges","volume":"9","author":"Duo","year":"2022","journal-title":"IEEE\/CAA J. Autom. Sin."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"21670","DOI":"10.1109\/JIOT.2023.3289625","article-title":"A survey on cyber-physical systems security","volume":"10","author":"Yu","year":"2023","journal-title":"IEEE Internet Things J."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"135","DOI":"10.1016\/j.automatica.2014.10.067","article-title":"A secure control framework for resource-limited adversaries","volume":"51","author":"Teixeira","year":"2015","journal-title":"Automatica"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"1471","DOI":"10.1109\/JIOT.2024.3495046","article-title":"A Survey on Cyber-Attacks for Cyber-Physical Systems: Modeling, Defense and Design","volume":"12","author":"Lian","year":"2025","journal-title":"IEEE Internet Things J."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"2763","DOI":"10.1109\/TIFS.2025.3546167","article-title":"Kullback-Liebler Divergence-Based Observer Design Against Sensor Bias Injection Attacks in Single-Output Systems","volume":"20","author":"Teixeira","year":"2025","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"1099","DOI":"10.1007\/s10207-023-00677-z","article-title":"Real-time detection of deception attacks in cyber-physical systems","volume":"22","author":"Cai","year":"2023","journal-title":"Int. J. Inf. Secur."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"2338","DOI":"10.1109\/TCYB.2019.2915124","article-title":"Summation detector for false data-injection attack in cyber-physical systems","volume":"50","author":"Ye","year":"2019","journal-title":"IEEE Trans. Cybern."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"1168","DOI":"10.1109\/TCST.2019.2903446","article-title":"False data injection attacks in bilateral teleoperation systems","volume":"28","author":"Dong","year":"2020","journal-title":"IEEE Trans. Control Syst. Technol."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"103609","DOI":"10.1016\/j.compind.2022.103609","article-title":"Mode division-based anomaly detection against integrity and availability attacks in industrial cyber-physical systems","volume":"137","author":"Liu","year":"2022","journal-title":"Comput. Ind."},{"key":"ref_19","first-page":"129615","article-title":"Quantized dissipative control for fuzzy hot strip mill cooling system under input constraint via dynamic output feedback approach","volume":"508","author":"Li","year":"2026","journal-title":"Appl. Math. Comput."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"5909","DOI":"10.1109\/TII.2026.3673218","article-title":"Fusion filtering for RIS-assisted vehicle localization with unknown inputs: A privacy-preserving output-mask strategy","volume":"22","author":"Zhu","year":"2026","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"804","DOI":"10.1109\/TAC.2013.2279896","article-title":"On the performance analysis of resilient networked control systems under replay attacks","volume":"59","author":"Zhu","year":"2021","journal-title":"IEEE Trans. Autom. Control"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"114","DOI":"10.1109\/JAS.2024.124815","article-title":"Detection of perfect stealthy attacks on cyber-physical systems subject to measurement quantizations: A watermark-based strategy","volume":"12","author":"Wang","year":"2025","journal-title":"IEEE\/CAA J. Autom. Sin."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"3895","DOI":"10.1109\/TAC.2020.2971994","article-title":"An online approach to physical watermark design","volume":"65","author":"Liu","year":"2020","journal-title":"IEEE Trans. Autom. Control"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Chen, J., Liu, B., Li, T., and Hu, Y. (2023). Multiplicative Attacks with Essential Stealthiness in Sensor and Actuator Loops against Cyber-Physical Systems. Sensors, 23.","DOI":"10.3390\/s23041957"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Liu, B., Chen, J., and Hu, Y. (2022, January 15\u201317). A Simple Approach to Data-driven Security Detection for Industrial Cyber-Physical Systems. Proceedings of the 34th Chinese Control and Decision Conference (CCDC), Hefei, China.","DOI":"10.1109\/CCDC55256.2022.10033885"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Chen, J., Fan, Y., and Li, T. (2024, January 28\u201331). QDGM: A Framework of Detection and Performance Evaluation for Industrial CPS Security. Proceedings of the 43rd Chinese Control Conference, Kunming, China.","DOI":"10.23919\/CCC63176.2024.10661768"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/18\/5750\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,12]],"date-time":"2026-09-12T04:29:03Z","timestamp":1789187343000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/18\/5750"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9,10]]},"references-count":26,"journal-issue":{"issue":"18","published-online":{"date-parts":[[2026,9]]}},"alternative-id":["s26185750"],"URL":"https:\/\/doi.org\/10.3390\/s26185750","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,10]]}}}