Hoa Ngoc Nguyen

Intrusion detection in Industrial Control Systems (ICS) remains challenging due to evolving attack behaviors, limited labeled data, train–deployment distribution mismatch, and strict timing constraints of industrial protocols. This paper presents CSLID, a practical intrusion detection framework for the IEC 60870-5-104 and DNP3 protocols. CSLID integrates shift-aware feature screening with SHAP-guided feature selection, controlled offline LLM-based tabular augmentation, and lightweight parallel ensemble inference to improve benchmark stability and deployment efficiency under changing traffic conditions. The augmentation module is not assumed to generate fully realistic traffic; instead, it is used to expand training-data diversity for rare and evolving attack categories. Constraint checks, filtering, and quantitative validity/artifact analyses are applied to reduce generation-induced risks. Detection decisions are produced through a parallel weighted-voting ensemble of heterogeneous base classifiers, enabling low-latency inference while maintaining competitive detection performance. Experiments on two benchmark datasets show that CSLID achieves an F1-score of 87.47% with a false alarm rate of 1.13% on IEC 60870-5-104, and an F1-score of 99.86% with a false alarm rate of 0.01% on DNP3 dataset. Comparative results indicate competitive and, in several cases, higher reported benchmark performance than prior approaches under broadly comparable reported settings. Offline evaluations further show per-flow processing latencies on the order of tens of microseconds, suggesting compatibility with typical ICS/SCADA timing requirements. Validation in hardware-in-the-loop or real industrial testbeds remains future work.