A Hybrid Deep Autoencoders and Random Forest Framework for False Data Injection Attack Detection in Industrial Internet of Things Networks
TL;DR
A hybrid detection framework is proposed that integrates a Random Forest classifier with an unsupervised anomaly detection model based on a deep autoencoder combined through a Logistic Regression metaclassifier that addresses the gap in single-model detectors that either rely on fixed decision boundaries that struggle with gradually evolving stealthy FDIA patterns or on anomaly detection that lacks strong discriminative power in separating subtle adversarial deviations from normal operational variability.
Abstract
The rapid adoption of Internet of Things (IoT)-enabled applications has significantly expanded the cyberattack surface across a wide range of critical systems such as industrial IoT (IIoT), smart grids, transportation, healthcare, industrial control systems, and smart cities. False data injection attack (FDIA) has emerged as a serious security threat to these applications due to its stealthiness and adversarial nature, silently corrupting the data integrity of critical operational processes without triggering conventional detection mechanisms. Existing FDIA solutions rely on single-model architectures that are built based on classical or limited predefined attack scenarios. Such solutions often fail to achieve robust detection under adversarial and evolving attack conditions; accordingly, they lack generalisability and are insufficient to capture the broader scope of FDIAs. In this study, a hybrid detection framework is proposed that integrates a Random Forest classifier with an unsupervised anomaly detection model based on a deep autoencoder combined through a Logistic Regression metaclassifier. The proposed framework addresses the gap in single-model detectors that either rely on fixed decision boundaries that struggle with gradually evolving stealthy FDIA patterns or on anomaly detection that lacks strong discriminative power in separating subtle adversarial deviations from normal operational variability. Different types of stealthy and adversarial FDIA have been modelled and injected into the dataset samples for use in training the proposed model. The results show that the overall detection performance of the proposed architecture improved by 2.39 percentage points in terms of F1-score while maintaining a low false-positive rate of 0.49%. These findings reflect the effectiveness of feature representation learning via autoencoders and hybrid classification strategies against stealthy and adversarial FDIA patterns. Future work should include temporal modelling for further advancing robust detection against evolving adversarial threats.