A Multi-View Hierarchical Intrusion Detection Model with Integrating Spatiotemporal Feature for Industrial Control System

Current intrusion detection in industrial control system (ICS) typically relies on network flows or traffic packets, often neglecting differences in payloads of functional fields and their heterogeneous responses under attacks. Moreover, most methods depend on manually crafted features, limiting the utilization of raw traffic byte streams and constraining detection performance. This paper proposes a multi-view correlation intrusion detection model that incorporates spatiotemporal features to enhance detection in ICS. By integrating byte streams with parsed field data, the model leverages traffic information through multi-view collaborative modeling. A fine-grained hierarchical feature framework is developed to extract behavior patterns from each field attribute, and cross-attention mechanisms capture inter-view relationships to construct a comprehensive representation of traffic content. A spatial feature extractor based on convolutional neural network (CNN) and a temporal extractor using Transformer architecture are employed to learn deep spatiotemporal features. A focal loss function is adopted to compute anomaly scores, which support the final intrusion detection decisions. Experiments on the water distribution testbed dataset show that the proposed model achieves superior performance compared to state-of-the-art methods, enabling accurate and efficient intrusion detection in ICS environments.