Hybrid dynamic feature convolution with transformer fusion model for the detection of intrusion during manufacturing process

Abstract

Intrusion detection is essential in contemporary manufacturing systems. These are vulnerable to various cyber threats due to the integration of cyber-physical systems and continuous data exchange. Traditional intrusion detection systems include statistical models and standard machine learning (ML) approaches. They struggle with high-dimensional sensor data, imbalanced datasets, and fast-changing attack patterns. To overcome these challenges, we propose a hybrid intrusion detection model. It combines Dynamic Feature Convolution (DFC) with a Transformer-based temporal modelling structure. The DFC component uses gated convolutional layers with sigmoid and tanh activations to learn localized temporal features. The Transformer component applies self-attention mechanisms to capture long-term dependencies. This hybrid model learns both local feature dynamics and global temporal dependencies in industrial time series data. We evaluated the proposed model using the publicly available Water Distribution (WADI) dataset. This dataset simulates realistic industrial processes under both normal and attack scenarios. Experimental results demonstrate robust detection performance. Over five independent training runs and 5-fold cross-validation, the model achieved an average accuracy of 97.34% ± 0.23. It also reached a precision of 97.47% ± 0.24, a recall of 97.14% ± 0.22, and an F1-score of 97.30% ± 0.23. The close values of precision and recall, further supported by confusion matrix analysis and low variance across folds, indicate balanced class learning rather than precision inflation. These results demonstrate robust and repeatable intrusion detection performance rather than isolated success. Our findings suggest that the proposed hybrid framework offers a robust and efficient solution for real-time intrusion detection in manufacturing systems.