Abstract:Traditional security detection methods face challenges in identifying zero-day attacks in critical infrastructures (CIs) integrated with the industrial internet of things (IIoT). These attacks exploit unknown vulnerabilities and are difficult to detect due to their connection to physical systems. The integration of legacy ICS networks with modern computing and networking technologies has significantly expanded the attack surface, making these systems more susceptible to cyber-attacks. Despite existing security measures, attackers continually find ways to breach these operating networks. Anomaly detection systems are critical in protecting these CIs from current cyber threats. This study investigates the effectiveness of unsupervised anomaly detection models in detecting operational anomalies that could lead to cyber-attacks, thereby disrupting and negatively impacting quality of life. We preprocess the data with a focus on cybersecurity and chose the SWAT dataset because it accurately represents the types of attack vectors that critical infrastructures commonly encounter. We evaluated the performance of isolation forest (IF), local outlier factor (LOF), one-class SVM (OCSVM), and Autoencoder algorithms—trained exclusively on normal data—in enhancing cybersecurity within IIoT environments. Our comprehensive analysis includes an assessment of each model's detection capabilities. The findings highlight the VAE-LSTM model's potential to identify cyber-attacks within seconds in a high-frequency dataset, suggesting near real-time detection capability. The final model combines the reconstruction ability of the variational autoencoder (VAE) with regularization using the Kullback–Leibler divergence, reflecting the non-Gaussian nature of industrial system data. Our model successfully detected 23 out of 26 attack scenarios in the SWAT dataset, demonstrating its effectiveness in improving the security of IIoT-based CIs.

A Lightweight Unsupervised Intrusion Detection Model Based on Variational Auto-Encoder

Robust and Unsupervised KPI Anomaly Detection Based on Highly Sensitive Conditional Variational Auto-Encoders.

Lightweight Long Short-Term Memory Variational Auto-Encoder for Multivariate Time Series Anomaly Detection in Industrial Control Systems

Network Intrusion Detection Based on Supervised Adversarial Variational Auto-Encoder With Regularization

Improving the Classification Effectiveness of Intrusion Detection by Using Improved Conditional Variational AutoEncoder and Deep Neural Network

Intrusion Detection System After Data Augmentation Schemes Based on the VAE and CVAE

Conditional Variational Auto-Encoder and Extreme Value Theory Aided Two-Stage Learning Approach for Intelligent Fine-Grained Known/Unknown Intrusion Detection

Toward Effective Intrusion Detection Using Log-Cosh Conditional Variational Autoencoder

Unknown Security Attack Detection of Industrial Control System by Deep Learning

Enhancing Critical Infrastructure Security: Unsupervised Learning Approaches for Anomaly Detection

Semi-supervised intrusion detection system for in-vehicle networks based on variational autoencoder and adversarial reinforcement learning

Constrained Twin Variational Auto-Encoder for Intrusion Detection in IoT Systems

A Lightweight Intelligent Network Intrusion Detection System Using One-Class Autoencoder and Ensemble Learning for IoT

An Efficient Anomaly Detection Method for Industrial Control Systems: Deep Convolutional Autoencoding Transformer Network

Detecting In-vehicle Intrusion via Semi-supervised Learning-based Convolutional Adversarial Autoencoders

A CVAE-Based Anomaly Detection Algorithm for Cyber Physical Attacks for Water Distribution Systems

An Efficient Intrusion Detection Method Based on LightGBM and Autoencoder

Variational LSTM Enhanced Anomaly Detection for Industrial Big Data

A Lightweight Intrusion Detection System for Vehicular Networks Based on an Improved ViT Model

Malicious Behavior Catcher: an Intrusion Detection System Based on VAE

Industrial Control Malicious Traffic Anomaly Detection System Based on Deep Autoencoder