A Novel Transformer Model Enhanced by Scaled-CNN and Bi-LSTM Hybrid Networks for Real-time Threat Identification within SCADA Systems

Modern Supervisory Control and Data Acquisition (SCADA) systems are essential for industrial automation and infrastructure monitoring, yet they confront escalating cybersecurity risks due to Internet of Things (IoT) integration. Their inherent vulnerabilities, such as insecure real-time protocols and endpoint-only protection mechanisms, result in traditional general-purpose network security solutions providing only partial safeguarding of data and traffic. To mitigate these weaknesses, a four-engine architecture featuring a self-adaptive PCA selector for automated feature filtering is first proposed. Subsequently, the novel Transformer model enhanced by Scaled-CNN and Bi-LSTM hybrid networks (Trans+scaled-CNN&bi-LSTM) is proposed, which combines spatial feature extraction by the Scaled-CNN, temporal pattern learning by Bi-LSTM, and dynamic weight optimization by Transformer for intrusion detection. Finally, this integrated approach is validated on SCADA-specific datasets, achieving an Accuracy of 99.14% and a Loss value of 0.0335. And the comparative and ablation experiments confirm the methodology’s superiority in real-time threat identification within SCADA systems.