Hybrid statistical-machine learning for real-time anomaly detection in industrial cyber–physical systems

Hao et al.'s hybrid approach achieves higher accuracy and lower miss rates than single-model statistical or pure LSTM-based methods, while retaining lower computational cost.

“This hybrid approach achieves higher accuracy and lower miss rates than single-model statistical or pure LSTM-based methods, while retaining lower computational cost.”

Time-series dependency-based anomaly detection on network traffic is particularly effective for attacks that explicitly disturb temporal patterns of communication, such as DoS/DDoS, flooding, scanning/probing, and botnet-driven bursts, where anomalies manifest as abrupt changes in flow-arrival rates, inter-arrival times, and session durations.

“First, this data type is particularly effective for attacks that explicitly disturb temporal patterns of communication, such as DoS/DDoS, flooding, scanning/probing, and botnet-driven bursts, where anomalies manifest as abrupt changes in flow-arrival rates, inter-arrival times, and session durations [35,38,40,44,45].”

Hao et al. [44] proposed a hybrid time-series anomaly detection approach combining a SARIMA-based online dynamic threshold model with an LSTM-based background traffic model, using network traffic from a large ICS-CPS testbed.

“Using network traffic collected from a large ICS-CPS testbed consisting of power systems, gas pipelines, and urban rail systems, Hao et al. [44] proposed a hybrid time-series anomaly detection approach combining a SARIMA-based online dynamic threshold model with an LSTM-based background traffic model.”

Unsupervised and generative approaches such as FID-GAN and autoencoder-based frameworks target zero-day or previously unseen attacks by learning normal temporal patterns and flagging deviations via reconstruction- or residual-based scores.

“Unsupervised and generative approaches such as FID-GAN and autoencoder-based frameworks target zero-day or previously unseen attacks by learning normal temporal patterns and flagging deviations via reconstruction- or residual-based scores [38,42,44].”

The dataset distribution for time-series dependency-based techniques reveals a concentration on a limited set of benchmarks, with CIC-IDS2017, UNSW-NB15, IoT-23, LITNET-2020, NetML-2020, CIC-DDoS2019, and N-BaIoT widely used, especially for botnet, DDoS, and generic network intrusions, while only a subset of studies leverage ICS/CPS-specific traces such as Alstom TCMS traffic, multi-domain ICS-CPS

“Fourth, the dataset distribution again reveals a concentration on a limited set of benchmarks. CIC-IDS2017, UNSW-NB15, IoT-23, LITNET-2020, NetML-2020, CIC-DDoS2019, and N-BaIoT are widely used to evaluate time-series dependency-based techniques, especially for botnet, DDoS, and generic network intrusions [35,38,40,43]. Only a subset of studies leverage ICS/CPS-specific traces such as Alstom TCMS”

Deep sequence models (LSTM, BLSTM-GRU, CNN + Bi-GRU) and generative architectures (FID-GAN, VAE-based digital twins) are able to exploit complex temporal patterns and achieve strong detection or classification performance on benchmark datasets.

“Third, in terms of model behavior and failure modes, the surveyed work shows that deep sequence models (LSTM, BLSTM-GRU, CNN + Bi-GRU) and generative architectures (FID-GAN, VAE-based digital twins) are able to exploit complex temporal patterns and achieve strong detection or classification performance on benchmark datasets [35,38-40,42,44,45].”

Time-series dependency-based methods incorporate sequential context such as burstiness, periodicity, and long-range dependencies via LSTM, BLSTM, GRU, SARIMA, or hybrid architectures, allowing them to capture more subtle deviations in normal traffic dynamics at the cost of higher model complexity, stricter requirements on ordering and timestamp quality, and increased sensitivity to concept drift.

“While statistical and entropy-based approaches treat each flow or aggregate independently, time-series dependency-based methods incorporate sequential context-such as burstiness, periodicity, and long-range dependencies-via LSTM, BLSTM, GRU, SARIMA, or hybrid architectures [33,38-40,44,45]. This allows them to capture more subtle deviations in normal traffic dynamics, at the cost of higher model c”

By explicitly modeling packet or flow sequences as time series, the proposed models can detect not only high-rate attacks but also low-rate or long-duration anomalies that gradually distort periodic traffic patterns in CPS/IIoT environments.

“By explicitly modeling packet or flow sequences as time series, the proposed models can detect not only high-rate attacks but also low-rate or long-duration anomalies that gradually distort periodic traffic patterns in CPS/IIoT environments [38,40,44].”