Abstract:Traditional security detection methods face challenges in identifying zero-day attacks in critical infrastructures (CIs) integrated with the industrial internet of things (IIoT). These attacks exploit unknown vulnerabilities and are difficult to detect due to their connection to physical systems. The integration of legacy ICS networks with modern computing and networking technologies has significantly expanded the attack surface, making these systems more susceptible to cyber-attacks. Despite existing security measures, attackers continually find ways to breach these operating networks. Anomaly detection systems are critical in protecting these CIs from current cyber threats. This study investigates the effectiveness of unsupervised anomaly detection models in detecting operational anomalies that could lead to cyber-attacks, thereby disrupting and negatively impacting quality of life. We preprocess the data with a focus on cybersecurity and chose the SWAT dataset because it accurately represents the types of attack vectors that critical infrastructures commonly encounter. We evaluated the performance of isolation forest (IF), local outlier factor (LOF), one-class SVM (OCSVM), and Autoencoder algorithms—trained exclusively on normal data—in enhancing cybersecurity within IIoT environments. Our comprehensive analysis includes an assessment of each model's detection capabilities. The findings highlight the VAE-LSTM model's potential to identify cyber-attacks within seconds in a high-frequency dataset, suggesting near real-time detection capability. The final model combines the reconstruction ability of the variational autoencoder (VAE) with regularization using the Kullback–Leibler divergence, reflecting the non-Gaussian nature of industrial system data. Our model successfully detected 23 out of 26 attack scenarios in the SWAT dataset, demonstrating its effectiveness in improving the security of IIoT-based CIs.

A Novel Warning Identification Framework for Risk-Informed Anomaly Detection

An Unsupervised Framework for Anomaly Detection in a Water Treatment System

Anomaly Detection for Incident Response at Scale

A Novel Early Warning Method for Handling Non-Homogeneous Information

A framework for automated anomaly detection in high frequency water-quality data from in situ sensors

A Novel Unsupervised Anomaly Detection Framework for Early Fault Detection in Complex Industrial Settings

Adaptable and Interpretable Framework for Novelty Detection in Real-Time IoT Systems

Real-World Anomaly Detection by using Digital Twin Systems and Weakly-Supervised Learning

Super Learner Ensemble for Anomaly Detection and Cyber-risk Quantification in Industrial Control Systems

Develop End-to-End Anomaly Detection System

No Need to Know Physics: Resilience of Process-based Model-free Anomaly Detection for Industrial Control Systems

Real-time Risk Analysis Method for Diagnosis and Warning of Offshore Downhole Drilling Incident

From Explanation to Action: An End-to-End Human-in-the-loop Framework for Anomaly Reasoning and Management

A Real-Time Novelty Recognition Framework Based on Machine Learning for Fault Detection

Cyber Anomaly Detection Using Graph-node Role-dynamics

Should I Raise The Red Flag? A comprehensive survey of anomaly scoring methods toward mitigating false alarms

Higher-Order Moment-Based Anomaly Detection

Unraveling False Positives in Unsupervised Defect Detection Models: A Study on Anomaly-Free Training Datasets

An Industrial Strength Novelty Detection Framework for Autonomous Equipment Monitoring and Diagnostics

Enhancing Critical Infrastructure Security: Unsupervised Learning Approaches for Anomaly Detection

A Novel Data Mining-Based Method for Alert Reduction and Analysis.