💻 computer science

A Security State Awareness Method for Petrochemical Industrial Control Network Equipment Based on Deep Learning

This paper proposes a deep learning-based security state awareness method for petrochemical industrial control network equipment using a hybrid TCN-MGRU model to address situational complexity and information delays, thereby significantly improving detection accuracy and security protection.

Original authors: Tengteng Xie, Songtao Yu, Jingchao Yang, Xianghong Min, Longhao Li

Published 2026-07-29

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Tengteng Xie, Songtao Yu, Jingchao Yang, Xianghong Min, Longhao Li

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the world of big factories, like those that turn crude oil into the plastic in your water bottle or the fuel in your car. These places run on "industrial control networks," which are essentially the nervous systems of the factory. They are a web of computers and sensors that talk to each other to keep giant machines running smoothly. For a long time, these systems were like secret fortresses, isolated from the outside world. But today, they are connected to the internet to be smarter and faster, which means they are now open to the same kind of digital thieves and hackers that try to break into your phone or email.

When a hacker attacks a regular computer, they might steal your photos. When they attack a factory, they could shut down a chemical plant or cause a dangerous explosion. To stop this, engineers use something called "security situational awareness." Think of this as the factory's immune system. It doesn't just wait for a virus to show up; it constantly scans the air, looking for tiny changes in how the machines are breathing, moving, or talking. It tries to spot the difference between a machine working hard and a machine being tricked by a bad guy. The challenge is that these factories are incredibly complex, and the data they produce changes every second, making it very hard for old-school security tools to keep up.

This is where the researchers Tengteng Xie, Songtao Yu, and their team step in. They are worried that the current ways of protecting these chemical factories aren't fast or smart enough to catch the sneaky, evolving attacks. They propose a new, super-smart method based on "deep learning," which is a type of artificial intelligence that learns by looking at massive amounts of examples, kind of like how a dog learns to recognize a ball by seeing thousands of balls.

The team built a new digital detective called TCN-MGRU. To understand how it works, imagine a security guard who has two superpowers. The first power is a "Time-Convolutional Network" (TCN). This is like a guard who can look at a video of a machine's activity and instantly spot the rhythm and pattern of how it usually moves. It's great at seeing the "shape" of the data over time. The second power is a "Multi-Layer Gate Recurrent Unit" (MGRU). This is like a guard with an incredible memory who remembers what happened a long time ago and uses that to understand what is happening right now. It's designed to avoid getting confused or "forgetting" important clues, a problem that plagues older AI models.

The researchers combined these two powers into one hybrid model. They trained this digital detective on a dataset called "Gas," which contains over 200,000 records of normal factory operations and thousands of records of different types of cyber-attacks. They tested their new detective against other existing security tools, including models named D-GRU, SATIDS, and CBRNN.

The results were impressive. In these tests, the TCN-MGRU model proved to be the sharpest detective in the room. When looking at normal operations, it correctly identified them as safe 98.75% of the time. When it came to spotting specific types of attacks, it consistently outperformed the others. For example, when detecting a specific type of attack called "MFCI," it achieved an accuracy of 98.77% and an F1 score (a measure of how well it balances finding real attacks without crying wolf) of 0.9776. The other models, while decent, couldn't reach these heights.

The team also tested how well the model handled attacks that were very small and subtle, like a hacker trying to sneak in a tiny bit of bad data. Even when the attack was barely noticeable (at a magnitude of just 0.05%), the model still managed to spot it with over 85% accuracy. As the attacks got slightly bigger, the model's accuracy jumped to over 92%. The researchers also measured the "Area Under the Curve" (AUC), a score that tells you how good a model is at distinguishing between good and bad. Their model's scores were very close to 1.0, which is the perfect score, meaning it is far better than just guessing randomly.

In short, this paper suggests that by combining a pattern-spotting AI with a memory-rich AI, we can create a much stronger shield for petrochemical factories. While this was tested in simulations and on specific datasets, the results indicate that this new method could be a powerful tool for keeping these critical industrial systems safe from the growing threat of cyber-attacks.

Technical Summary: A Security State Awareness Method for Petrochemical Industrial Control Network Equipment Based on Deep Learning

Problem Statement
The integration of industrial control network equipment with business processes in the petrochemical industry has generated vast amounts of data for real-time monitoring but has also introduced significant security vulnerabilities. Traditional security measures, such as access control and basic threat awareness, are insufficient for the complex, hybrid architectures of modern petrochemical systems. These systems face frequent security incidents where existing protocols contain exploitable vulnerabilities. The core challenge lies in the high complexity of situational awareness within dynamic and continuous operational environments, coupled with the delayed transmission of security information. Consequently, there is an urgent need for a method that can effectively extract key security state features, reduce false alarm rates, and improve awareness accuracy to ensure the stable operation of industrial control network equipment against evolving network threats.

Methodology
To address these challenges, the authors propose a deep learning-based security state awareness scheme centered on a hybrid model called TCN-MGRU (Temporal Convolutional Network combined with Multi-layer Gate Recursive Units).

Security State Awareness Model Formulation:
The authors first define a mathematical framework for situational elements, categorizing them into two dimensions:
- External Situational Factors: Including port traffic information ( $O^{exPot}$ ) and log event information ( $O^{exLog}$ ).
- Attack Threats: Modeled as known attack behaviors ( $O^{At}$ ).
  The objective is formulated as minimizing the awareness error rate for abnormal ports, events, and aggressive behaviors while maintaining low processing costs.
The TCN-MGRU Architecture:
- Temporal Convolutional Network (TCN): This component utilizes convolutional layers to extract spatiotemporal structural characteristics from the feature subsets of industrial control data. It employs max pooling for dimensionality reduction and dropout techniques to prevent overfitting, enhancing the model's ability to learn temporal features.
- Multi-layer Gate Recursive Units (MGRU): Based on Gated Recurrent Units (GRU), this component addresses the gradient vanishing and explosion problems common in traditional RNNs. It utilizes reset and update gates to preserve long-term sequence information and manage residual memory, making it suitable for processing nonlinear time series data.
- Residual Classification: The model calculates the predicted residue ( $\Re^p_t$ ) between measured data and predicted values. This residue is then processed through a classification network that incorporates wavelet transform-based convolution and pooling. This approach replaces blind parameter iteration with predefined multiresolution analysis to improve feature extraction and classification accuracy.

Key Contributions

Proposed Model: The development of the TCN-MGRU hybrid model specifically designed for the dynamic and continuous situational spaces of petrochemical industrial control networks.
Hybrid Feature Learning: The integration of TCN for spatial feature extraction and MGRU for temporal sequence modeling allows the system to learn both statistical and temporal security features without losing critical data characteristics during processing.
Novel Classification Method: The design of a real-time classification method utilizing wavelet transform principles within the CNN residue classification layer to detect and classify security states.
Error Rate Minimization: The formulation of a security awareness problem that explicitly targets the minimization of awareness error rates across different dimensions (ports, logs, and attacks).

Experimental Results
The proposed method was evaluated using the Gas dataset, a standard benchmark in industrial security containing over 270,000 data points with seven types of attacks. The TCN-MGRU model was compared against baseline models including D-GRU, SATIDS, and CBRNN.

Performance Metrics: TCN-MGRU outperformed all baselines across Accuracy, Recall, Precision, and F1 scores.
- On the MFCI (Multi-Feature Class Injection) attack type, TCN-MGRU achieved the highest accuracy of 98.77% and an F1 score of 0.9776.
- On the Normal dataset, it achieved an accuracy of 98.75%.
- The macro-average metrics for TCN-MGRU were approximately 0.9589 (Accuracy), 0.9605 (Recall), 0.9685 (Precision), and 0.9619 (F1).
Robustness: The model demonstrated superior performance even as attack amplitudes increased. In scenarios with small attack injection magnitudes (0.05%), the model maintained an awareness accuracy of over 85%, with a False Acceptance Rate (FAR) below 8% and a False Rejection Rate (FRR) under 6.8%.
AUC Analysis: The Area Under the Curve (AUC) values for TCN-MGRU were consistently close to 1 across all tested attack types (NMRI, CMRI, MSCI, MPCI, MFCI, DoS, Recon), indicating performance significantly better than random guessing.

Significance and Claims
The paper claims that the TCN-MGRU scheme provides robust support for the security protection of petrochemical industrial control network equipment. By addressing the high complexity of situational awareness and the challenges of dynamic environments, the method enables:

Real-time Monitoring: The ability to process and understand security states in real-time, facilitating timely responses to potential threats.
Enhanced Detection: Improved capability to identify, recognize, analyze, and respond to practical security scenarios, particularly in complex environments where traditional methods fail.
Adaptability: The model exhibits adaptive performance in challenging security environments, reducing false alarms and improving the overall reliability of the industrial control system.

The authors conclude that this deep learning-driven approach offers a viable solution for achieving high-precision security situational awareness, thereby supporting the safe and stable operation of petrochemical production systems.

Technical Summary: A Security State Awareness Method for Petrochemical Industrial Control Network Equipment Based on Deep Learning

More like this