The technique, which the researchers call ICS-Sniper, targets facilities that communicate with cloud-hosted monitoring and control systems over encrypted connections. To mount the attack, an adversary would first need to compromise a router carrying traffic between the facility and the cloud. From that vantage point, the attacker cannot read the messages, but can observe metadata such as the timing and size of each digital transmission. By analyzing these everyday traffic patterns, the attacker can identify when critical commands or data are likely to be transmitted, even while the actual contents remain completely hidden.

Industrial control systems rely on computers to run physical machinery such as pumps, valves and generators. Unlike attacks that compromise equipment inside a plant or overwhelm a network with indiscriminate traffic, ICS-Sniper uses patterns in encrypted communications to predict critical moments and then selectively block only a small fraction of messages. This surgical approach allows it to disrupt operations without ever entering the plant’s own systems, and it allowed the attack to evade the detectors that the researchers tested against it during their experiments.

Dr. Aastha Mehta, a UBC computer science professor who leads the Principled Systems Security Group and is a co-investigator on the project, explained the core of the problem. What makes the attack concerning, she said, is that an attacker does not need to read the messages being exchanged. Even when the contents are encrypted, patterns in the communication can reveal enough information to identify and target critical communications. In other words, the metadata that encryption protocols deliberately expose becomes a roadmap for sabotage.

The researchers chose the name ICS-Sniper because, like a sniper, the attack framework can selectively target critical communications with a small footprint. Rather than flooding a network with junk traffic or deploying malware inside a facility, the attacker waits, observes and fires at a single decisive moment, dropping precisely the packets whose loss will cause the greatest operational damage. This minimal signature is what makes the attack both difficult to detect and dangerous in practice.

In laboratory tests, the team demonstrated the attack on a cloud-adapted version of a water-treatment research testbed developed at the Singapore University of Technology and Design. They used two models of the testbed, one built on software-based controllers and the other on standard industrial control hardware, with both models simulating the physical processes of a treatment plant. In one test, the attack delayed the start of clean-water pumping by about fifteen minutes. In another, it left a simulated valve open for more than nine minutes longer than intended, a failure that in a real plant could cause a significant loss of treated water.

Dr. Karthik Pattabiraman, a UBC professor of electrical and computer engineering who leads the Dependable Systems Lab and is a co-investigator on the project, emphasized that cracking encryption is not a prerequisite for causing harm. An attacker does not necessarily need to break your encryption to cause disruption, he said. By simply watching traffic patterns, they can identify when critical messages are likely to be sent and selectively block them. That means blocking a small amount of traffic could trigger a much larger operational disruption, an asymmetry that makes the attack especially attractive to adversaries with limited resources.

The team selected water treatment as their demonstration case because public schematics were available that allowed them to faithfully replicate the facility’s control systems. They also tested their traffic-analysis method across several industrial communication protocols, including a power-grid dataset, although the operational disruptions themselves were demonstrated only in the water-treatment models. Dr. Gargi Mitra, the first author of the paper, who conducted the research as a postdoctoral researcher at UBC, noted that as industrial systems increasingly connect to cloud-hosted services, their exposure to network-based attacks like ICS-Sniper could grow. The goal of the work, she said, is to uncover new vulnerabilities before attackers do, so that the security community can address them while these cloud services are still in the early stages of adoption.

The researchers are already working on defences. One approach involves making network communications less predictable, for example by padding message sizes or adjusting their timing so that attackers find it harder to distinguish critical commands from routine system chatter. Such countermeasures carry a technical constraint: any changes to traffic shaping must preserve the strict timing requirements of industrial equipment, which often depends on deterministic communication cycles. A second strategy is to make plant controls and coordination more resilient to network disruptions, including by providing alternative routes for critical communications. Mehta described the overarching aim as building defence in depth, so that no single point of failure, including an encrypted link to the cloud, can bring operations to a halt.

In an unusual step for transparency, the team has released its research code, instructions for reproducing the laboratory testbeds, and network traffic data from those testbeds, allowing other security researchers to reproduce the findings and to develop and test defences of their own. The paper, titled ICS-Sniper: A Targeted Blackhole Attack on Encrypted ICS Traffic, has been accepted for presentation at the 2027 Network and Distributed System Security Symposium, a leading computer security research conference, to be held in Seoul, South Korea. Chanyuan Liu, Pritam Dash, Elaine Yao and Alain Zhiyanov also contributed to the paper, and the project is supported by the National Cybersecurity Consortium. As society relies ever more heavily on interconnected technology to run essential services, the researchers argue that security strategies must evolve to protect not only the privacy of data, but also the safe operation of the physical machinery that keeps water flowing and power on during an attack.

Subject of Research: A traffic-analysis attack on encrypted industrial control system communications that can disrupt water and energy infrastructure

Article Title: UBC researchers uncover new cyber threat to water and energy networks

Article References: UBC researchers uncover new cyber threat to water and energy networks. (n.d.). Original publication

Image Credits: AI Generated

DOI: Not provided

Keywords: industrial control systems, cybersecurity, critical infrastructure, encrypted traffic analysis, water treatment, energy grids, cloud security, network attacks, UBC research, ICS-Sniper, NDSS 2027, defence in depth

The core idea behind GCAT is reconstruction-based anomaly detection, a strategy that has become a workhorse of the field. The model is trained exclusively on normal data, learning to compress and then rebuild typical patterns of sensor behavior. When the system later encounters something it has never seen during training, its reconstruction degrades, and the resulting error between the original and rebuilt signals becomes the alarm. The elegance of this approach is that it requires no labeled anomalies, which are scarce and expensive to collect in real industrial settings. Its weakness, however, is equally well documented: deep networks can become so flexible that they faithfully reconstruct even faulty inputs, a failure mode that recent research has highlighted as a serious reliability concern for autoencoder-based detectors. GCAT’s designers attack this weakness by making the reconstruction process far more structured.

Structure enters the model at two distinct levels. At the feature level, GCAT builds a data-driven graph in which nodes represent individual sensors and edges encode the dependencies between them, learned from the statistics of the training data rather than hand-drawn by engineers. A graph-convolutional layer then propagates information across this graph, so that each sensor’s representation is informed by the behavior of its correlated neighbors. This matters because in cyber-physical systems, sensors rarely lie. A pressure reading only makes sense in relation to flow rates and valve states, and a fault that appears innocuous in one channel may be glaring when viewed against its neighbors. By explicitly modeling these relationships, the model gains a reference frame against which deviations become much more conspicuous.

The temporal level receives equally careful treatment. Before the Transformer encoder, the component responsible for capturing long-range dependencies across time, processes a sequence, GCAT applies a time-graph propagation mechanism that enforces structured temporal neighborhoods, ensuring that each time step is contextualized by its neighbors in a disciplined way. In parallel, a lightweight Convolutional Long Short-Term Memory module refines local temporal patterns, blending the strengths of convolutional filters, which excel at short, repeating motifs, with the gated memory of recurrent networks, which track slower evolving trends. The combination stabilizes reconstruction and prevents the model from smoothing over the sharp, short-lived transients that often mark the onset of a fault. Only after this graph-structured preprocessing does the Transformer encoder perform its global attention over the sequence, now operating on representations that already carry both spatial and temporal context.

GCAT also borrows a page from the adversarial playbook. The architecture includes a compact one-dimensional convolutional discriminator trained alongside the reconstruction network, in the spirit of generative adversarial networks first introduced by Goodfellow and colleagues in 2014. The discriminator’s job is to judge whether a reconstructed window of sensor data is indistinguishable from genuine normal windows. Its verdict feeds back as an auxiliary training signal, a window-level constraint that pushes the reconstructor to preserve the local multivariate texture of normal operation rather than producing plausible-looking but statistically hollow outputs. This adversarial regularizer complements the reconstruction loss, and it connects GCAT to a growing family of GAN-based detectors such as MAD-GAN, TadGAN and USAD, while distinguishing itself through the explicit graph machinery wrapped around the Transformer.

Perhaps the most distinctive methodological contribution is the paper’s range-aware, exponent-adjusted anomaly scoring function. Rather than treating all reconstruction residuals equally, the score fuses two complementary signals: the magnitude of the reconstruction error and the association discrepancy measured from the attention layers, a concept popularized by the Anomaly Transformer. Crucially, the score emphasizes feature-wise deviations that exceed the empirical ranges observed during training. In other words, if a sensor value drifts outside the envelope of anything seen in normal operation, that deviation is amplified in the final anomaly score. This design choice gives the detector a form of statistical common sense, anchoring its judgments to the actual distribution of healthy data instead of relying solely on how badly the network happened to reconstruct a window.

The evaluation spans five widely used public benchmarks: SMAP and MSL, two NASA datasets of spacecraft telemetry that have become standard proving grounds since Hundman and colleagues introduced them in 2018; PSM, a server-machine dataset released by eBay; and SWaT and WADI, two testbed datasets from the iTrust centre in Singapore that simulate secure water treatment and water distribution systems under real and simulated cyberattacks. Across these benchmarks, GCAT achieves competitive performance, including the highest reported F1-scores among the compared methods on SMAP and MSL, high recall on SWaT and high precision on WADI. The F1-score, which balances precision and recall into a single figure, is the currency of anomaly detection research, and topping it on the two NASA datasets is a notable result in a crowded field where methods such as TranAD, TimesNet, GDN and the Anomaly Transformer all compete within fractions of a percentage point.

The practical implications reach well beyond leaderboard rankings. Cyber-physical systems, industrial control systems and large-scale IoT environments are exactly the settings where a missed anomaly can translate into physical damage, environmental harm or safety risk, and where a flood of false alarms erodes operator trust. The dual emphasis on recall in water treatment, where catching as many genuine faults as possible is paramount, and precision in water distribution, where spurious alarms carry operational costs, illustrates how the same architecture can be tuned to different risk profiles. Because the model is trained without labels, it can be deployed on systems where historical fault records simply do not exist, which describes most critical infrastructure in the real world. The authors have also released their implementation and evaluation scripts on GitHub, lowering the barrier for practitioners and researchers who want to test the approach on their own telemetry.

The study also situates itself honestly within the field’s ongoing debates. Recent work has questioned whether autoencoders are fundamentally reliable anomaly detectors, and surveys of deep learning approaches to time series anomaly detection document a landscape crowded with architectures that sometimes differ more in branding than in substance. GCAT’s response is architectural pluralism: rather than betting on a single mechanism, it combines graph convolutions, convolutional recurrence, Transformer attention and adversarial training into a pipeline in which each component addresses a specific failure mode of the others. The graph captures inter-sensor structure that pure attention may miss, the ConvLSTM stabilizes local dynamics, the discriminator polices reconstruction quality, and the range-aware scoring function guards against the silent reconstruction of out-of-range values.

What emerges is a portrait of where anomaly detection research is heading. The era of a single network architecture solving multivariate time series monitoring on its own appears to be closing, replaced by composite systems that encode domain structure, in the form of sensor graphs and temporal neighborhoods, directly into the learning process. For the engineers who keep power grids, water networks and spacecraft alive, models like GCAT promise detectors that understand not just what the numbers are, but how they relate to one another and when they stray beyond anything normal operation has ever produced. As sensor networks multiply across industry and daily life, that relational understanding may prove to be the difference between a logged warning and a headline-making failure.

Subject of Research: Unsupervised anomaly detection in multivariate time series using graph-convolutional adversarial transformer networks

Article Title: GCAT: a graph-convolutional adversarial transformer for multivariate time series anomaly detection

Article References: Sefati, S. T., Razavi, S. N., & Salehpoor, P. (2026). GCAT: a graph-convolutional adversarial transformer for multivariate time series anomaly detection. Cluster Computing, 29(14), Article 823. https://doi.org/10.1007/s10586-026-06635-3

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06635-3

Keywords: anomaly detection, multivariate time series, transformer, graph convolutional network, generative adversarial network, ConvLSTM, cyber-physical systems, industrial control systems, Internet of Things, SMAP, SWaT, machine learning

The challenge the researchers set out to solve is deceptively simple to describe but notoriously difficult in practice. Industrial systems spend nearly all of their time operating normally, with genuine faults appearing only in fleeting moments. As the authors illustrate, a factory that malfunctions for just five seconds in a day produces a dataset in which normal data overwhelmingly dominates, creating severe class imbalance that cripples conventional binary classification approaches. Signals in these environments also tend to be erratic rather than seasonal, making them hard for machine learning models to segment and learn. Rather than trying to classify each moment as normal or abnormal, the team adopted a prediction-based strategy: train the model exclusively on normal data to forecast future sensor values, then flag anomalies whenever reality diverges sharply from prediction.

Architecturally, the framework stacks three complementary components. At its core sits a three-layer bidirectional gated recurrent unit, or Bi-GRU, which processes sequences of sensor readings in both forward and backward directions. The GRU itself is a streamlined variant of the recurrent neural network that tamed the vanishing gradient problem through reset and update gates, requiring fewer parameters than the better-known LSTM and therefore training faster and generalizing more easily. By making the network bidirectional, the researchers allowed it to interpret the full context at every point in a sequence, capturing complex temporal dependencies and converging more quickly during training thanks to gradients flowing from both directions. A residual skip connection further eased gradient flow through the deep stack.

Temporal modeling alone, however, ignores a crucial truth about industrial plants: sensors do not operate in isolation. Boilers, turbines, valves, pumps, and tanks interact through physical process flows, and an anomaly at one component often propagates to its neighbors. To capture this spatial dimension, the team wired a graph neural network into the predictive model. The graph’s adjacency matrix was not learned from statistical correlations, which the authors caution can introduce spurious edges when anomalies are rare, but instead derived directly from the piping and instrumentation diagrams of the testbed. Each entry in the matrix encodes whether a direct process-flow path exists between two sensors or actuators, embedding physically grounded causal pathways into the model’s structure from the outset.

On top of this structural backbone, the researchers layered a graph attention network, or GAT, a relatively recent architecture that has proven exceptionally powerful for graph-structured data. Unlike graph convolution, which applies uniform weights to all neighboring nodes, the attention mechanism learns normalized coefficients that quantify the relative influence of each connected sensor. Through multi-head attention, the model can simultaneously attend to multiple aspects of each node’s neighborhood, stabilizing learning and enriching feature extraction. The attention weights multiply the input data before it reaches the bidirectional GRU, ensuring that the temporal model processes information in alignment with the underlying system topology. Crucially, these weights are also interpretable, allowing operators to see exactly which sensor relationships drive detection decisions.

The experimental platform was anything but a toy. The team evaluated the framework on the HAI 21.03 dataset, recorded at one sample per second from 79 sensors and actuators spanning a hardware-in-the-loop industrial control system testbed that replicates steam turbine generation and pumped-storage hydroelectric power. The testbed comprises four integrated processes: a boiler process handling heat transfer through water, a turbine process simulating rotating machinery, a water treatment process moving water between reservoirs, and a hardware-in-the-loop simulation layer synchronizing the whole, built on real industrial controllers from Emerson, GE, and Siemens. The test set contained 50 simulated attack scenarios, of which five were reserved for validation and 45 for final evaluation, with anomalies making up just 2.23 percent of the data.

The results demonstrated clear benefits from each design decision. Among unidirectional models, the plain LSTM baseline fared worst, while GRU-based models with graph neural network modules led the field with an F1 score of 0.912. Switching to bidirectional architectures pushed performance further: Bi-LSTM+GNN and Bi-GRU+GNN achieved F1 scores of 0.879 and 0.924 respectively, with the GE-BiGRU configuration emerging as the best overall performer. The gains were especially pronounced in sensitivity and time-series-aware precision, metrics that directly reflect missed-detection risk and operator alarm burden in continuous monitoring. Notably, the bidirectional extension added negligible computational cost, with even the most expensive variant requiring less than half a millisecond per sample, comfortably within the one-second budget imposed by the testbed’s sampling rate.

Perhaps the most striking finding concerns interpretability. The attention weights learned by the GAT revealed three exceptionally strong sensor connections, and each corresponded precisely to documented actuator-sensor pairs in the plant’s feedback control loops: a flow control valve linked to return-tank water levels, a level control valve linked to tank level measurements, and an auto speed demand linked to turbine RPM. These same channel pairs coincided with the primary targets of the testbed’s attack scenarios and exhibited markedly elevated prediction errors during attack intervals. In practical terms, this means operators can trace fault-propagation paths through the plant, identifying, for example, that a valve malfunction is likely when an anomaly coincides with abrupt changes in the relationship between a flow control valve and downstream water levels. Such insights can inform troubleshooting and preventive maintenance strategies.

The authors are candid about limitations. The adjacency matrix is constructed statically from simulator configuration documents and remains fixed during training, so topology changes such as adding or removing sensors would require full retraining, an expensive prospect in continuously operating plants. The evaluation also relies on simulator-based data, which, despite incorporating genuine industrial controllers, cannot fully reproduce sensor degradation, environmental variability, or adaptive adversarial attacks seen in the field. The team notes that sensitivity values remained below 0.75 across most models, reflecting a threshold selection procedure that balances precision and recall rather than minimizing missed detections; in safety-critical deployments where a missed fault costs far more than a false alarm, operators might weight recall more heavily. Future work will pursue dynamic graph construction, broader benchmark evaluation, and latency optimization for resource-constrained edge devices.

Even with these caveats, the study marks a meaningful advance in the race to secure critical infrastructure. By learning what normal looks like, exploiting the physical topology of the plant, and explaining its own reasoning through attention weights, the GE-BiGRU framework offers a blueprint for anomaly detection systems that are simultaneously accurate, efficient, and transparent. As power grids, water treatment facilities, and transportation networks grow ever more interconnected through the Internet of Things, tools that can spot a five-second anomaly buried in a sea of normal data, and tell engineers exactly where to look, may prove indispensable to keeping the lights on.

Subject of Research: A graph neural network and bidirectional GRU framework for detecting anomalies in multivariate time-series data from power generation cyber-physical systems.

Article Title: Graph-enhanced bidirectional GRU for anomaly detection in power generation environments

Article References: Kwon, D., Kang, Y., Lee, J., Nam, Y., Won, J., Kim, K. K., Kim, D. D., & Park, C. (2026). Graph-enhanced bidirectional GRU for anomaly detection in power generation environments. Data Mining and Knowledge Discovery, 40(6), Article 102. https://doi.org/10.1007/s10618-026-01262-3

Image Credits: AI Generated

DOI: 10.1007/s10618-026-01262-3

Keywords: anomaly detection, graph neural networks, graph attention network, bidirectional GRU, cyber-physical systems, power generation, industrial control systems, multivariate time series, cybersecurity, deep learning, fault diagnosis, HAI dataset

The research, led by Zhongmin Wang, Zhongjian Yuan, Cong Gao, and Yanping Chen, addresses a long-standing weakness in a classical machine learning technique known as the One-Class Support Vector Machine, or OCSVM. The OCSVM has been a workhorse of anomaly detection since its introduction in the early 2000s. Its appeal lies in its ability to learn from a single class of data—normally, it needs to see only examples of healthy behavior to build a model of what ‘normal’ looks like. Anything that falls outside that learned boundary is flagged as an anomaly. This is crucial in industrial settings, where attack examples are rare, dangerous to stage, and endlessly varied, making conventional supervised learning impractical.

Yet the OCSVM carries two stubborn Achilles’ heels. First, its performance depends heavily on the choice of kernel function and, in particular, on the parameters of the Gaussian kernel that defines how similarity between data points is measured. Getting these parameters right often requires laborious trial and error or expensive cross-validation, and a poor choice can gut the model’s accuracy. Second, industrial sensor data is increasingly high-dimensional, with hundreds or thousands of measurements streaming from pumps, valves, and controllers. As dimensionality rises, data points spread farther apart, distributions become sparse, and the notion of distance itself loses meaning—a phenomenon statisticians call the curse of dimensionality. The Gaussian kernel, which relies on Euclidean distances, struggles to capture the true distribution of normal samples in this sparse high-dimensional space, and detection performance degrades.

The Xi’an team’s answer, which they call Information Clustering One-Class Support Vector Machine (IC-OCSVM), tackles both problems in a single framework built on information-theoretic foundations. The method begins with a preprocessing stage that treats each feature dimension of the industrial data as if it were a separate information system. For every dimension, the researchers compute the Shannon information entropy—a measure of the uncertainty or unpredictability carried by that variable. Dimensions with low information content contribute little to distinguishing between samples and are treated as redundant and removed. This entropy-based pruning reduces dimensionality in a principled way, concentrating the model’s attention on the sensors and signals that actually carry meaningful variability, and simultaneously softening the effects of sparsity before the learning stage even begins.

The second and more novel stage replaces the conventional Gaussian kernel entirely. Instead of measuring similarity through Euclidean distance, IC-OCSVM introduces the concept of information content to characterize the differences between samples. Information content, a concept descending from Claude Shannon’s mathematical theory of communication, quantifies how surprising or informative one sample is relative to another. The researchers design an explicit mapping function based on this information-content measure, which serves the same mathematical role as the implicit feature mapping performed by a kernel trick—but with a crucial advantage. Because the mapping is explicit and constructed directly from information theory, the method no longer depends on the delicate selection of Gaussian kernel parameters. The model essentially builds its own geometry from the information structure of the data rather than relying on a pre-chosen distance metric.

This design choice has a second benefit that matters greatly for industrial deployments. By measuring the distance between samples through information content rather than raw coordinate differences, the constructed OCSVM is far less susceptible to the sparsity problem that plagues high-dimensional data. Samples that would appear arbitrarily far apart in a high-dimensional Euclidean space may share substantial information structure, allowing the model to recognize the common signature of normal behavior even when the raw feature space is vast and thinly populated. In effect, the method asks a more meaningful question of the data: not ‘how far apart are these points?’ but ‘how much do these observations tell us about each other?’

To test the approach, the team turned to two of the most demanding and widely respected benchmark datasets in industrial control system security: SWaT and WADI. SWaT, the Secure Water Treatment testbed developed at the Singapore University of Technology and Design, simulates a full-scale water purification process complete with realistic cyberattack scenarios, while WADI extends the same experimental philosophy to water distribution networks. Both datasets feature multivariate time series from dozens of sensors and actuators, injected attacks of varying sophistication, and the noisy, correlated measurements that make real industrial anomaly detection so difficult. The researchers compared IC-OCSVM against a roster of state-of-the-art anomaly detection algorithms, including deep-learning approaches built on autoencoders, generative adversarial networks, and graph neural networks.

The results were striking. IC-OCSVM achieved an F1-score of 85.91 percent on SWaT and 68.28 percent on WADI, outperforming the best competing baseline by 3.2 and 3.3 percentage points respectively. In a field where incremental gains of a fraction of a percentage point frequently justify publication, improvements of this size—particularly on the notoriously difficult WADI dataset—are significant. The F1-score, which balances precision and recall into a single number, is especially meaningful in industrial security, where a detector that cries wolf too often wastes operator attention and one that stays silent too long allows attacks to proceed. IC-OCSVM’s edge on both fronts suggests that the information-theoretic framing genuinely captures structure that Gaussian-kernel and deep-learning baselines miss.

The implications extend well beyond water treatment. Any setting where anomalies must be learned from normal data alone—power grid monitoring, manufacturing quality control, aircraft engine health tracking, building automation—faces the same twin burdens of kernel tuning and high-dimensional sparsity. A method that sidesteps kernel parameter selection removes a costly and error-prone step from the deployment pipeline, while entropy-based dimension reduction offers a computationally light alternative to heavyweight deep architectures. Notably, IC-OCSVM achieves its results without the massive training datasets and GPU resources that deep learning methods typically demand, which could make sophisticated anomaly detection accessible to smaller operators and resource-constrained facilities that cannot maintain large labeled datasets or dedicated machine learning infrastructure.

The work also represents a broader and somewhat counterintuitive trend in machine learning research: the return of classical theory to solve problems that modern deep learning has struggled with. Shannon’s information theory, formulated in the 1940s, provides tools that are interpretable, mathematically grounded, and robust in ways that black-box neural networks often are not. By fusing information-theoretic feature analysis with the boundary-learning power of support vector machines, the Xi’an researchers have demonstrated that careful mathematical design can still beat brute-force complexity in the right domain. As industrial systems become ever more connected and the attack surface for critical infrastructure continues to expand, tools like IC-OCSVM point toward a future in which the sentinels guarding our water, power, and factories are built not just on more data, but on a deeper understanding of what information itself reveals.

Subject of Research: A hybrid information clustering and one-class support vector machine method for anomaly detection in industrial control systems

Article Title: A hybrid method integrating information clustering and one-class support vector machine for industrial anomaly detection

Article References: Wang, Z., Yuan, Z., Gao, C., & Chen, Y. (2026). A hybrid method integrating information clustering and one-class support vector machine for industrial anomaly detection. Applied Intelligence, 56(14), Article 418. https://doi.org/10.1007/s10489-026-07447-z

Image Credits: AI Generated

DOI: 10.1007/s10489-026-07447-z

Keywords: anomaly detection, industrial control systems, one-class support vector machine, information entropy, information content, SWaT dataset, WADI dataset, industrial cybersecurity, machine learning, high-dimensional data, Gaussian kernel, Applied Intelligence