Machine-learning-based anomaly detection is increasingly used in industrial control systems (ICS), yet most studies assume that detector training data is trustworthy. In practice, training data may be corrupted through compromised logs, labeling errors, manipulated historian records, or unsafe retraining processes. This paper evaluates the robustness of offline ICS anomaly-detection pipelines on the Secure Water Treatment (SWaT) benchmark under training-time contamination. We assess 11 heterogeneous anomaly detectors under three contamination strategies: random injection, similarity-targeted injection, and feature-noise injection. The first two insert attack samples into the nominal training pool, while the third adds bounded Gaussian noise to selected normal training samples. These attacks are contamination-based rather than gradient-driven poisoning methods. Contamination budgets from 1% to 10% are evaluated using clean validation and test sets under a unified offline protocol. The results show that robustness is strongly model-dependent and cannot be predicted from clean-data performance alone. Injection-based contamination causes the greatest degradation, particularly for local-density and distance-based detectors, whereas feature-noise contamination has a comparatively limited effect. PCA, SVM, HBOS, and IForest remain relatively stable, while the tuned neural detectors demonstrate intermediate robustness. Overall, the findings highlight the importance of training-data integrity in ML-enabled ICS monitoring, subject to the evaluated dataset, models, and threat assumptions.
Figures & tables
Fig. 1: Offline ICS anomaly-detection workflow. Contamination is confined to the normal training pool; validation and test data remain uncontaminated.
Strategy
Training-pool manipulation
Final size
Random injection
Uniformly sample k observations from attack pool A and append them as nominal
N+k
Similarity-targeted injection
Append the k attack observations closest to the clean centroid
N+k
Feature-noise injection
Perturb k selected clean observations with clipped, scaled Gaussian noise
N
TABLE I: Summary of the evaluated training-time contamination strategies.
Item
Value
Processed samples
449,919
Retained features
44
Normal / attack samples
395,298 / 54,621
Attack ratio
12.14%
Pointwise split
70% / 15% / 15%
Normalization
Train-fitted min-max to [0,1]
TABLE II: Pointwise SWaT benchmark pool after preprocessing.
Model and family
Scoring mechanism
Retained configuration
Training input
IForest Tree ensemble
Average path length in random isolation trees
100 trees; tree subsample 256; contamination 0.05; seed-controlled initialization
TABLE III: Detector families, scoring mechanisms, retained configurations, and training inputs used in the comparative benchmark. Classical detectors use PyOD and neural detectors use PyTorch, as described in the text.
TABLE IV: Tuning policy and final model-configuration summary.
Detector
Clean F1
Clean FNR
Train (s)
Worst F1 drop
LSTM-AE
0.8813±0.0032
0.2027±0.0068
139.9
0.442
LOF
0.8761±0.0208
0.1373±0.0312
36.5
0.660
ABOD
0.8744±0.0039
0.2012±0.0171
249.8
0.674
AE
0.8674±0.0029
0.2030±0.0082
117.1
0.302
KNN
0.8482±0.0016
0.2259±0.0077
264.2
0.648
SVM
0.8144±0.0019
0.2922±0.0015
17.1
0.068
TABLE V: Clean performance (mean ± SD over three seeds), mean observed training time, and worst-case F1 drop across twelve attack-budget combinations. Worst-case drop is computed from seed-averaged F1 values.
Fig. 2: F1-score versus training-pool-relative contamination budget. Injection attacks cause detector-specific degradation; feature noise has a limited effect at the tested magnitude.
Fig. 3: FNR versus training-pool-relative contamination budget. LOF, KNN, ABOD, and LSTM-AE enter the highest missed-detection region under one or more injection settings.
Fig. 4: Change in F1-score relative to the clean baseline. Stable classical models remain near zero, while injection attacks expose severe fragility in several high-clean-F1 detectors.
Anomaly-based intrusion detection systems in industrial control systems (ICS) and operational technology (OT) environments are increasingly required to meet formal resilience criteria: absorbed adversarial disturbances, graceful degradation under sustained attack, and certified system-level guarantees. Existing resilience frameworks for cyber-physical systems define absorb-recover-adapt trajectories at the architectural level but do not treat machine learning anomaly detectors as first-class components, leaving a gap between component-level robustness evaluation and system-level resilience certification. In this paper, we establish that adversarial robustness in ICS anomaly detection is a specific instantiation of system resilience, and formalise this connection by mapping four resilience constructs, i.e. disturbance class, absorption capacity, recovery trajectory, and degradation function, onto the adversarial machine learning setting. We derive a compositional resilience bound for heterogeneous ICS detection networks, showing that the binding constraint on system-level resilience is the coupling-adjusted absorption capacity of each node along the attack path, not the per-node capacity -- so the binding node need not be the weakest one. Empirical validation on the BATADAL water distribution system benchmark demonstrates that the resulting metrics surface operationally significant phenomena invisible to standard benchmarks: the absorption-degradation divergence under adversarial training, and the paradox that hardening the binding node in isolation reduces system-level resilience. Implications for ICS architecture design and certification standards are discussed.
Branka Stojanović, Andreas Flatscher, Michael Somma
1JOANNEUM RESEARCH Forschungsgesellschaft mbH, Austria · 2TU Graz, Institute for Technical Informatics, Austria
Industrial Water Treatment Systems (IWTS) are safety critical cyber-physical infrastructures and due to increased connectivity, these systems are exposed to cyber threats that can manipulate process behaviour without creating obvious devices outliers. In particular, logic-layer deception anomalies can preserve numerically plausible measurements while breaking expected cause-and-effect relationships in the control process. These attacks are difficult to detect using threshold-based monitoring or require heavy server-oriented anomaly detection models. This paper explores the potential of Tiny Deep Learning (TinyDL) to provide lightweight on-device logic-level anomaly detection for resource constrained Programmable Logic Controllers (PLCs). We propose a novel framework, TinyDL-based incremental LSTM (Ti-iLSTM) which optimises the memory and space foot print of Long Short-Term Memory (LSTM), to detect logic-layer inconsistencies in Programmable Logic Controller (PLC) based Industrial Water Treatment Systems (IWTS). Experiments on the publicly available SWaT dataset show that the optimised model achieves high detection performance (F1-score=0.983 and ROC-AUC=0.998). A deployment-style validation on the WADI dataset confirms that the proposed light-weight framework remains applicable beyond a single dataset. The research demonstrates that combining logic-aware supervision with Tiny Deep Learning (TinyDL) sequence learning creates an efficient and accurate anomaly detection suitable for resource constrained Programmable Logic Controllers (PLCs) in industrial environments.
Mandar Joshi, Farzana Zahid, Judy Bowen +3
University of Waikato, Hamilton, New Zealand · Auckland University of Technology, Auckland, New Zealand · Aalto University, Espoo, Finland
Industrial anomaly detection benchmarks have advanced rapidly, yet they remain largely static and therefore underrepresent deployment settings in which inspection systems must be extended from one industrial component to another over time. In our setting, continual industrial anomaly detection is framed as a task-incremental problem: each component defines a task, while the learning objective remains semi-supervised. The goal extends beyond conventional anomaly detection, since models should preserve their performance on all components as they are sequentially exposed to new components. This framing is especially relevant because many existing industrial pipelines either assume fully supervised defect labels or study only isolated datasets, leaving open the question of how semi-supervised anomaly detectors behave across a sequence of heterogeneous components. We address this gap by organizing the benchmark as a sequence of related component-level tasks and by defining multiple scenarios, including random, easy-to-hard, and hard-to-easy. In addition to single-dataset continual scenarios, we propose challenging scenarios spanning across multiple datasets. We further evaluate continual performance from two complementary perspectives: image-level anomaly detection and pixel-level anomaly localization. By recasting industrial anomaly detection as a continual benchmark rather than a static train/test problem, our work establishes a concrete path toward studying knowledge retention, adaptation, and generalization in evolving industrial environments.