A comparative evaluation of unsupervised anomaly detection techniques using the PyOD Python library, applied to three representative industrial scenarios: Intrusion Detection, Fault Detection, and Predictive Maintenance, offers valuable guidance for selecting robust anomaly detection models in industrial applications beyond cybersecurity.
Abstract
This study presents a comparative evaluation of unsupervised anomaly detection techniques using the PyOD Python library, applied to three representative industrial scenarios: Intrusion Detection, Fault Detection, and Predictive Maintenance. Three public datasets, each corresponding to one of these domains, are used to assess the generalizability and robustness of the methods. The methodology includes data normalization, feature selection, and class balancing to address the specific challenges of each dataset, such as class imbalance and heterogeneous feature spaces. Performance is assessed using metrics such as Precision, Recall, Specificity, F1-score, AUC-PR, AUC-ROC, Balanced Accuracy, and Execution Time (training and testing). The findings offer valuable guidance for selecting robust anomaly detection models in industrial applications beyond cybersecurity, including those related to reliability and maintenance. The code and results will be publicly available on GitHub
https://github.com/hvelesaca/PyOD_OPC-UA
to support future research.
This study develops and evaluates an AI-based analytical system for detecting anomalies in industrial processes. The work reviews major sources of risk in industrial control systems, distinguishes point, contextual, and collective anomalies, and summarizes the principal machine-learning approaches used for industrial anomaly detection. A synthetic dataset modeled on the Secure Water Treatment (SWaT) testbed was created with 10 sensor and actuator variables and 10,000 one-second observations, including 1,000 anomalous samples. After missing-value interpolation, duplicate removal, low-variance filtering, and standardization for consistent analysis and visualization, an Isolation Forest with 200 trees was trained in a novelty-detection configuration using normal operating data. On the held-out test set, the model achieved 88.63% accuracy, 45.86% precision, 75.67% recall, and an F1-score of 57.11%. The results show that Isolation Forest can detect most simulated anomalies, although the relatively low precision indicates a substantial false-alarm burden. Future work should validate the approach on authorized real SWaT or PLC-SCADA data, investigate hybrid temporal models, and incorporate explainable-AI methods to support operator decision-making.
Mehdiyeva Almaz, Ahmedov Elmar, Uzakov Gulom et al.· 2026 International Conferenc...· 0 citations
The development of effective intrusion detection systems for renewable-integrated smart grids necessitates models that are capable of distinguishing between legitimate operational variations and genuine cyberattacks. In this study, we present a systematic evaluation of the Sherlock dataset, a recent benchmark for process-aware security research. The investigation encompasses three distinct learning paradigms: unsupervised anomaly detection, binary supervised classification, and a proposed multi-class supervised formulation. The results demonstrate that anomaly detection methods fail to separate attacks from benign operational anomalies due to structural characteristics of the dataset, including benign anomalous behavior and substantial drift between training and testing distributions. While binary supervised classification appears effective under a single split, its performance collapses once cross-validation is applied, with accuracy fluctuating significantly between 35% and 96% (σ ≈ 0.19), which indicates that its apparent success relies on favorable sampling rather than meaningful generalization. Conversely, the multi-class formulation, combined with duplicate removal, variance filtering, and top-80 feature selection, provides a stable and context-aware solution. A tuned eXtreme Gradient Boosting classifier achieves a mean accuracy of 99.81% ± 0.04% across 5 independent seeds successfully identifying all fifteen classes, including rare maintenance events and four distinct attack types. Feature importance analysis confirms that the model primarily relies on physically meaningful variables such as voltage, reactive power, and line currents, thereby demonstrating process-aware decision-making. The results establish that, when high-fidelity event labels are available, supervised multi-class learning provides a robust, accurate, and engineering-valid foundation for intrusion detection in the modern, renewable-integrated grids.
Unknown authors· Journal of Intelligent &...· 0 citations
A fully automated IoT-based Network Intrusion Detection System (NIDS), utilizing the Gotham Dataset 2025, using two AutoML approaches: TPOT (Tree-based Pipeline Optimization Tool) and FLAML (cost-aware lightweight AutoML framework).
Susan Al Naqshbandi· Sulaimani Journal for Engine...· 0 citations
Security researchers rely heavily on Network Intrusion Detection Systems (NIDS) to keep an eye on network traffic and notify administrators of any suspicious activities. The purpose of this paper is to offer a comprehensive overview of intrusion detection systems (IDS), including the following topics: fundamentals, kinds of IDS, methods for detecting intrusions in NIDS, the architecture of IDS, data pre-processing, and examples of ML techniques used in NIDS. This covers several detection methods, including signature-based, anomaly-based, specification-based, and behavior-based approaches, as well as their advantages and disadvantages in recognizing both existing and new cyber threats. The review also covers the architecture of NIDS which consists of network sensors, preprocessors, network traffic analysis, alert generation and security analysis. A variety of ML techniques, including supervised, unsupervised, semi-supervised, ensemble, and deep learning (DL) approaches, are being explored to improve the accuracy and adaptability of intrusion detection systems (IDS). Other applications such as DoS/DDoS attack detection, Malware detection, Botnets, Brute force attacks, Insider compromise, IoT compromise and Critical infrastructure threats are also shown. Despite all the challenges in terms of false positives, scalability, computational complexity, data quality, and novel attack styles, the features that ML can provide for intelligent, adaptive, and accurate intrusion detection systems are appealing.
Madhav Sharma· International Journal of Cyb...· 0 citations
As machine learning-based intrusion detection systems increasingly support information security risk management, prior systematic literature review findings indicate that many studies still emphasize benchmark accuracy while paying limited attention to robustness, interpretability, and operational feasibility. This study aims to map the operational weaknesses of machine learning-based intrusion detection systems under realistic deployment stressors. A directed replication and scenario-based stresstesting approach was applied using four public intrusion detection datasets, namely CICIDS2017, CICIDS2018, UNSW-NB15, and RanSMAP. The data were obtained from public repositories, converted to binary labels, cleaned by removing identifiers and non-numeric attributes, imputed with median values, scaled with MinMax normalization, and split into training and testing subsets. Supervised models, including Random Forest and XGBoost, were compared with unsupervised baselines, including Isolation Forest, LOF/kNN-distance, and DBSCAN, across scenarios covering baseline benchmarking, class imbalance, telemetry degradation, drift, parameter sensitivity, and micro-batch inference. The results show that supervised models achieved near-perfect baseline performance but degraded sharply under minor Gaussian noise, with F1-score dropping to 0.16 for Random Forest and 0.41 for XGBoost. Unsupervised models showed limited detection capability and high sensitivity to parameters. Although micro-batch inference achieved high throughput, alert burden remained a practical concern. These findings demonstrate that benchmark accuracy alone is insufficient for deployment readiness and that IDS evaluation should include robustness, interpretability, and alert-management analysis.
Fathoni Mahardika, Ema Utami, Kusrini et al.· Matrik· 0 citations
Anomaly-detection methods typically fail to detect changes in operating conditions or are unresponsive in detecting changes in the aging of industrial assets. This paper outlines an unsupervised lightweight machine learning-based approach to adaptively detect anomalies in the reliability of industrial assets. It incorporates in its framework operating-range normalisation, principal component analysis, Euclidean-distance anomaly scoring, Gaussian-based dynamic thresholds, sensor-contribution ranking and autonomous baseline recalibration. The validation was performed by taking 10 sensor variables initially screened in a critical P-101 A/B pump in an HDPE slurry polymerisation process, sampled approximately every 15 min and nine variables were selected for sensor-quality screening and then used for the validation. The framework identified all 44 reported functional failures resulting in a 100% recall, 84.62% precision, an average warning lead time of 72 h and an F1-score of 91.67%. The findings show that a self-recalibrating unsupervised model can successfully detect faults in a scalable manner, with an interpretable model, low computational complexity and can adapt to ageing assets and varying operating baselines without labelled fault information.
Dhirendra Singh, Durga Prasad Panday, Manish Kumar· International journal of com...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
