Improving Method of Anomaly Detection Performance for Industrial IoT Environment
Open accessAbstract
Industrial Control System (ICS), which is based on Industrial IoT (IIoT), has an intelligent mobile environment that supports various mobility, but there is a limit to relying only on the physical security of the ICS environment. Due to various threat factors that can disrupt the workflow of the IIoT, machine learning-based anomaly detection technologies are being presented; it is also essential to study for increasing detection performance to minimize model errors for promoting stable ICS operation. In this paper, we established the requirements for improving the anomaly detection performance in the IIoT-based ICS environment by analyzing the related cases. After that, we presented an improving method of the performance of a machine learning model specialized for IIoT-based ICS, which increases the detection rate by applying correlation coefficients and clustering; it provides a mechanism to predict thresholds on a per-sequence. Likewise, we adopted the HAI dataset environment that actively reflected the characteristics of IIoT-based ICS and demonstrated that performance could be improved through comparative experiments with the traditional method and our proposed method. The presented method can further improve the performance of commonly applied error-based detection techniques and includes a primary method that can be enhanced over existing detection techniques by analyzing correlation coefficients between features to consider feedback between ICS components. Those can contribute to improving the performance of several detection models applied in ICS and other areas.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Kim et al. [83] proposed a method to improve anomaly detection performance in IIoT environments using the HAI 1.0 dataset.
“Using the HAI 1.0 dataset, Kim et al. [83] proposed a method to improve anomaly detection performance in IIoT environments.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [83]
The Introduction says the authors propose a method to improve anomaly detection in IIoT-based industrial control systems using the HAI dataset. However, Dataset Selection and the performance experiment identify the dataset used as HAI 21.04, not HAI 1.0. (LLM, conf=0.90)
Experimental — accuracy not yet measuredReconstruction-error-based methods are particularly effective for detecting sensor/actuator faults, false data injection, command manipulation, and generic injection-type attacks that cause local or global distortions in multivariate process trajectories.
“First, these methods are particularly effective for detecting sensor/actuator faults, false data injection, command manipulation, and generic injection-type attacks that cause local or global distortions in multivariate process trajectories [77,79,81-83,86,87].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [83]
Split into 2 atoms — 0 confirmed, 2 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measuredSome approaches rely almost exclusively on reconstruction error derived from AE or VAE models trained on normal process data, while others treat boundary distances in one-class neural networks or PCA-residual statistics as functionally equivalent 'reconstruction-like' anomaly measures.
“Some approaches rely almost exclusively on reconstruction error derived from AE or VAE models trained on normal process data [77,79,83], while others treat boundary distances in one-class neural networks or PCA-residual statistics as functionally equivalent 'reconstruction-like' anomaly measures [81,86].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [83]
Split into 2 atoms — 0 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 1 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measuredThis necessitates careful design of feature selection, mode handling, and adaptive thresholding, as well as periodic model updates, to avoid an excessive false-positive burden in real deployments.
“This necessitates careful design of feature selection, mode handling, and adaptive thresholding, as well as periodic model updates, to avoid an excessive false-positive burden in real deployments [77,79,83,86,87].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [83]
Sections 2.1 and 4.1 discuss feature selection, while Section 4.2 proposes thresholds that vary with the control system’s operating cycle; the Introduction links false positives to operational availability. These passages support much of the design rationale, but our copy does not recommend periodic model updates or establish that the combined measures prevent an excessive false-positive burden in real deployments. (LLM, conf=0.87)
Experimental — accuracy not yet measuredThe dataset distribution for reconstruction-error-based anomaly detection studies shows a strong reliance on a limited set of public process benchmarks (SWaT, HAI, BATADAL, and TE) supplemented by a small number of custom-built CAN fieldbus and wind-turbine SCADA datasets.
“Finally, the dataset distribution again reveals a strong reliance on a limited set of public process benchmarks-SWaT, HAI, BATADAL, and TE-supplemented by a small number of custom-built CAN fieldbus and wind-turbine SCADA datasets [77,79,81-83,85-87].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [83]
Section 3 identifies HAI as the dataset used for this ICS anomaly-detection study and says earlier HAI versions were publicly released. But it also says the specific HAI 21.04 dataset used in the study was not officially distributed. The paper supports HAI as an example in the citing sentence, not its characterization of this study's dataset as a public benchmark. (LLM, conf=0.85)
Experimental — accuracy not yet measured
Autoencoder-like models (AE, VAE, OC-NN) and PCA-based approaches can flag process states that lie outside the learned normal manifold, including zero-day attack scenarios that were not explicitly seen during training.
“By learning a compact representation of normal operating conditions and monitoring reconstruction error or boundary-based anomaly scores, autoencoder-like models (AE, VAE, OC-NN) and PCA-based approaches can flag process states that lie outside the learned normal manifold, including zero-day attack scenarios that were not explicitly seen during training [77,79,81-83,86,87].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [83]
Section 5 reports detecting attack points with an LSTM-based anomaly detector trained without abnormal data, which supports the general idea of flagging attacks not explicitly represented in training. The paper does not establish the claim for AE, VAE, OC-NN, or PCA-based approaches, and it does not identify the detected attacks as zero-day attacks. No page number is available in our copy. (LLM, conf=0.84)
Experimental — accuracy not yet measuredLightweight and quantized AE/CNN-LSTM models deployed at edge gateways can provide millisecond-level anomaly scoring while offloading complex diagnosis and attack-type classification to the cloud, enabling hierarchical detection in resource-constrained CPS environments.
“Lightweight and quantized AE/CNN-LSTM models deployed at edge gateways can provide millisecond-level anomaly scoring while offloading complex diagnosis and attack-type classification to the cloud, enabling hierarchical detection in resourceconstrained CPS environments [83,85].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [83]
Split into 2 atoms — 0 confirmed, 0 partially supported, 0 disputed, 0 misattributed, 2 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
A survey on feature selection methods
Chandrashekar, G., & Sahin, F. (2014) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2013.11.024 · Cited by 5,189 · see citing works
Deep Learning Approach for Intelligent Intrusion Detection System
Vinayakumar, R., Alazab, M., Soman, K. P., Poornachandran, P., Al-Nemrat, A., & Venkatraman, S. (2019) · IEEE Access · doi:10.1109/access.2019.2895334 · Cited by 2,126 · see citing works
Feature selection in machine learning: A new perspective
Cai, J., Luo, J., Wang, S., & Yang, S. (2018) · Neurocomputing · doi:10.1016/j.neucom.2017.11.077 · Cited by 2,107 · see citing works
The correlation coefficient: its values range between +1/-1, or do they?
Ratner, B. (2009) · Journal of Targeting, Measurement and Analysis for Marketing · doi:10.1057/jt.2009.5 · Cited by 1,612 · see citing works
Design Techniques and Applications of Cyberphysical Systems: A Survey
Khaitan, S. K., & McCalley, J. D. (2014) · IEEE Systems Journal · doi:10.1109/jsyst.2014.2322503 · Cited by 796 · see citing works
A survey of intrusion detection techniques for cyber-physical systems
Mitchell, R., & Chen, I.-R. (2014) · ACM Computing Surveys · doi:10.1145/2542049 · Cited by 768 · see citing works
Deep Learning for Anomaly Detection in Time-Series Data: Review, Analysis, and Guidelines
Choi, K., Yi, J., Park, C., & Yoon, S. (2021) · IEEE Access · doi:10.1109/access.2021.3107975 · Cited by 621 · see citing works
Sajid, A., Abbas, H., & Saleem, K. (2016) · IEEE Access · doi:10.1109/access.2016.2549047 · Cited by 401 · see citing works
Industrial IoT, Cyber Threats, and Standards Landscape: Evaluation and Roadmap
Dhirani, L. L., Armstrong, E., & Newe, T. (2021) · Sensors · doi:10.3390/s21113901 · Cited by 172 · see citing works
A Survey of Security in SCADA Networks: Current Issues and Future Challenges
Ghosh, S., & Sampalli, S. (2019) · IEEE Access · doi:10.1109/access.2019.2926441 · Cited by 154 · see citing works
Toward Detection and Attribution of Cyber-Attacks in IoT-Enabled Cyber–Physical Systems
Jahromi, A. N., Karimipour, H., Dehghantanha, A., & Choo, K. R. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3067667 · Cited by 125 · see citing works
Maamar, A., & Benahmed, K. (2019) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2019.06497 · Cited by 70 · see citing works
Two ICS Security Datasets and Anomaly Detection Contest on the HIL-based Augmented ICS Testbed
Shin, H.-K., Lee, W., Yun, J.-H., & Min, B.-G. (2021) · Cyber Security Experimentation and Test Workshop (CSET) · doi:10.1145/3474718.3474719 · Cited by 65 · see citing works
E-SFD: Explainable Sensor Fault Detection in the ICS Anomaly Detection System
Hwang, C., & Lee, T. (2021) · IEEE Access · doi:10.1109/access.2021.3119573 · Cited by 62 · see citing works
Trinh, H. D., Zeydan, E., Giupponi, L., & Dini, P. (2019) · IEEE Access · doi:10.1109/access.2019.2947742 · Cited by 56 · see citing works
Anomaly Detection using Supervised Learning and Multiple Statistical Methods
Jia, W., Shukla, R. M., & Sengupta, S. (2019) · International Conference on Machine Learning and Applications · doi:10.1109/icmla.2019.00211 · Cited by 50 · see citing works
Secure IoT Platform for Industrial Control Systems
Shahzad, A., Kim, Y., & Elgamoudi, A. (2017) · International Conference on Platform Technology and Service · doi:10.1109/platcon.2017.7883726 · Cited by 41 · see citing works
Anomaly Detection in ICS Datasets with Machine Learning Algorithms
Mubarak, S., Habaebi, M. H., Islam, M. R., Rahman, F. D. A., & Tahir, M. (2021) · Computer Systems Science and Engineering · doi:10.32604/csse.2021.014384 · Cited by 37 · see citing works
Towards Learning Normality for Anomaly Detection in Industrial Control Networks
Schuster, F., Paul, A., & König, H. (2013) · Lecture notes in computer science · doi:10.1007/978-3-642-38998-6_8 · Cited by 22 · see citing works
An IIoT Based ICS to Improve Safety Through Fast and Accurate Hazard Detection and Differentiation
Moradbeikie, A., Jamshidi, K., Bohlooli, A., García, J., & Masip‐Bruin, X. (2020) · IEEE Access · doi:10.1109/access.2020.3037093 · Cited by 21 · see citing works
An Efficient Internet Traffic Classification System Using Deep Learning for IoT
Alhumyani, H. A., Alrube, I., Alsharif, S., Afifi, A., Amar, C. B., El‐sayed, H. S., & Faragallah, O. S. (2021) · Computers, materials & continua/Computers, materials & continua (Print) · doi:10.32604/cmc.2022.020727 · Cited by 15 · see citing works
An Improved Algorithm of K-means Based on Evolutionary Computation
Wang, Y., Luo, X., Zhang, J., Zhao, Z., & Zhang, J. (2020) · Intelligent Automation & Soft Computing · doi:10.32604/iasc.2020.010128 · Cited by 10 · see citing works
Flagged first, then by citations
Research works printed but not linked: 1
- W. S. Hwang, J. H. Yun, J. Kim and H. C. Kim, "Time-series aware precision and recall for anomaly detection: considering variety of detection result and addressing ambiguous labeling," in Proc. of the 28th ACM Int. Conf. on Information and Knowledge Management (CIKM '19), New York, NY, USA, pp. 2241- 2244, 2019.
Cited by
Sorted by citations
Enhancing intrusion detection: a hybrid machine and deep learning approach
Sajid, M., Malik, K. R., Almogren, A., Malik, T. S., Khan, A. H., Tanveer, J., & Rehman, A. U. (2024) · Journal of Cloud Computing Advances Systems and Applications · doi:10.1186/s13677-024-00685-x · Cited by 292 · see citing works
Unsupervised Learning Approach for Anomaly Detection in Industrial Control Systems
Choi, W.-H., & Kim, J. (2024) · Applied System Innovation · doi:10.3390/asi7020018 · Cited by 74 · see citing works
Self-citationSrinivas, M. B. R., & Konguvel, E. (2024) · IEEE Access · doi:10.1109/access.2024.3400624 · Cited by 21 · see citing works
Seo, J. K., Lee, J., Kim, B., Shim, W., & Seo, J. T. (2025) · Electronics · doi:10.3390/electronics15010020 · Cited by 15 · see citing works
Izuazu, U. U., Ihekoronye, V. U., Kim, D.-S., & Lee, J. M. (2024) · International Conference on Artificial Intelligence in Information and Communication (ICAIIC) · doi:10.1109/icaiic60209.2024.10463488 · Cited by 7 · see citing works
Anomaly Detection Based on Edge Computing Using Transfer Learning in Industrial IoT
Dr. Ganesh, D., Choudhary, S., Mishra, A. K., Dev, S., Gomathi, R. M., & Chakraborty, R. (2025) · International Conference on AI-Driven STEM Education and Learning Technologies (AISTEMEDU) · doi:10.1109/aistemedu67077.2025.11403915 · Cited by 1 · see citing works
da Rosa, W. C., Silva, W., & Carvalho, C. B. (2023) · Anais de XXXV Simpósio Brasileiro de Telecomunicações e Processamento de Sinais · doi:10.14209/sbrt.2023.1570923831 · Cited by 1 · see citing works
Laxmi, S. S., Soujanya, G., Himabindu, B., & Nikitha, M. (2025) · International Conference on Computing Methodologies and Communication (ICCMC) · doi:10.1109/iccmc65190.2025.11141011
Anomaly Detection Method Using Statistical Distribution Identification
Krämmer, P., Habala, O., & Hluchý, L. (2024) · IEEE International Scientific Conference on Informatics (Informatics) · doi:10.1109/informatics62280.2024.10900759
- Authors
- Kim, J., Shin, J., Park, K.-W., & Taek Seo, J.
- Affiliations
- Gachon University (KR)
- Korean National Police University (KR)
- Sejong University (KR)
- Venue
- Computers, Materials & Continua
- Publisher
- Tech Science Press
- Published
- 2022
- Volume
- 72
- Issue
- 3
- Pages
- 5377-5394
- ISSN
- 1546-2218 (ISSN-L)
- 1546-2226
- OpenAlex
- W4226499756
- Cited by
- 8
- References
- 22
- Citations by year
- 2025: 2 · 2024: 5 · 2023: 1
- FWCI
- 0.89
- Type
- journal article
- Language
- en
- Open access
- diamond
- doi.org
- Locations
- Computers, materials & continua/Computers, materials & continua (Print) (publishedVersion, cc-by)
- Funders
- National Research Foundation
- Nuclear Safety and Security Commission (2101058)
- National Research Foundation of Korea (2101058, NRF-2020R1A2C1012187)
- Ministry of Science and ICT, South Korea (2021-0-00493, NRF-2020R1A2C1012187)
- Institute for Information and Communications Technology Promotion (2021-0-00493)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Physical Sciences › Engineering › Control and Systems Engineering › Fault Detection and Control Systems
- Keywords
- anomaly detection, Industrial Internet of Things, industrial control systems, machine learning, correlation coefficient, clustering, threshold prediction, cyberattack detection, detection rate improvement
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
