## 5 Conclusions  
In order to ensure the security of industrial control networks and the accuracy of detecting network traffic, this paper proposes a hybrid machine learning and neural network model for a ETM-TBD intrusion detection model. First of all, the quality of the dataset can be significantly improved through preprocessing and feature engineering, which can be used for model training to make the results obtained after model training more accurate. The machine learning stacking tree model proposed in this paper can better complete the identification of intrusion attacks in industrial control networks. But the stacking machine learning tree model has similar shortcomings compared with traditional machine learning; that is, machine learning cannot adaptively learn features in data well and cannot be better adapted to complex datasets and tasks. In this regard, the integrated model of hybrid machine learning and neural network models is relatively better. It not only adapts itself to more complex tasks but also represents the data in a distributed manner, thus better handling high dimensional data. The Transformer module proposed in this paper can better handle classification tasks by establishing the connection between different features. And the BiGRU module can better capture the correlation and timing in the data by learning context information when dealing with high dimensions. The BiGRU module is very suitable for the situation, which can handle high dimensions. It is very suitable for the situation where the data volume of the industrial control network is relatively large. The DNN module adopted in the end supplements the first two modules to a certain extent. By weighing and nonlinearly transforming each layer of the model, higher-level features can be better learned, thereby achieving more accurate classification.  
Through the performance evaluation of an industrial robotic arm control laboratory dataset, the ETM-TBD intrusion detection model proposed in this paper can effectively detect various known attack patterns. The detection accuracy rate of the dataset is 97.24%, and the average F1 score is 0.9665. Therefore, the feasibility of this model in the industrial control network is realized.  
At the same time, the model in this paper has some drawbacks. For example, when we extract the more important features, the method based on IG-FCBF is not the best. Sometimes, some relatively unimportant features will be selected as well. In addition, we cannot handle unknown network traffic attacks well. As of now, if we are attacked by unknown types of attacks, we generally categorize them into the class of attack types that are most similar to them. Therefore, in our future work, we will focus on these two aspects, especially on the detection algorithm for open-set identification. We hope to mix the algorithms of open-set recognition into our intrusion detection system to face a variety of attacks in the industrial control field.  
Conceptualization, methodology, validation, writing, D.S.; Conceptualization, Data curation, Formal analysis, D.S., K.J. and J.L.; Supervision, funding acquisition and review, D.S., L.Z. and X.Z. All authors have read and agreed to the published version of the manuscript.  
This research received no external funding.  
Not applicable.  
The authors are not allowed to publish the data.  
The authors declare no conflict of interest.