Abstract:Traditional security detection methods face challenges in identifying zero-day attacks in critical infrastructures (CIs) integrated with the industrial internet of things (IIoT). These attacks exploit unknown vulnerabilities and are difficult to detect due to their connection to physical systems. The integration of legacy ICS networks with modern computing and networking technologies has significantly expanded the attack surface, making these systems more susceptible to cyber-attacks. Despite existing security measures, attackers continually find ways to breach these operating networks. Anomaly detection systems are critical in protecting these CIs from current cyber threats. This study investigates the effectiveness of unsupervised anomaly detection models in detecting operational anomalies that could lead to cyber-attacks, thereby disrupting and negatively impacting quality of life. We preprocess the data with a focus on cybersecurity and chose the SWAT dataset because it accurately represents the types of attack vectors that critical infrastructures commonly encounter. We evaluated the performance of isolation forest (IF), local outlier factor (LOF), one-class SVM (OCSVM), and Autoencoder algorithms—trained exclusively on normal data—in enhancing cybersecurity within IIoT environments. Our comprehensive analysis includes an assessment of each model's detection capabilities. The findings highlight the VAE-LSTM model's potential to identify cyber-attacks within seconds in a high-frequency dataset, suggesting near real-time detection capability. The final model combines the reconstruction ability of the variational autoencoder (VAE) with regularization using the Kullback–Leibler divergence, reflecting the non-Gaussian nature of industrial system data. Our model successfully detected 23 out of 26 attack scenarios in the SWAT dataset, demonstrating its effectiveness in improving the security of IIoT-based CIs.

Few-shot Weakly-supervised Cybersecurity Anomaly Detection

A Hybrid Deep Learning Anomaly Detection Framework for Intrusion Detection

An Unsupervised Framework for Anomaly Detection in a Water Treatment System

Deep Learning for Anomaly Detection in IoT Systems: Techniques, Applications, and Future Directions

Weakly-supervised Joint Anomaly Detection and Classification

A Gated Few-shot Learning Model for Anomaly Detection

Siamese Neural Network Based Few-Shot Learning for Anomaly Detection in Industrial Cyber-Physical Systems

Few-Shot Anomaly Detection with Adversarial Loss for Robust Feature Representations

Deep Learning-Based Anomaly Detection in Network Traffic for Cyber Threat Identification

Few-shot Online Anomaly Detection and Segmentation

Enhancing Critical Infrastructure Security: Unsupervised Learning Approaches for Anomaly Detection

Model-agnostic generation-enhanced technology for few-shot intrusion detection

Enhancing Cybersecurity in IoT Networks: A Deep Learning Approach to Anomaly Detection

Few-shot Detection of Anomalies in Industrial Cyber-Physical System via Prototypical Network and Contrastive Learning

Deep Learning-based Anomaly Detection in Cyber-physical Systems

A Deep Learning Ensemble for Network Anomaly and Cyber-Attack Detection

From Unsupervised to Few-shot Graph Anomaly Detection: A Multi-scale Contrastive Learning Approach

Strengthening Network Intrusion Detection in IoT Environments with Self-Supervised Learning and Few Shot Learning

Dynamic Threshold-based Two-layer Online Unsupervised Anomaly Detector

A few-shot deep learning approach for improved intrusion detection

Attention-GAN for Anomaly Detection: A Cutting-Edge Approach to Cybersecurity Threat Management