Industrial control systems (ICSs), as critical national infrastructures, are increasingly susceptible to sophisticated security threats. To address this challenge, our study introduces the CAE-T, a deep convolutional autoencoding transformer network designed for efficient anomaly detection and real-time fault monitoring in ICS. The CAE-T utilizes unsupervised deep learning, employing a convolutional autoencoder for spatial feature extraction from multidimensional time-series data, and combines this with a transformer architecture to capture long-term temporal dependencies. The design of the model facilitates rapid training and inference, while its dual-component approach, utilizing an optimization function based on support vector data description (SVDD), enhances detection accuracy. This integration synergistically combines spatiotemporal feature extraction, significantly improving the robustness and precision of anomaly detection in ICS environments. The CAE-T model demonstrated notable performance enhancements across three industrial control system datasets. Notably, the CAE-T model achieved approximately a 70.8 increase in F1 score and a 9.2 rise in AUC on the WADI dataset. On the SWaT dataset, the model showed improvements of approximately 2.8 in F1 score and 5 in AUC. The power system dataset saw more modest gains, with an approximately 0.1 uptick in F1 score and a 1 increase in AUC. These improvements validate the CAE-T models efficacy and robustness in anomaly detection across various scenarios.

This article proposes a prediction model that combines network physical characteristics and deep learning methods to solve the problem of insufficient round-trip time (RTT) prediction accuracy caused by complex dynamic characteristics in civil aviation business data networks. This model is based on a physical information neural network framework, which embeds domain knowledge such as delay load relationships, burst traffic attenuation patterns, and inverse RTT window constraints into a long short-term memory (LSTM) network. In addition, the multi constraint loss function enhances the adaptability of the model to complex network activities. Moreover, in order to overcome the limitations of LSTM networks in modeling long-range dependencies, a multi head attention (MA) mechanism was implemented to capture long-term temporal dependencies in parallel, thereby improving the model’s ability to capture long-range time step correlations. Benchmarking and extension tests were conducted on four civil aviation business data network datasets. The experimental results show that compared with the baseline model, the proposed model significantly improves the root mean square error (RMSE), mean absolute error (MAE), and mean absolute percentage error (MAPE) for bidirectional network communication RTT prediction tasks. The study has verified that combining network physical attribute constraints with attention mechanisms can effectively improve the accuracy of transmission delay prediction, providing an effective method for effective traffic prediction in highly dynamic civil aviation network environments.

Aiming at the problem that large-scale traffic data lack labels and take too long for feature extraction in network intrusion detection, an unsupervised intrusion detection method ACOPOD based on Adam asymmetric autoencoder and COPOD (Copula-Based Outlier Detection) algorithm is proposed. This method uses the Adam asymmetric autoencoder with a reduced structure to extract features from the network data and reduce the data dimension. Then, based on the Copula function, the joint probability distribution of all features is represented by the edge probability of each feature, and then the outliers are detected. Experiments on the published NSL-KDD dataset with six other traditional unsupervised anomaly detection methods show that ACOPOD achieves higher precision and has obvious advantages in running speed. Experiments on the real civil aviation air traffic management network dataset further prove that the method can effectively detect intrusion behavior in the real network environment, and the results are interpretable and helpful for attack source tracing.