A Hybrid Ft-Transformer-GRU Model for Intrusion Detection in Industrial Control Systems Using Multivariate Time-Series Data

Abstract

Industrial Control Systems (ICS) are the operational core of all modern infrastructure, managing the complex sensors and automated machinery required for large-scale manufacturing. Intrusion detection has emerged as a key security mechanism. These systems often generate high-dimensional data that security models struggle to manage. Specifically, these models are often unable to simultaneously account for intricate feature interactions and long-term temporal dependencies in the industrial sensor data, resulting in inaccurate detection results with high false alarm rates. To overcome these issues, this study proposes a hybrid DL model based on a combination of a Feature Tokenizer Transformer (FT-Transformer) and a Gated Recurrent Unit (GRU). By combining these two approaches, the model learns complex relationships between individual data features while capturing the sequential patterns of multivariate time-series data. This study is validated using the Water Distribution (WADI) dataset, a benchmark for industrial systems under normal and attack scenarios. The results obtained show that the proposed framework has an overall accuracy of 98.58%, with recall, precision and F1-score. The method has an AUC of 0.99, which is the discriminative capacity. This implies that the results validate the effectiveness of the framework in enhancing the performance of intrusion detection systems with low misclassification rates.