Abstract:Traditional security detection methods face challenges in identifying zero-day attacks in critical infrastructures (CIs) integrated with the industrial internet of things (IIoT). These attacks exploit unknown vulnerabilities and are difficult to detect due to their connection to physical systems. The integration of legacy ICS networks with modern computing and networking technologies has significantly expanded the attack surface, making these systems more susceptible to cyber-attacks. Despite existing security measures, attackers continually find ways to breach these operating networks. Anomaly detection systems are critical in protecting these CIs from current cyber threats. This study investigates the effectiveness of unsupervised anomaly detection models in detecting operational anomalies that could lead to cyber-attacks, thereby disrupting and negatively impacting quality of life. We preprocess the data with a focus on cybersecurity and chose the SWAT dataset because it accurately represents the types of attack vectors that critical infrastructures commonly encounter. We evaluated the performance of isolation forest (IF), local outlier factor (LOF), one-class SVM (OCSVM), and Autoencoder algorithms—trained exclusively on normal data—in enhancing cybersecurity within IIoT environments. Our comprehensive analysis includes an assessment of each model's detection capabilities. The findings highlight the VAE-LSTM model's potential to identify cyber-attacks within seconds in a high-frequency dataset, suggesting near real-time detection capability. The final model combines the reconstruction ability of the variational autoencoder (VAE) with regularization using the Kullback–Leibler divergence, reflecting the non-Gaussian nature of industrial system data. Our model successfully detected 23 out of 26 attack scenarios in the SWAT dataset, demonstrating its effectiveness in improving the security of IIoT-based CIs.

Fusing Design and Machine Learning for Anomaly Detection in Water Treatment Plants

An Unsupervised Framework for Anomaly Detection in a Water Treatment System

Adversarial Attacks and Mitigation for Anomaly Detectors of Cyber-Physical Systems

Multi-parameters fusion algorithm for detecting anomalous water quality

Improving SIEM for Critical SCADA Water Infrastructures Using Machine Learning

Anomaly detection using isomorphic analysis for false data injection attacks in industrial control systems

Deep Learning-Based Cyber–Physical Feature Fusion for Anomaly Detection in Industrial Control Systems

An Attention-Based Deep Generative Model for Anomaly Detection in Industrial Control Systems

Anomaly-Based Intrusion Detection System for Cyber-Physical System Security

Enhanced Anomaly Detection in Industrial Control Systems aided by Machine Learning

Machine learning for intrusion detection in industrial control systems: challenges and lessons from experimental evaluation

Anomaly detection for early ransomware and spyware warning in nuclear power plant systems based on FusionGuard

Lightweight Long Short-Term Memory Variational Auto-Encoder for Multivariate Time Series Anomaly Detection in Industrial Control Systems

Anomaly events classification and detection system in critical industrial internet of things infrastructure using machine learning algorithms

A framework for automated anomaly detection in high frequency water-quality data from in situ sensors

Machine learning and user interface for cyber risk management of water infrastructure

Enhancing Critical Infrastructure Security: Unsupervised Learning Approaches for Anomaly Detection

A Comparative Study of Anomaly Detection Techniques for IoT Security Using Adaptive Machine Learning for IoT Threats

Cross-Modal Learning for Anomaly Detection in Fused Magnesium Smelting Process: Methodology and Benchmark

Anomaly Detection and Classification in Water Distribution Networks Integrated with Hourly Nodal Water Demand Forecasting Models and Feature Extraction Technique

Artificial immunity based distributed and fast anomaly detection for Industrial Internet of Things