Unsupervised Deep Autoencoder for Multivariate Cyber-Attack Detection in Industrial Cyber-Physical Systems

Abstract

Cyber-attacks on Operational Technology (OT) environments pose significant risks to critical infrastructure due to the increasing integration of Cyber–Physical Systems (CPSs). Accurate and timely detection of such attacks is essential to ensure operational safety and reliability. This paper proposes an unsupervised multivariate anomaly detection framework based on a deep autoencoder model trained exclusively on normal operational data. The framework is evaluated on the Secure Water Treatment (SWaT) testbed and enhanced through the integration of multiple thresholding strategies, including Peak, Average, RMS, Hotelling’s T<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup>, and Z-Score methods. The results demonstrate that RMS-based thresholding achieves the best overall trade-off between accuracy (0.9696) and robustness, while Hotelling’s T<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> exhibits superior recall, and Peak excels in precision and specificity. A detailed error analysis further reveals the types of attacks most challenging to detect and the conditions leading to false alarms. These findings provide valuable insights into threshold selection for industrial cyber-attack detection and establish the proposed framework as a practical and effective solution for securing CPSs.