Copyright © 2026 Authors retain the copyright of this article. This article is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

@article{184325,
        author = {Shantanu Kumar Suman and Ramakant Pal},
        title = {A Comparative Study of Machine Learning and Deep Learning Models for Intrusion Detection in ICS},
        journal = {International Journal of Innovative Research in Technology},
        year = {2025},
        volume = {12},
        number = {4},
        pages = {885-892},
        issn = {2349-6002},
        url = {https://ijirt.org/article?manuscript=184325},
        abstract = {Industrial Control Systems (ICS) are increasingly targeted by cyber-attacks, so it is required to have a robust intrusion detection. Benchmark ICS dataset[1] (gas pipeline and water tank) contains 17 sensor features across ~274k samples (78% normal, 22% attacks)[1]. We evaluate multiple models – a multilayer perceptron (MLP), a 1D convolutional neural network (CNN), XGBoost, and TabNet – on this dataset. Our methodology has various stages such as  data cleaning, label encoding, feature scaling, and class balancing (SMOTE) to resolve the heavy class imbalance (78% normal)[1]. The MLP and CNN are trained with cross-entropy loss and the Adam optimizer; XGBoost is trained with multi-class logistic loss; TabNet is used as an advanced tabular-deep model[2][3]. We measure accuracy, precision, recall, and F1-score. The result of the experiment shows that the XGBoost outperforms TabNet, MLP and CNN. In particular, our XGBoost achieves ~97% overall accuracy (versus ~94% for a baseline DNN reported in prior work[4][5]), with balanced precision/recall across all attack classes. Figures include precision–recall curves and per-class recall bar charts comparing all models. We analyze these results considering dataset imbalance and model capacity. Our XGBoosts’s strong performance (=0.95 F1) aligns with prior MLP-based ICS IDS studies[5][6]. We conclude that deep architecture (especially XGBoost) better capture ICS traffic patterns than traditional models, though ensemble and online learning are needed for future real-time ICS security.},
        keywords = {Intrusion detection, Industrial control systems, Benchmark ICS dataset, machine learning, deep learning, CNN, XGBoost, TabNet, class imbalance, SMOTE.},
        month = {September},
        }