Deep Tabular and Sequential Models for Robust SCADA Cybersecurity Using the Custom-Built SCADANet Dataset
Year: 2026
Type: article
Abstract: Supervisory Control and Data Acquisition (SCADA) systems are critical for managing large-scale industrial facilities, yet their increasing connectivity exposes them to sophisticated cyberattacks, with a reported 44% rise in incidents by 2023. This study addresses the challenge of intrusion detection in SCADA systems by evaluating four advanced deep learning models, DCNv2_MoE, EntityEmbeddingMLP (EE-MLP), RTDLResNet, and Temporal Convolutional Network (TCN), for multi-class attack classification. Using a custom SCADANet dataset, generated in a virtualized lab environment with nine attack scenarios (e.g., HTTP flood, SQL injection, port scan) and normal traffic, we applied comprehensive preprocessing to tackle class imbalance, high dimensionality, and temporal dependencies. The models achieved near-perfect performance, with RTDLResNet attaining a Macro Avg F1-Score of 1.00, followed by DCNv2_MoE and EE-MLP at 0.99, and TCN at 0.96. Cross-dataset evaluation on an independent public SCADA benchmark further confirmed competitive generalization (Macro Avg F1-Scores of 0.80–0.85), although performance naturally declined due to domain shift between laboratory-generated and real-world traffic patterns. Class-specific analysis revealed robust detection of volumetric attacks but variable performance on scanning attacks, particularly TCN’s lower precision for OS scans. These findings highlight the strengths of tabular and sequential architectures for SCADA security, offering a scalable framework for real-time intrusion detection while identifying areas for enhancing model robustness and generalizability against evolving threats. While results are derived from a virtualized laboratory environment, future semi-real-world validation in digital twin setups is planned to bridge the gap to operational SCADA deployments, ensuring applicability boundaries are clearly defined. To partially mitigate concerns regarding real-world applicability, the trained models were evaluated in a zero-shot manner on a publicly available SDN-based SCADA dataset, achieving competitive Macro Avg F1-Scores in the 0.80–0.85 range despite domain shift. These findings highlight the strengths of tabular and sequential architectures for SCADA security, offering a scalable framework for real-time intrusion detection while identifying areas for enhancing model robustness and generalizability against evolving threats.
Source: IEEE Access
Institutions: King Abdulaziz University, Adıyaman University
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
Estimated APC paid: $2,075
OpenAlex ID: W7160833183