The pervasive adoption of Internet-of-Things (IoT) systems has exposed critical vulnerabilities in cyber-security frameworks due to their decentralized deployment in unattended environments. While deep learning-based intrusion detection systems (IDSs) offer promising solutions, the design of hyper-parameters and neural architectures in existing models imposes prohibitive computational costs and expert dependency. To address these limitations, this work proposes an innovative automated hybrid deep learning method for IDS by employing a binary particle swarm optimization (BPSO) algorithm called BPSO-AHDL-IDS to effectively address the intrusion detection tasks of IoT. In BPSO-AHDL-IDS, the combination of convolutional neural network and recurrent neural network is considered as the hybrid deep learning model to extract features of the IoT dataset for accurate detection of intrusions. First, an efficient binary encoding mechanism is developed to describe the hyper-parameters and neural architectures of the hybrid deep learning model. Then, an efficient BPSO-based evolutionary operation is introduced to evolve the hyper-parameters and neural architectures to discover the optimized hybrid deep learning model. The performance of the proposed BPSO-AHDL-IDS method is testified by employing four datasets gathered from different IoT scenarios. It achieves accuracy of 0.9832, 0.9959, and 0.9897, precision of 0.9700, 0.9788, and 0.9843, recall of 0.9724, 0.9822, and 0.965, andF1-score of 0.9712, 0.9804, and 0.9744 on Bot-IoT, ToN-IoT, and Gas Pipeline datasets, respectively. On SWaT dataset, it achieves a precision of 0.9962, a recall of 0.9969, and anF1-score of 0.9965, respectively. The experimental results show the superiority of the proposed BPSO-AHDL-IDS method to machine learning methods, state-of-the-art manually designed and automated deep learning-based IDSs in terms ofaccuracy, precision, recall, andF1-score.

State estimation of cyber-physical power systems (CPPSs) is of great significance for power system optimization, control, and security analysis. Additionally, fractional differential calculus is based on differentiation and integration of arbitrary fractional order, which can more accurately describe the physical phenomenon model than the traditional integer calculus. Thus, this article proposes a novel fractional-order extended Kalman filter (FOEKF) based on the evolutionary algorithm and deep ensemble learning techniques for the state estimation problem of CPPSs from the fractional-order theory perspective. First, the power system is modeled as a fractional version to describe the physical phenomenon better according to the fractional differential calculus theory. Then, considering the difficulties in determining fractional orders in the fractional-order power system, a deep ensemble learning-based approach is used to design the fitness function and a genetic algorithm is developed to determine these parameters by optimizing the designed objective function. Furthermore, to solve the difficulties in estimating for fractional-order power system by integral extended Kalman filter (EKF), the evolutionary FOEKF (EFOEKF) is presented as the estimator for the designed fractional-order power system. Finally, to improve the performance of EFOEKF under bad datum scenarios caused by cyber-attacks or sudden loads, an enhanced EFOEKF method is developed by using an adapted exponential weighting function. The numerical simulation results show that the proposed EFOEKF is better than EKF and FOEKF on four different IEEE bus systems in terms of the mean absolute error.

Industrial Internet of Things (IIoT) is an important part of industrial infrastructure but facing serious and evolving security threats in recent years. Deep learning has been widely considered as a promising solution for enhancing the security of IIoT. However, these existing deep learning models utilized in the intrusion detection of IIoT are manually developed that not only greatly rely on the experience of the designers but also is lack of utility due to the high model complexity. By taking into account the trade-off between the model performance and model complexity, this article makes the first attempt to propose a multi-objective joint optimization method of neural architecture search (NAS) and hyper-parameter optimization (HPO) based on multi-objective discrete extremal optimization (MODEO) to automatically design a lightweight convolutional neural network (CNN) for the intrusion detection task of IIoT, abbreviated as MODEO-CNN. A novel hybrid variable-length encoding strategy is developed by combing binary and integer encoding to characterize both the neural architectures including the number of blocks, the blocks-based network topology and the corresponding architecture parameters in CNN block, and some important hyper-parameters including batch size, learning rate, weight optimizer and regularization. The individual-based discrete multi-objective evolutionary process of MODEO is designed to obtain the Pareto-optimal CNN models. Three widely-used IIoT intrusion detection datasets, including the Gas Pipeline, BoT-IoT, and Power System Attack datasets, have been used to illustrate the superiority of the proposed MODEO-CNN over the state-of-the-art hand-craft models and two single-objective fixed-length blocks-based NAS models in terms of accuracy, precision, recall,$F_{1}$-Score, and model's million floating point operations.

Deep learning and federated learning (FL) play a crucial role in ensuring the security of industrial control systems (ICSs), but they also face severe security threats, especially the threat of backdoor attacks. Most FL backdoor defense methods primarily focus on a single clustering strategy, resulting in low true positive rates (TPR) and true negative rates (TNR) in the attack classification task. Due to the excessive combination scheme of currently available clustering strategies, it is difficult to manually select an appropriate combination scheme of clustering strategies to defense backdoor attacks in federated ICSs. This work is the first time to automatically design a multi-objective clustering combination-based backdoor defense for federated intrusion detection in ICSs, called MoCC-BD-FID. The automated design issue of clustering strategies combination for backdoor defense is formulated as a mixed-variable multi-objective optimization problem, which considers both combinatorial variables, i.e., the combination length and the specific combination of clustering strategies, and continuous variables, i.e., the confidence levels of each combined clustering as the decision variables, and considers maximization of both TPR and TNR as the two objectives. To describe and evolve the different combinations of 12 clustering strategies with confidence levels, we develop an efficient mixed and variable-length encoding mechanism, and the specifically tailored crossover operation and mutation operation under the framework of nondominated sorting genetic algorithm II. The experiments are conducted on the three widely-used ICS datasets including Secure Water Treatment, Water Distribution, and Power System Attack datasets under two different backdoor attacks. The experimental results demonstrate that MoCC-BDFID outperforms the single clustering strategy-based backdoor defense methods and five existing backdoor defense methods, i.e., Krum, Weak-DP, FoolsGold, DeepSight, and CrowdGuard, in terms of the classification accuracy of the poisoned model on regular samples and backdoor samples, TPR, and TNR.

The rapid growth of interconnected smart devices and advanced computing technologies in the industrial Internet of Things (IIoT) has significantly enhanced operational resilience and performance but also increased cybersecurity risks. While deep learning shows promise in IIoT security, it faces challenges due to the lack of labeled data and reliance on human expertise for unsupervised anomaly detection. To address these challenges, a novel automated adversarial deep learning-based unsupervised anomaly detection method called EvoAAE is proposed to optimize the hyperparameters and neural architectures of adversarial variational autoencoder (VAE) for securing IIoT. Specifically, a generative adversarial network-based VAE is employed to adversarially generate multivariate time series. Then, particle swarm optimization with an efficient binary encoding strategy is designed to evolve hyperparameters and neural architectures in adversarial VAE including batch size, learning rate, the type of optimizer, the number of convolutional layer, the number of kernels of convolutional layer, kernel size, the type of normalization layer, and the type of active function. The experimental results indicate that EvoAAE achieves notable performance across four IIoT datasets in industrial control domain, i.e., secure water treatment, water distribution, Mars Science Laboratory, and power system domain, i.e., power system attack with precision of 0.949, 0.8356, 0.972, and 0.981, recall of 0.971, 0.9214, 0.964, and 0.979, and$F_{1}$-score of 0.960, 0.8764, 0.968, and 0.980, respectively.

Enabled by the advances in communication networks, computational units, and control systems, cyber-physical power systems (CPPSs) are anticipated to be complex and smart systems in which a large amount of data are generated, exchanged, and processed for various purposes. Due to these strong interactions, CPPSs will introduce new security vulnerabilities. To ensure secure operation and control of CPPSs, it is essential to detect the locations of the attacked measurements and remove the state bias caused by malicious cyber-attacks such as false data inject attack, jamming attack, denial of service attack, or hybrid attack. Accordingly, this article makes the first contribution concerning the representation-learning-based convolutional neural network (RL-CNN) for intelligent attack localization and system recovery of CPPSs. In the proposed method, the cyber-attacks' locational detection problem is formulated as a multilabel classification problem for CPPSs. An RL-CNN is originally adopted as the multilabel classifier to explore and exploit the implicit information of measurements. By comparing with previous multilabel classifiers, the RL-CNN improves the performance of attack localization for complex CPPSs. Then, to automatically filter out the cyber-attacks for system recovery, a mean-squared estimator is used to handle the difficulty in state estimation with the removal of contaminated measurements. In this scheme, prior knowledge of the system state is obtained based on the outputs of the stochastic power flow or historical measurements. The extensive simulation results in three IEEE bus systems show that the proposed method is able to provide high accuracy for attack localization and perform automatic attack filtering for system recovery under various cyber-attacks.

As the next-generation power grids, smart grids are integrated with advanced information and communication technology (ICT) to make the grid more efficient and stable than conventional power systems. Given the mounting cyber-attack threats, these critical ICT systems create great security issues for smart grids. Additionally, the clever attackers have the ability to not only access and monitor the smart grid, but also hack it by launching well-established cyber-attacks. Thus, this article is devoted to understanding the potential stealthy cyber-attack and its countermeasure. First, this article proposes a stealthy sparse cyber-attack model in an ac smart grid by considering both the residual test-based detector and the interval-state-estimation-based detector, which is not considered in previous studies. The design model is formulated as a constrained optimization problem by minimizing the number of contaminated meters, where the characteristics of two types of detector are considered simultaneously as the constraints for the first time. A constrained differential evolution (CDE) is proposed as the solver because the optimization problem is NP-hard. Then, a generalized-cumulative-sum-based detector is developed to detect the proposed cyber-attacks, where a fractional-order state transition matrix is originally introduced into the estimator to describe the dynamics of the power system. Numerical studies illustrate the feasibility of CDE-based stealthy sparse cyber-attacks and the effectiveness of the proposed countermeasure.

Industrial automation and control systems (IACS) are tremendously employing supervisory control and data acquisition (SCADA) network. However, their integration into IACS is vulnerable to various cyber-attacks. In this article, we first present population extremal optimization (PEO)-based deep belief network detection method (PEO-DBN) to detect the cyber-attacks of SCADA-based IACS. In PEO-DBN method, PEO algorithm is employed to determine the DBN's parameters, including number of hidden units and the size of mini-batch and learning rate, as there is no clear knowledge to set these parameters. Then, to enhance the performance of single method for cyber-attacks detection, the ensemble learning scheme is introduced for aggregation of the proposed PEO-DBN method, called EnPEO-DBN. The proposed detection methods are evaluated on gas pipeline system dataset and water storage tank system dataset from SCADA network traffic by comparing with some existing methods. Through performance analysis, simulation results show the superiority of PEO-DBN and EnPEO-DBN.

The optimal generation of initial connection weight parameters and dynamic updating strategies of connection weights are critical for adjusting the performance of back-propagation (BP) neural networks. This paper presents an adaptive fractional-order BP neural network abbreviated as PEO-FOBP for handwritten digit recognition problems by combining a competitive evolutionary algorithm called population extremal optimization and a fractional-order gradient descent learning mechanism. Population extremal optimization is introduced to optimize a large number of initial connection weight parameters and fractional-order gradient descent learning mechanism is designed to update these connection weight parameters adaptively during the evolutionary process of fractional-order BP neural network. The extensive experimental results for a well-known MNIST handwritten digits dataset have demonstrated that the proposed PEO-FOBP outperforms the original fractional-order BP neural network and the traditional integer-order BP neural network in terms of training and testing accuracies.

As a typical kind of the Internet of Things, smart grid has attracted a lot of attentions. The power energy management of smart grid is of great importance for energy distribution, system security, and market economics. One of the most important issues is the accurate and stable prediction of wind speed for the optimal operation and management of wind power generations connected to smart grid. In this paper, a novel two-layer nonlinear combination method termed as EEL-ELM is developed for short-term wind speed prediction problems, such as 10-min ahead and 1-h ahead. The first layer is based on extreme learning machine (ELM), Elman neural network (ENN), and long short term memory neural network (LSTM) to separately forecast wind speed by making use of their merits of calculation speed or strong ability in forecasting, and obtain three forecasting results. Then, we propose the second layer by making use of ELM-based nonlinear aggregated mechanism to alleviate the inherent weakness of single method and linear combination. Two real-world case studies, gathered from Inner Mongolia's wind farm in China, are implemented to demonstrate the effectiveness of the proposed EEL-ELM method. By comparing with other eight wind speed prediction methods, the simulation results reveal that EEL-ELM can achieve better forecasting performance according to three evaluation metrics and three statistical tests.