Unsupervised Learning Approach for Anomaly Detection in Industrial Control Systems
Open accessAbstract
Industrial control systems (ICSs) play a crucial role in managing and monitoring critical processes across various industries, such as manufacturing, energy, and water treatment. The connection of equipment from various manufacturers, complex communication methods, and the need for the continuity of operations in a limited environment make it difficult to detect system anomalies. Traditional approaches that rely on supervised machine learning require time and expertise due to the need for labeled datasets. This study suggests an alternative approach to identifying anomalous behavior within ICSs by means of unsupervised machine learning. The approach employs unsupervised machine learning to identify anomalous behavior within ICSs. This study shows that unsupervised learning algorithms can effectively detect and classify anomalous behavior without the need for pre-labeled data using a composite autoencoder model. Based on a dataset that utilizes HIL-augmented ICSs (HAIs), this study shows that the model is capable of accurately identifying important data characteristics and detecting anomalous patterns related to both value and time. Intentional error data injection experiments could potentially be used to validate the model’s robustness in real-time monitoring and industrial process performance optimization. As a result, this approach can improve system reliability and operational efficiency, which can establish a foundation for safe and sustainable ICS operations.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Choi and Kim [79] proposed an unsupervised anomaly detection approach using an LSTM-based Variational Autoencoder (VAE) analyzing process data from the HAI dataset.
“Analyzing process data from the HAI (HIL-Based Augmented ICS) dataset, Choi and Kim [79] proposed an unsupervised anomaly detection approach using an LSTM-based Variational Autoencoder (VAE).”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [79]
The Abstract describes an unsupervised anomaly-detection approach using a composite autoencoder model, and §3.3 (Data Preparation) says the study used the HAI dataset. The cited passages do not identify the proposed model as an LSTM-based variational autoencoder; the LSTM methods mentioned in §2.1 are attributed to other researchers. Page numbers are unavailable in our copy. (LLM, conf=0.87)
Experimental — accuracy not yet measuredAutoencoder-like models (AE, VAE, OC-NN) and PCA-based approaches can flag process states that lie outside the learned normal manifold, including zero-day attack scenarios that were not explicitly seen during training.
“By learning a compact representation of normal operating conditions and monitoring reconstruction error or boundary-based anomaly scores, autoencoder-like models (AE, VAE, OC-NN) and PCA-based approaches can flag process states that lie outside the learned normal manifold, including zero-day attack scenarios that were not explicitly seen during training [77,79,81-83,86,87].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [79]
The Abstract reports that a composite autoencoder detected anomalous patterns in industrial-control-system data without pre-labeled data. The passages do not establish the claim for VAE, OC-NN, or PCA-based approaches, nor do they show detection of zero-day attacks unseen during training; searches for those terms and for reconstruction-error and boundary scores found no supporting passage. (LLM, conf=0.85)
Experimental — accuracy not yet measuredThis necessitates careful design of feature selection, mode handling, and adaptive thresholding, as well as periodic model updates, to avoid an excessive false-positive burden in real deployments.
“This necessitates careful design of feature selection, mode handling, and adaptive thresholding, as well as periodic model updates, to avoid an excessive false-positive burden in real deployments [77,79,83,86,87].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [79]
Section 3.3.1 describes selecting tags with similar behavior for clustering, and Section 3.3.4 describes cluster-specific thresholds for detecting anomalies. These support parts of the design claim, but the cited passages do not establish adaptive thresholding, operating-mode handling, periodic model updates, or that these measures prevent an excessive false-positive burden in real deployments. The indexed copy gives no page numbers for these sections. (LLM, conf=0.79)
Experimental — accuracy not yet measuredThe dataset distribution for reconstruction-error-based anomaly detection studies shows a strong reliance on a limited set of public process benchmarks (SWaT, HAI, BATADAL, and TE) supplemented by a small number of custom-built CAN fieldbus and wind-turbine SCADA datasets.
“Finally, the dataset distribution again reveals a strong reliance on a limited set of public process benchmarks-SWaT, HAI, BATADAL, and TE-supplemented by a small number of custom-built CAN fieldbus and wind-turbine SCADA datasets [77,79,81-83,85-87].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [79]
Split into 2 atoms — 0 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 1 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measuredSome approaches rely almost exclusively on reconstruction error derived from AE or VAE models trained on normal process data, while others treat boundary distances in one-class neural networks or PCA-residual statistics as functionally equivalent 'reconstruction-like' anomaly measures.
“Some approaches rely almost exclusively on reconstruction error derived from AE or VAE models trained on normal process data [77,79,83], while others treat boundary distances in one-class neural networks or PCA-residual statistics as functionally equivalent 'reconstruction-like' anomaly measures [81,86].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [79]
Split into 2 atoms — 0 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 1 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measured
Reconstruction-error-based methods are particularly effective for detecting sensor/actuator faults, false data injection, command manipulation, and generic injection-type attacks that cause local or global distortions in multivariate process trajectories.
“First, these methods are particularly effective for detecting sensor/actuator faults, false data injection, command manipulation, and generic injection-type attacks that cause local or global distortions in multivariate process trajectories [77,79,81-83,86,87].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [79]
Section 4.2.3 reports detection of a small, single-variable change assumed to represent a sensor change or system failure; the paper also reports multivariate-variable detection in Table 6. These findings support detecting some local and multivariate anomalies, but the cited passages do not establish particular effectiveness against false data injection, command manipulation, or the other specified attack types. (LLM, conf=0.84)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Maseer, Z. K., Yusof, R., Bahaman, N., Mostafa, S. A., & Foozy, C. F. M. (2021) · IEEE Access · doi:10.1109/access.2021.3056614 · Cited by 476 · see citing works
Stuxnet and the Limits of Cyber Warfare
Lindsay, J. R. (2013) · Security Studies · doi:10.1080/09636412.2013.816122 · Cited by 466 · see citing works
A Taxonomy of Cyber Attacks on SCADA Systems
Zhu, B., Joseph, A., & Sastry, S. (2011) · 2011 International Conference on Internet of Things and 4th International Conference on Cyber, Physical and Social Computing · doi:10.1109/ithings/cpscom.2011.34 · Cited by 458 · cited 1× · see citing works
“The ICS is intimately involved in our daily lives and cyberattacks on these systems can cause significant damage [17].”
BackgroundAnomaly Detection in Cyber Physical Systems Using Recurrent Neural Networks
Goh, J., Adepu, S., Tan, M., & Lee, Z. S. (2017) · IEEE International Symposium on High Assurance Systems Engineering (HASE) · doi:10.1109/hase.2017.36 · Cited by 447 · see citing works
Security of smart manufacturing systems
Tuptuk, N., & Hailes, S. (2018) · Journal of Manufacturing Systems · doi:10.1016/j.jmsy.2018.04.007 · Cited by 416 · see citing works
Cybersecurity for Industry 4.0 in the current literature: A reference framework
Lezzi, M., Lazoi, M., & Corallo, A. (2018) · Computers in Industry · doi:10.1016/j.compind.2018.09.004 · Cited by 404 · see citing works
Security for Industrial Communication Systems
Dzung, D., Naedele, M., Von Hoff, T. P., & Crevatin, M. (2005) · Proceedings of the IEEE · doi:10.1109/jproc.2005.849714 · Cited by 386 · see citing works
Guide to Industrial control Systems (ICS) security :
Stouffer, K. A., Falco, J. A., & Scarfone, K. A. (2008) · doi:10.6028/nist.sp.800-82e2008 · Cited by 373 · see citing works
Anomaly Detection for a Water Treatment System Using Unsupervised Machine Learning
Inoue, J., Yamagata, Y., Chen, Y., POSKITT, C. M., & Sun, J. (2017) · IEEE ... International Conference on Data Mining workshops · doi:10.1109/icdmw.2017.149 · Cited by 372 · see citing works
Review of security issues in industrial networks
Cheminod, M., Durante, L., & Valenzano, A. (2013) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2012.2198666 · Cited by 349 · cited 1× · see citing works
“The ICS is characterized by the use of diverse equipment from multiple vendors, proprietary protocols, and complex communication methods that add to the complexity of securing these systems [11].”
BackgroundCyber security risk assessment for SCADA and DCS networks
Ralston, P. A. S., Graham, J. H., & Hieb, J. L. (2007) · ISA Transactions · doi:10.1016/j.isatra.2007.04.003 · Cited by 267 · see citing works
Mokhtari, S., Abbaspour, A., Yen, K. K., & Sargolzaei, A. (2021) · Electronics · doi:10.3390/electronics10040407 · Cited by 198 · see citing works
Human factors in process control systems: The design of human–machine interfaces
Nachreiner, F., Nickel, P., & Meyer, I. (2005) · Safety Science · doi:10.1016/j.ssci.2005.09.003 · Cited by 146 · see citing works
Hao, W., Yang, T., & Yang, Q. (2023) · IEEE Transactions on Automation Science and Engineering · doi:10.1109/tase.2021.3073396 · Cited by 143 · see citing works
Cyber-physical systems for water sustainability: challenges and opportunities
Wang, Z., Song, H. H., Watkins, D., Ong, K. G., Xue, P., Yang, Q. B., & Shi, X. (2015) · IEEE Communications Magazine · doi:10.1109/mcom.2015.7105668 · Cited by 142 · see citing works
Cyber Attacks on Power Grids: Causes and Propagation of Cascading Failures
Rajkumar, V. S., Stefanov, A. I., Presekal, A., Pálenský, P., & Rueda, J. L. (2023) · IEEE Access · doi:10.1109/access.2023.3317695 · Cited by 134 · see citing works
A Comparative Study of Time Series Anomaly Detection Models for Industrial Control Systems
Kim, B., Alawami, M. A., Kim, E., Oh, S., Park, J., & Kim, H. (2023) · Sensors · doi:10.3390/s23031310 · Cited by 126 · see citing works
Power Grid AC-Based State Estimation: Vulnerability Analysis Against Cyber Attacks
Jin, M., Lavaei, J., & Johansson, K. H. (2018) · IEEE Transactions on Automatic Control · doi:10.1109/tac.2018.2852774 · Cited by 124 · see citing works
Liu, J., Wang, X., Xie, F., et al. (2023) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2023.106000 · Cited by 104 · see citing works
Pang, J., Pu, X., & Li, C. (2022) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2022.3145834 · Cited by 84 · see citing works
Putchala, M. K. (2017) · CORE Scholar (Wright State University) · Cited by 60 · see citing works
A Deep Learning Method for Lightweight and Cross-Device IoT Botnet Detection
Catillo, M., Pecchia, A., & Villano, U. (2023) · Applied Sciences · doi:10.3390/app13020837 · Cited by 55 · see citing works
Fausto, A., Gaggero, G. B., Patrone, F., Girdinio, P., & Marchese, M. (2021) · Sensors · doi:10.3390/s21216970 · Cited by 42 · see citing works
de Brito, I. B., & de Sousa, R. T. (2022) · Applied Sciences · doi:10.3390/app12157942 · Cited by 38 · see citing works
Gaggero, G. B., Caviglia, R., Armellin, A., Rossi, M., Girdinio, P., & Marchese, M. (2022) · Sensors · doi:10.3390/s22103933 · Cited by 24 · see citing works
Du, Y., Huang, Y., Wan, G., & He, P. (2022) · Mathematics · doi:10.3390/math10224373 · Cited by 24 · see citing works
Can Industrial Intrusion Detection Be SIMPLE?
Wolsing, K., Thiemt, L., van Sloun, C., Wagner, E., Wehrle, K., & Henze, M. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-17143-7_28 · Cited by 18 · see citing works
Attacks on Industrial Control Systems
Evancich, N., & Li, J. (2016) · Advances in information security · doi:10.1007/978-3-319-32125-7_6 · Cited by 13 · see citing works
Improving Method of Anomaly Detection Performance for Industrial IoT Environment
Kim, J., Shin, J., Park, K.-W., & Taek Seo, J. (2022) · Computers, Materials & Continua · doi:10.32604/cmc.2022.026619 · Cited by 8 · see citing works
Self-citationMultivariate Time Series Anomaly Detection with Few Positive Samples
Xue, F., & Yan, W. (2022) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn55064.2022.9892091 · Cited by 7 · see citing works
Park, H., & Choi, Y. (2022) · Sensors · doi:10.3390/s22124417 · Cited by 3 · see citing works
Flagged first, then by citations
Research works printed but not linked: 3
- Audibert, J.; Michiardi, P.; Guyard, F.; Marti, S.; Zuluaga, M.A. Usad: Unsupervised anomaly detection on multivariate time series. In Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, Virtual, 6-10 July 2020; pp. 3395-3404.
- Shin, H.K.; Lee, W.; Yun, J.H.; Kim, H. HAI 1.0: HIL-Based Augmented ICS Security Dataset. In Proceedings of the 13th USENIX Conference on Cyber Security Experimentation and Test, Berkeley, CA, USA, 10 August 2020; USENIX Association: Berkeley, CA, USA, 2020.
- Maseer, Z.K.; Yusof, R.; Bahaman, N.; Mostafa, S.A.; Foozy, C.F.M. Benchmarking of machine learning for anomaly based intrusion detection systems in the CICIDS2017 dataset. IEEE Access 2021, 9, 22351-22370.
Cited by
Sorted by citations
Seo, J. K., Lee, J., Kim, B., Shim, W., & Seo, J. T. (2025) · Electronics · doi:10.3390/electronics15010020 · Cited by 15 · see citing works
- Authors
- Choi, W.-H., & Kim, J.
- Affiliations
- Gwangju Institute of Science and Technology (KR)
- Corresponding author
- Kim, Jongwon
- Venue
- Applied System Innovation
- Publisher
- MDPI AG
- Published
- 2024-02-21
- Volume
- 7
- Issue
- 2
- Pages
- 18
- ISSN
- 2571-5577 (ISSN-L)
- OpenAlex
- W4391996970
- Cited by
- 74
- References
- 31
- Citations by year
- 2026: 31 · 2025: 27 · 2024: 16
- FWCI
- 11.60
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- Applied System Innovation (publishedVersion, cc-by)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Funders
- Korean government (MSIT) (2019-0-01842)
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Fault Detection and Control Systems
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- industrial control systems, anomaly detection, unsupervised learning, hardware-in-the-loop, anomaly classification, real-time monitoring, fault injection, system reliability, industrial process optimization
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
