An Intelligent Ensemble-Based Anomaly Detection Framework for Industrial Control Systems With Dynamic Attention and Dual-Layer Monitoring

Abstract

Industrial Control Systems (ICSs) support critical infrastructure operations but are increasingly exposed to sophisticated cyber-attacks that may closely resemble legitimate process behavior. This characteristic makes reliable, adaptive, and interpretable anomaly detection challenging, particularly under heterogeneous and dynamically changing operating conditions. This paper proposes PMHRL, a confidence-guided adaptive multi-view anomaly detection framework that integrates four complementary perspectives of industrial process behavior: statistical, behavioral, temporal, and semantic. Unlike conventional multi-view and ensemble approaches that employ fixed aggregation strategies, PMHRL dynamically adjusts the contribution of each view using confidence-guided attention, allowing heterogeneous anomaly evidence to be weighted according to its estimated relevance to the current observation. The resulting view-specific evidence is combined into a continuous anomaly score, while the final operating threshold is determined exclusively from normal validation data using the 99th percentile, without using attack or independent test observations for threshold selection. The proposed framework is evaluated under an unsupervised anomaly detection setting using the Secure Water Treatment (SWaT) benchmark dataset. At the selected operating point, PMHRL achieves 83.60% accuracy, 84.30% precision, 80.85% recall, 82.54% F1-score, 84.91% ROC-AUC, and 89.60% PR-AUC. Although the temporal and semantic views individually achieve higher F1-scores than the fused model at the selected operating point, the adaptive fusion mechanism provides complementary evidence integration and observation-dependent view weighting rather than relying on fixed contributions. In particular, the mean contribution of the semantic view increases from 0.273 for normal test observations to 0.749 for attack observations, demonstrating substantial redistribution of view importance under anomalous conditions. Threshold sensitivity analysis further shows the trade-off between detection performance and false-alarm rate across different validation-derived operating points. Bootstrap confidence intervals and post-hoc leave-one-view-out sensitivity analysis provide additional assessment of performance stability and fusion sensitivity. The results position PMHRL as a reliability-oriented adaptive evidence-fusion framework that provides multi-view integration and view-level interpretability for anomaly detection in industrial control environments.