Enhancing Critical Infrastructure Security: Unsupervised Learning Approaches for Anomaly Detection
Open accessAbstract
Traditional security detection methods face challenges in identifying zero-day attacks in critical infrastructures (CIs) integrated with the industrial internet of things (IIoT). These attacks exploit unknown vulnerabilities and are difficult to detect due to their connection to physical systems. The integration of legacy ICS networks with modern computing and networking technologies has significantly expanded the attack surface, making these systems more susceptible to cyber-attacks. Despite existing security measures, attackers continually find ways to breach these operating networks. Anomaly detection systems are critical in protecting these CIs from current cyber threats. This study investigates the effectiveness of unsupervised anomaly detection models in detecting operational anomalies that could lead to cyber-attacks, thereby disrupting and negatively impacting quality of life. We preprocess the data with a focus on cybersecurity and chose the SWAT dataset because it accurately represents the types of attack vectors that critical infrastructures commonly encounter. We evaluated the performance of isolation forest (IF), local outlier factor (LOF), one-class SVM (OCSVM), and Autoencoder algorithms—trained exclusively on normal data—in enhancing cybersecurity within IIoT environments. Our comprehensive analysis includes an assessment of each model’s detection capabilities. The findings highlight the VAE-LSTM model’s potential to identify cyber-attacks within seconds in a high-frequency dataset, suggesting near real-time detection capability. The final model combines the reconstruction ability of the variational autoencoder (VAE) with regularization using the Kullback–Leibler divergence, reflecting the non-Gaussian nature of industrial system data. Our model successfully detected 23 out of 26 attack scenarios in the SWAT dataset, demonstrating its effectiveness in improving the security of IIoT-based CIs.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Their results empirically validated the effectiveness of reconstruction-error-based techniques.
“Their results empirically validated the effectiveness of reconstruction-error-based techniques.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [82]
Section 5.5.1 reports that the VAE-LSTM produced low reconstruction errors for normal data and higher errors for anomalies; the study identified 23 of 26 attack scenarios. But Section 5.4 reports that a vanilla autoencoder’s reconstruction error stayed low for both normal and abnormal data, limiting its detection. The results support the effectiveness of the VAE-LSTM approach, not reconstruction-error-based techniques generally. (LLM, conf=0.86)
Experimental — accuracy not yet measuredReconstruction-error-based methods are particularly effective for detecting sensor/actuator faults, false data injection, command manipulation, and generic injection-type attacks that cause local or global distortions in multivariate process trajectories.
“First, these methods are particularly effective for detecting sensor/actuator faults, false data injection, command manipulation, and generic injection-type attacks that cause local or global distortions in multivariate process trajectories [77,79,81-83,86,87].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [82]
Section 5.5.1 (page unavailable) reports that the VAE-LSTM detected 23 of 26 evaluated attack scenarios and that deviations from learned sensor patterns are difficult to reconstruct. Section 4.1 (page unavailable) identifies sensors and actuators as attack surfaces. The paper does not establish particular effectiveness for sensor/actuator faults, false data injection, command manipulation, and generic injection attacks as distinct categories; its evaluation concerns cyberattacks with physical effects in the SWAT water-treatment dataset. (LLM, conf=0.84)
Experimental — accuracy not yet measuredAutoencoder-like models (AE, VAE, OC-NN) and PCA-based approaches can flag process states that lie outside the learned normal manifold, including zero-day attack scenarios that were not explicitly seen during training.
“By learning a compact representation of normal operating conditions and monitoring reconstruction error or boundary-based anomaly scores, autoencoder-like models (AE, VAE, OC-NN) and PCA-based approaches can flag process states that lie outside the learned normal manifold, including zero-day attack scenarios that were not explicitly seen during training [77,79,81-83,86,87].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [82]
Section 4.3 (page unavailable) explains how autoencoders trained on normal data can flag deviations through reconstruction error, and the Conclusions report detecting attacks with models trained only on normal data. The paper discusses OC-NN only as a prior study, does not establish the claim for PCA-based approaches, and reports that its vanilla autoencoder missed many attacks. Thus it supports the general mechanism and zero-day rationale, but not the full list of methods as stated. (LLM, conf=0.88)
Experimental — accuracy not yet measuredThe dataset distribution for reconstruction-error-based anomaly detection studies shows a strong reliance on a limited set of public process benchmarks (SWaT, HAI, BATADAL, and TE) supplemented by a small number of custom-built CAN fieldbus and wind-turbine SCADA datasets.
“Finally, the dataset distribution again reveals a strong reliance on a limited set of public process benchmarks-SWaT, HAI, BATADAL, and TE-supplemented by a small number of custom-built CAN fieldbus and wind-turbine SCADA datasets [77,79,81-83,85-87].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [82]
Split into 2 atoms — 0 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 1 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measuredComparative studies on SWaT and TE data further confirm that reconstruction-error-based detectors often outperform classical statistical methods in capturing complex nonlinear relationships among process variables.
“Comparative studies on SWaT and TE data further confirm that reconstruction-error-based detectors often outperform classical statistical methods in capturing complex nonlinear relationships among process variables [82,86].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [82]
Section 5.5.1 compares models on SWAT and identifies VAE-LSTM as the best-performing evaluated model, supporting the SWAT portion of the claim. The paper does not report a comparison on TE data or establish that reconstruction-error detectors outperform classical statistical methods specifically because they capture nonlinear relationships among process variables (section 5.5.1; page not available). (LLM, conf=0.88)
Experimental — accuracy not yet measured
Pinto et al. [82] conducted a comparative analysis of various unsupervised learning approaches using the SWaT dataset.
“Using the SWaT dataset, Pinto et al. [82] conducted a comparative analysis of various unsupervised learning approaches.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [82]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
A Design Science Research Methodology for Information Systems Research
Peffers, K., Tuunanen, T., Rothenberger, M. A., & Chatterjee, S. (2007) · Journal of Management Information Systems · doi:10.2753/mis0742-1222240302 · Cited by 7,832 · cited 1× · see citing works
“This methodology offers a structured framework for researchers to construct and assess artifacts, with the goal of producing actionable insights that benefit both theoretical understanding and practical application in addressing real-world challenges [15].”
Ferrag, M. A., Friha, O., Hamouda, D., Maglaras, L. A., & Janicke, H. (2022) · IEEE Access · doi:10.1109/access.2022.3165809 · Cited by 1,308 · see citing works
Alsaedi, A., Moustafa, N., Tari, Z., Mahmood, A. N., & Anwar, A. (2020) · IEEE Access · doi:10.1109/access.2020.3022862 · Cited by 983 · see citing works
Towards a Standard Feature Set for Network Intrusion Detection System Datasets
Sarhan, M., Layeghy, S., & Portmann, M. (2021) · Mobile Networks and Applications · doi:10.1007/s11036-021-01843-0 · Cited by 407 · see citing works
Al-Hawawreh, M. S., Sitnikova, E., & Aboutorab, N. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3102056 · Cited by 285 · see citing works
Pinto, A., Herrera, L.-C., Donoso, Y., & Gutiérrez, J. (2023) · Sensors · doi:10.3390/s23052415 · Cited by 212 · see citing works
Self-citationGenerating realistic intrusion detection system dataset based on fuzzy qualitative modeling
Haider, W., Hu, J., Slay, J., Turnbull, B., & Xie, Y. (2017) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2017.03.018 · Cited by 207 · see citing works
Machine Learning Based IoT Intrusion Detection System: An MQTT Case Study (MQTT-IoT-IDS2020 Dataset)
Hindy, H., Bayne, E., Bureš, M., Atkinson, R. C., Tachtatzis, C., & Bellekens, X. (2021) · Lecture notes in networks and systems · doi:10.1007/978-3-030-64758-2_6 · Cited by 199 · see citing works
Umer, M., Junejo, K. N., Jilani, M. T., & Mathur, A. P. (2022) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2022.100516 · Cited by 172 · see citing works
MedBIoT: Generation of an IoT Botnet Dataset in a Medium-sized IoT Network
Guerra-Manzanares, A., Medina-Galindo, J., Bahşi, H., & Nõmm, S. (2020) · International Conference on Information Systems Security and Privacy (ICISSP) · doi:10.5220/0009187802070218 · Cited by 165 · see citing works
A Comparative Study of Time Series Anomaly Detection Models for Industrial Control Systems
Kim, B., Alawami, M. A., Kim, E., Oh, S., Park, J., & Kim, H. (2023) · Sensors · doi:10.3390/s23031310 · Cited by 126 · see citing works
Nedeljkovic, D. M., & Jakovljević, Ž. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102585 · Cited by 113 · see citing works
Khan, I. A., Keshk, M., Pi, D., Khan, N., Hussain, Y., & Soliman, H. (2022) · Ad Hoc Networks · doi:10.1016/j.adhoc.2022.102930 · Cited by 110 · see citing works
APAD: Autoencoder-based Payload Anomaly Detection for industrial IoE
Kim, S.-J., Jo, W., & Shon, T. (2019) · Applied Soft Computing · doi:10.1016/j.asoc.2019.106017 · Cited by 91 · see citing works
Multivariate Abnormal Detection for Industrial Control Systems Using 1D CNN and GRU
Xie, X., Wang, B., Wan, T., & Tang, W. (2020) · IEEE Access · doi:10.1109/access.2020.2993335 · Cited by 91 · see citing works
Khan, I. A., Pi, D., Abbas, M. Z., Zia, U., Hussain, Y., & Soliman, H. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2022.3200048 · Cited by 79 · see citing works
MADICS: A Methodology for Anomaly Detection in Industrial Control Systems
Gómez, Á. L. P., Maimó, L. F., Celdrán, A. H., & Clemente, F. J. G. (2020) · Symmetry · doi:10.3390/sym12101583 · Cited by 76 · see citing works
A multilayer perceptron model for anomaly detection in water treatment plants
Gauthama Raman, M. R., Somu, N., & Mathur, A. P. (2020) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2020.100393 · Cited by 72 · see citing works
Fährmann, D., Damer, N., Kirchbuchner, F., & Kuijper, A. (2022) · Sensors · doi:10.3390/s22082886 · Cited by 59 · see citing works
Anomaly detection for a water treatment system based on one-class neural network
Aboah Boateng, E., Bruce, J. W., & Talbert, D. A. (2022) · IEEE Access · doi:10.1109/access.2022.3218624 · Cited by 44 · see citing works
Novikova, E. S., Doynikova, E. V., & Golubev, S. (2022) · Algorithms · doi:10.3390/a15040104 · Cited by 33 · see citing works
Sun, H., Huang, Y., Han, L., Fu, C., Liu, H., & Long, X. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103570 · Cited by 33 · see citing works
A comprehensive instrument for identifying critical information infrastructure services
Herrera, L.-C., & Maennel, O. (2019) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2019.02.001 · Cited by 27 · see citing works
Self-citationAutoencoder Based Anomaly Detection for SCADA Networks
Nazir, S., Patel, S. D., & Patel, D. A. (2021) · International Journal of Artificial Intelligence and Machine Learning · doi:10.4018/ijaiml.20210701.oa6 · Cited by 24 · see citing works
Intrusion Detection for Industrial Control Systems Based on Improved Contrastive Learning SimCLR
Li, C., Li, F., Zhang, L., Yang, A., Hu, Z., & He, M. (2023) · Applied Sciences · doi:10.3390/app13169227 · Cited by 14 · see citing works
A Causality-Inspired Approach for Anomaly Detection in a Water Treatment Testbed
Koutroulis, G., Mutlu, B., & Kern, R. (2022) · Sensors · doi:10.3390/s23010257 · Cited by 12 · see citing works
Flagged first, then by citations
Research works printed but not linked: 1
- UK's National Cyber Security Centre: NCSC Annual Review 2023, London (2023).
Cited by
Sorted by citations
VAE-Based Real-Time Anomaly Detection Approach for Enhanced V2X Communication Security
Gebrezgiher, Y. T., Jeremiah, S. R., Gritzalis, S., & Park, J. H. (2025) · Applied Sciences · doi:10.3390/app15126739 · Cited by 18 · see citing works
Guo, G., Qamar, F., Kazmi, S. H. A., & Rehman, M. H. U. (2025) · Internet of Things · doi:10.1016/j.iot.2025.101686 · Cited by 12 · see citing works
Seo, J. K., Lee, J., Kim, B., Shim, W., & Seo, J. T. (2025) · Electronics · doi:10.3390/electronics15010020 · Cited by 15 · see citing works
AI-Driven Security Systems and Intelligence Threat Response Using Autonomous Cyber Defense
Al-E’mari, S., Sanjalawe, Y. K., & Fataftah, F. M. (2025) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-0954-5.ch002 · Cited by 8 · see citing works
Bhutani, M., Dalal, S., Alhussein, M. A., Lilhore, U. K., Aurangzeb, K., & Hussain, A. (2025) · Cognitive Computation · doi:10.1007/s12559-025-10483-5 · Cited by 7 · see citing works
Maghanaki, M., Keramati, S., Chen, F. F., & Shahin, M. (2026) · Journal of Manufacturing Science and Engineering · doi:10.1115/1.4071232 · Cited by 7 · see citing works
FedSW-TSAD: SWGAN-Based Federated Time Series Anomaly Detection
Zhang, X., Zhao, H., Zhang, W., Cao, S., Sun, H., & Zhang, B. (2025) · Sensors · doi:10.3390/s25134014 · Cited by 6 · see citing works
Goranin, N., Čeponis, D., & Čenys, A. (2025) · Applied Sciences · doi:10.3390/app15052316 · Cited by 5 · see citing works
Privacy-Preserving Intrusion Detection in Industrial IoT Using Federated Learning
Cakin, A., Dilek, S., & Oracevic, A. (2025) · International Conference on Smart Applications, Communications and Networking (SmartNets) · doi:10.1109/smartnets65254.2025.11106778 · Cited by 4 · see citing works
Leng, J., Zhu, X., Li, J., Liu, Z., Dong, Y., Zhou, X. R., Liu, C., Zheng, S., Zhang, C., Liu, Q., et al. (2026) · Robotics and Computer-Integrated Manufacturing · doi:10.1016/j.rcim.2026.103304 · Cited by 3 · see citing works
FP-LSTM: a federated proximal LSTM autoencoder framework for zero-day cyberattack detection
Gopi, A. P., Jaladi, K. S., Naik, K. J., Kosaraju, C., Kanumalli, S. S., & Narayana, V. L. (2026) · Journal of Computer Virology and Hacking Techniques · doi:10.1007/s11416-026-00616-1 · Cited by 2 · see citing works
Lee, J., Charmchi, A. S. T., Ghobadi, F., & Kim, M. I. (2026) · Environmental Science and Ecotechnology · doi:10.1016/j.ese.2026.100697 · Cited by 2 · see citing works
Hussain, N., Attique, D., Li, S., & Sarwar, N. (2025) · International Conference on Open Source Systems and Technologies (ICOSST) · doi:10.1109/icosst69113.2025.11315362 · Cited by 1 · see citing works
Machine Learning‐Based Routing Framework for WSNs Using Learning Automata and Genetic Algorithms
Jain, K., Singh, A., Kumar, S., V, & Agarwal, A. (2026) · International Journal of Communication Systems · doi:10.1002/dac.70422 · Cited by 1 · see citing works
Improving Industrial Control System Cybersecurity with Time-Series Prediction Models
Varbanov, V., & Atanasova, T. V. (2025) · doi:10.3390/engproc2025101004 · Cited by 1 · see citing works
Mahamkali, N., & Mudigonda, K. S. P. (2025) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-1807-3.ch004
Dual-Stage Intrusion Detection Approach Based on Hybrid-GNN-DT Model for Industrial Data
Wan, M., Liu, X., Wang, X., An, S., Guan, Y., & Wang, J. (2025) · IEEE International Symposium on Parallel and Distributed Processing with Applications (ISPA) · doi:10.1109/ispa67752.2025.00104
Advances in Security Maturity and Architecture Design in Critical Infrastructures
Tigre, H., Belesaca, J. D., & Astudillo‐Salinas, F. (2025) · IEEE Ecuador Technical Chapters Meeting (ETCM) · doi:10.1109/etcm67548.2025.11304365
Attention-Enhanced LSTM Autoencoder for Login Anomaly Detection
Hizkia, & Yugopuspito, P. (2025) · International Conference on Informatics and Computing (ICIC) · doi:10.1109/icic68054.2025.11309610
Seeing the invisible: Detection of stealth DoS attacks using variational U-Net-like models
Cambiaso, E., Folino, F., Guarascio, M., Liguori, A., & Rullo, A. (2025) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2025.104356
Cyber-Resilience of Cyber-Physical Systems Integrating Internet of Things Devices: A Survey
Pavão, J., Bastardo, R., & Rocha, N. P. (2026) · Lecture notes in networks and systems · doi:10.1007/978-3-032-10929-3_19
Mission Explainable: From Feature Attribution to Mitigation in 5G Anomaly Detection
Uccello, F., Karim, I., Mubasshir, K. S., Bertino, E., & Nadjm‐Tehrani, S. (2026) · 2012 International Conference on Computing, Networking and Communications (ICNC) · doi:10.1109/icnc68183.2026.11416967
Pagunuran, J. R., Alqawasmi, K., Pandi, V. S., Ravi, N., Dinesh, M., & Rajalingam, A. (2025) · IEEE Global Conference on Wireless Computing and Networking (GCWCN) · doi:10.1109/gcwcn66157.2025.11448332
Iqbal, A., -, M. R. H. O., Hossain, S., Tanvirahmedshuvo, Sarwar, M. G., & Mohiuddin, M. (2025) · International Conference on Computational Intelligence, Security, and Artificial Intelligence (IntelliSecAI) · doi:10.1109/intellisecai66368.2025.11473180
Mityakov, E., Saenko, I. B., & Kotenko, I. (2026) · International Conference on Industrial Engineering, Applications and Manufacturing (ICIEAM) · doi:10.1109/icieam69213.2026.11549614
Ciberseguridad cuántica en sistemas ciberfísicos e infraestructuras críticas: un estado del arte
Villalba, K. M., Pardo, C., & Donado, S. A. (2026) · Tecnura · doi:10.14483/22487638.24853
Villalba, K. M., Pardo, C., & Donado, S. A. (2026) · Future Internet · doi:10.3390/fi18080395
Vezeteu, P. V., Boboc, N.-D., & Năstac, I. (2026) · Algorithms · doi:10.3390/a19090750
Unsupervised Anomaly Detection in Network Traffic: A Comparative Study
Tavares, R., Neto, M., Borges, A. R., & Correia, F. B. (2026) · International Conference on Computer Systems and Technologies (CompSysTech) · doi:10.1109/compsystech69798.2026.11683143
A Review of Engineering Applications in Additive Manufacturing Enhanced by Artificial Intelligence
Tooski, A. Y., Kargar, E., Foratinejad, M., Javadi, M., Mirgheisari, A., Roknabadi, M. H. A., Soleimani, A., Pinnarelli, A., & Štrbac, G. (2026) · AI · doi:10.3390/ai7090372
Pandey, R. K., Das, T. K., Gangopadhyay, S., & Zhou, J. (2026) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2026.100906
AI-Driven Anomaly Detection for Securing U.S. Critical Infrastructure Networks
Olatunbosun, E., Bizel, G., & Lacava, A. (2025) · International Journal of Scientific Research in Artificial Intelligence and Machine Learning · doi:10.32628/ijsraiml251309
Deep Representation Learning for Institutional Risk Ranking Under Label Scarcity
Irawan, D., & Isa, S. M. (2026) · International Journal of Electronics and Communications Systems · doi:10.24042/ijecs.v6i1.31069
Hybrid ML-Based Anomaly Detection Model for Securing Confidential Citizen and Judicial Records
Pomsathit, A., Aunuwongpinit, T., & Boonchan, B. (2026) · International Electrical Engineering Congress (iEECON) · doi:10.1109/ieecon68065.2026.11706969
- Authors
- Pinto, A., Herrera, L.-C., Donoso, Y., & Gutierrez, J. A.
- Affiliations
- Universidad de Los Andes (CO)
- Corresponding author
- Pinto, Andrea
- Venue
- International Journal of Computational Intelligence Systems
- Published
- 2024-09-10
- Volume
- 17
- Issue
- 1
- ISSN
- 1875-6883 (ISSN-L)
- OpenAlex
- W4402408429
- Cited by
- 35
- References
- 26
- Citations by year
- 2026: 17 · 2025: 18
- FWCI
- 5.79
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- International Journal of Computational Intelligence Systems (publishedVersion, cc-by-nc-nd)
- Tuwhera (Auckland University of Technology) (submittedVersion, cc-by-nc-nd)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion)
- Funders
- Universidad de los Andes
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Keywords
- critical infrastructure security, Industrial Internet of Things, anomaly detection, unsupervised learning, zero-day attacks, industrial control systems, SWaT dataset, variational autoencoder, LSTM, Isolation Forest, local outlier factor, one-class support vector machine, Kullback-Leibler divergence, real-time attack detection, cyberattack detection
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
