Industrial Control Systems (ICS) serve as the backbone of critical infrastructures, controlling and automating the stable operation of industrial processes. With the progressive integration of industrial processes and Information Technology (IT), ICS have evolved from closed, isolated systems to open, interconnected networks. This evolution has significantly expanded attack surfaces and increased security vulnerabilities, making ICS more susceptible to cyber attacks. Intrusion Detection Systems (IDS), particularly those based on deep learning that can learn spatio-temporal features from raw network traffic, are the most effective methods for protecting ICS. However, most existing DL-based IDS adopt a Traditional Spatio-Temporal Feature (TSTF) view for representation learning, which often ignores the unique characteristics of industrial protocols and ICS communication patterns, and loses important fine-grained discriminative information. As a result, the detection models perform poorer with higher false negatives and false positives when applied in ICS. To overcome the above issue, we propose a novel Segment-Based Spatio-Temporal Feature (SSTF) view, which leverages temporal dependencies among the same segments in different packets within a flow and spatial correlations between different segments. Additionally, we introduce a dual-view intrusion detection framework-DVSTdetector, that integrates both the TSTF and SSTF views and employs two workflows to promote better representation learning from both global and local perspectives in parallel, obtaining more robust spatiotemporal features. A publicly available dataset (WDT) and a private dataset (XLP) are used to evaluate our approach. The experimental results demonstrate its effectiveness and superiority, outperforming six state-of-the-art approaches and achieving high performance across six metrics: Accuracy ($99.35 \%$, 99.87%), Precision (99.28%, 99.93%), Recall (98.52%, 99.90%), F1-score ($\mathbf{9 8. 9 0 \%, ~} \mathbf{9 9. 9 1 \%}$), AUC-ROC ($\mathbf{9 9. 1 1 \%, ~ 9 9. 8 4 \%), ~ a n d ~ a ~ l o w ~ F a l s e ~}$ Positive Rate ($\mathbf{0. 2 9 \%, ~} \mathbf{0. 2 1 \%}$).

Industrial Control System (ICS) is vital to critical infrastructures, yet it faces increasing security threats. Current Intrusion Detection System (IDS) designed for ICS often overlooks the unbalanced resource distribution among devices at different layers and primarily focus on known attacks, rendering it difficult to be deployed on all key nodes and vulnerable to unknown threats. To address above issues, we propose a Combined Intrusion Detection Framework (CIDF). This innovative approach is based on strategy of “multi-level layered deployment, combined detection”, deploying the Packet Signature model and the Enhanced Fast Search and Find of Density Peaks (EFSFDP) model on devices at different layers. To achieve optimal use of resource and full protection for ICS and combining the advantages of multiple detection methods to effective detect both known and unknown attacks. The Evaluation using a public gas pipeline dataset and a private dataset shows our approach outperforms existing methods, achieving an average Accuracy, Precision, and Recall of 94%, 95.5%, and 86.5% respectively, and along with superior detection speed.