Cluster‐based decentralized transformers for cyberattack detection and resilient recovery in integrated process networks

Abstract

Abstract Highly integrated process systems are vulnerable to adversarial cyberattacks that can corrupt sensor measurements, destabilize closed‐loop operation, and propagate across interconnected units. To address these challenges, this study presents decentralized transformer‐based detection and identification frameworks that integrate graph‐based community detection with topology‐aware process decomposition, reducing dimensionality while preserving structural interdependencies. Using a benzene alkylation process as a benchmark, two architectures are evaluated: a joint end‐to‐end transformer and a hierarchical two‐tier framework. Across multiple attack types, results show that subsystem‐level decomposition improves the consistency of network‐level attack detection and identification. Comparisons with centralized approaches further demonstrate that joint learning within the decentralized end‐to‐end transformer outperforms hierarchical task separation for network‐level detection and identification, although reconstruction performance remains scenario‐dependent. The proposed frameworks are coupled with a localized extended Kalman filter‐based reconstruction to recover compromised measurements and maintain closed‐loop stability, enabling effective recovery from single‐sensor attacks and stable mitigation of coordinated multi‐sensor attacks.