Systematic and Efficient Anomaly Detection Framework using Machine Learning on Public ICS Datasets

Millot et al. [129] used six public ICS datasets-Water Storage Tank, New Gas Pipeline, Power System, WADI, BATADAL, and Tennessee Eastman Process-and leveraged both cyber-layer data and physical-layer data.

“Using six public ICS datasetsWater Storage Tank, New Gas Pipeline, Power System, WADI, BATADAL, and Tennessee Eastman Process-the framework leverages both cyber-layer data (network traffic, IDS logs) and physical-layer data (sensor and process variables).”

In Millot et al. [129], WADI and Power System datasets, which include both network and physical signals, are used to validate multi-domain applicability.

“In particular, WADI and Power System datasets, which include both network and physical signals, are used to validate multi-domain applicability.”

Millot et al. [129] presented a systematic and efficient anomaly detection framework that performs integrative analysis of multi-domain data.

“Millot et al. [129] presented a systematic and efficient anomaly detection framework that performs integrative analysis of multi-domain data.”

Millot et al. [129]'s experimental results demonstrate consistently high detection accuracy (above 90%) across datasets and show that the framework significantly improves generalization and reproducibility compared to single-domain models.

“Experimental results demonstrate consistently high detection accuracy (above 90%) across datasets and show that the framework significantly improves generalization and reproducibility compared to single-domain models.”

Millot et al. [129]'s pipeline combines data scaling and normalization, frequency smoothing, dimensionality reduction via PCA, and machine-learning classifiers to handle heterogeneous data structures in a unified manner.

“The pipeline combines data scaling and normalization, frequency smoothing, dimensionality reduction via PCA, and machine-learning classifiers (Random Forest, SVM, XGBoost, etc.) to handle heterogeneous data structures in a unified manner.”

Many hybrid data fusion-based anomaly detection approaches explicitly synchronize cyber-layer events with physical-layer behavior on a common time axis to detect cyber-physical inconsistencies that single-domain detectors would miss.

“First, many approaches explicitly synchronize cyber-layer events with physical-layer behavior on a common time axis to detect cyber-physical inconsistencies that single-domain detectors would miss [122-129].”

Several hybrid data fusion frameworks are designed to operate across multiple datasets and domains by providing generic pipelines for heterogeneous feature processing and multi-modal fusion, rather than redesigning ad hoc detectors for each individual system.

“Second, several frameworks are designed to operate across multiple datasets and domains by providing generic pipelines for heterogeneous feature processing and multi-modal fusion, rather than redesigning ad hoc detectors for each individual system [124,129,131].”