Robustness of Anomaly Detection Models for Industrial Control Systems under Training-Time Data Contamination

Mustafa Umut Ozbek; Taiwo Ojo; Pooria Madani; Khalil El-Khatib; Li Yang

cs.CRAug 24, 2026

Robustness of Anomaly Detection Models for Industrial Control Systems under Training-Time Data Contamination

Authors: Mustafa Umut Ozbek, Taiwo Ojo, Pooria Madani, Khalil El-Khatib, Li Yang

Organizations: Ontario Tech University, Oshawa, Ontario, Canada

Abstract

Machine-learning-based anomaly detection is increasingly used in industrial control systems (ICS), yet most studies assume that detector training data is trustworthy. In practice, training data may be corrupted through compromised logs, labeling errors, manipulated historian records, or unsafe retraining processes. This paper evaluates the robustness of offline ICS anomaly-detection pipelines on the Secure Water Treatment (SWaT) benchmark under training-time contamination. We assess 11 heterogeneous anomaly detectors under three contamination strategies: random injection, similarity-targeted injection, and feature-noise injection. The first two insert attack samples into the nominal training pool, while the third adds bounded Gaussian noise to selected normal training samples. These attacks are contamination-based rather than gradient-driven poisoning methods. Contamination budgets from 1% to 10% are evaluated using clean validation and test sets under a unified offline protocol. The results show that robustness is strongly model-dependent and cannot be predicted from clean-data performance alone. Injection-based contamination causes the greatest degradation, particularly for local-density and distance-based detectors, whereas feature-noise contamination has a comparatively limited effect. PCA, SVM, HBOS, and IForest remain relatively stable, while the tuned neural detectors demonstrate intermediate robustness. Overall, the findings highlight the importance of training-data integrity in ML-enabled ICS monitoring, subject to the evaluated dataset, models, and threat assumptions.

Figures & tables

Fig. 1: Offline ICS anomaly-detection workflow. Contamination is confined to the normal training pool; validation and test data remain uncontaminated.

Strategy	Training-pool manipulation	Final size
Random injection	Uniformly sample $k$ observations from attack pool $A$ and append them as nominal	$N+k$
Similarity-targeted injection	Append the $k$ attack observations closest to the clean centroid	$N+k$
Feature-noise injection	Perturb $k$ selected clean observations with clipped, scaled Gaussian noise	$N$

TABLE I: Summary of the evaluated training-time contamination strategies.

Item	Value
Processed samples	449,919
Retained features	44
Normal / attack samples	395,298 / 54,621
Attack ratio	12.14%
Pointwise split	70% / 15% / 15%
Normalization	Train-fitted min-max to $[0,1]$

TABLE II: Pointwise SWaT benchmark pool after preprocessing.

Model and family	Scoring mechanism	Retained configuration	Training input
IForest Tree ensemble	Average path length in random isolation trees	100 trees; tree subsample 256; contamination 0.05; seed-controlled initialization	Full normal pool
SVM Kernel boundary	RBF $\nu$ -SVM support boundary, $\nu=0.01$	RBF one-class SVM; $\nu=0.01$ ; gamma = scale ; contamination 0.05	50K subsample
LOF Local density	Density ratio relative to a 20-neighbor neighborhood	Novelty mode; 20 neighbors; Minkowski distance; contamination 0.05	50K subsample
CBLOF Cluster/density	Cluster assignment, cluster size, and distance	Eight clusters; $\alpha=0.9$ ; $\beta=5$ ; seed-controlled initialization	Full normal pool
KNN Distance	Distance to the fifth-nearest training point	Fifth-nearest-neighbor distance; largest-distance score; Minkowski metric	50K subsample
HBOS Statistical	Feature-wise histogram outlier scores	10 bins; $\alpha=0.1$ ; tolerance 0.5; feature-wise histogram scoring	Full normal pool

TABLE III: Detector families, scoring mechanisms, retained configurations, and training inputs used in the comparative benchmark. Classical detectors use PyOD and neural detectors use PyTorch, as described in the text.

Group	Search policy	Retained configuration
Classical	Sensitivity-first; only PCA and SVM promoted	PCA: 90% variance; SVM: RBF, $\nu=0.01$
AE	426 staged configurations; multi-seed confirmation	$[256,128,64]$ , LeakyReLU, dropout 0.1, Adam $5\times 10^{-4}$ , batch 2048
LSTM-AE	216 staged configurations; joint sequence/capacity search	$W=30$ , hidden size 256, AdamW $10^{-3}$ , batch 256

TABLE IV: Tuning policy and final model-configuration summary.

Detector	Clean F1	Clean FNR	Train (s)	Worst F1 drop
LSTM-AE	$0.8813\pm 0.0032$	$0.2027\pm 0.0068$	139.9	0.442
LOF	$0.8761\pm 0.0208$	$0.1373\pm 0.0312$	36.5	0.660
ABOD	$0.8744\pm 0.0039$	$0.2012\pm 0.0171$	249.8	0.674
AE	$0.8674\pm 0.0029$	$0.2030\pm 0.0082$	117.1	0.302
KNN	$0.8482\pm 0.0016$	$0.2259\pm 0.0077$	264.2	0.648
SVM	$0.8144\pm 0.0019$	$0.2922\pm 0.0015$	17.1	0.068

TABLE V: Clean performance (mean

\pm

SD over three seeds), mean observed training time, and worst-case F1 drop across twelve attack-budget combinations. Worst-case drop is computed from seed-averaged F1 values.

Fig. 2: F1-score versus training-pool-relative contamination budget. Injection attacks cause detector-specific degradation; feature noise has a limited effect at the tested magnitude.

Fig. 3: FNR versus training-pool-relative contamination budget. LOF, KNN, ABOD, and LSTM-AE enter the highest missed-detection region under one or more injection settings.

Fig. 4: Change in F1-score relative to the clean baseline. Stable classical models remain near zero, while injection attacks expose severe fragility in several high-clean-F1 detectors.

Industrial Control System Security

See all 17 papers

Towards a Resilience-Theoretic Foundation for Adversarial Robustness in Industrial Control System Anomaly Detection
Sep 7, 2026Branka Stojanović, Andreas Flatscher, Michael SommaCyber-Physical Systems Adversarial Robustness
1JOANNEUM RESEARCH Forschungsgesellschaft mbH, Austria · 2TU Graz, Institute for Technical Informatics, Austria
Ti-iLSTM: A TinyDL Approach for Logic-Level Anomaly Detection in Industrial Water Treatment Systems
May 15, 2026Mandar Joshi, Farzana Zahid, Judy Bowen +3Efficient Neural Network Inference Industrial Anomaly Detection
University of Waikato, Hamilton, New Zealand · Auckland University of Technology, Auckland, New Zealand · Aalto University, Espoo, Finland
InCLAD: A Continual Learning Benchmark for Industrial Visual Anomaly Detection
Oct 10, 2026Łukasz Marcjan, Dorota Wilk-Kołodziejczyk, Roberto CorizzoTask-Incremental Learning Continual Anomaly Detection
AGH University of Krakow, Krakow, Poland · American University, Washington, DC, USA

Sep 7, 2026J/K move · Enter open · S save

Towards a Resilience-Theoretic Foundation for Adversarial Robustness in Industrial Control System Anomaly Detection

Branka Stojanović, Andreas Flatscher, Michael Somma

1JOANNEUM RESEARCH Forschungsgesellschaft mbH, Austria · 2TU Graz, Institute for Technical Informatics, Austria

Cyber-Physical Systems Adversarial Robustness Industrial Anomaly Detection Cybersecurity Certified Robustness Industrial Control System Security

Open paper AskPDF arXiv

Anomaly-based intrusion detection systems in industrial control systems (ICS) and operational technology (OT) environments are increasingly required to meet formal resilience criteria: absorbed adversarial disturbances, graceful degradation under sustained attack, and certified system-level guarantees. Existing resilience frameworks for cyber-physical systems define absorb-recover-adapt trajectories at the architectural level but do not treat machine learning anomaly detectors as first-class components, leaving a gap between component-level robustness evaluation and system-level resilience certification. In this paper, we establish that adversarial robustness in ICS anomaly detection is a specific instantiation of system resilience, and formalise this connection by mapping four resilience constructs, i.e. disturbance class, absorption capacity, recovery trajectory, and degradation function, onto the adversarial machine learning setting. We derive a compositional resilience bound for heterogeneous ICS detection networks, showing that the binding constraint on system-level resilience is the coupling-adjusted absorption capacity of each node along the attack path, not the per-node capacity -- so the binding node need not be the weakest one. Empirical validation on the BATADAL water distribution system benchmark demonstrates that the resulting metrics surface operationally significant phenomena invisible to standard benchmarks: the absorption-degradation divergence under adversarial training, and the paradox that hardening the binding node in isolation reduces system-level resilience. Implications for ICS architecture design and certification standards are discussed.

Abstract

Industrial Control System Security

Explore similar work

Towards a Resilience-Theoretic Foundation for Adversarial Robustness in Industrial Control System Anomaly Detection

Ti-iLSTM: A TinyDL Approach for Logic-Level Anomaly Detection in Industrial Water Treatment Systems

InCLAD: A Continual Learning Benchmark for Industrial Visual Anomaly Detection