{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,3]],"date-time":"2026-04-03T05:42:08Z","timestamp":1775194928544,"version":"3.50.1"},"reference-count":48,"publisher":"MDPI AG","issue":"8","license":[{"start":{"date-parts":[[2022,4,9]],"date-time":"2022-04-09T00:00:00Z","timestamp":1649462400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100002347","name":"Federal Ministry of Education and Research","doi-asserted-by":"publisher","award":["Athene"],"award-info":[{"award-number":["Athene"]}],"id":[{"id":"10.13039\/501100002347","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100003495","name":"Hessian Ministry for Science and the Arts","doi-asserted-by":"publisher","award":["Athene"],"award-info":[{"award-number":["Athene"]}],"id":[{"id":"10.13039\/501100003495","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Heterogeneous cyberattacks against industrial control systems (ICSs) have had a strong impact on the physical world in recent decades. Connecting devices to the internet enables new attack surfaces for attackers. The intrusion of ICSs, such as the manipulation of industrial sensory or actuator data, can be the cause for anomalous ICS behaviors. This poses a threat to the infrastructure that is critical for the operation of a modern city. Nowadays, the best techniques for detecting anomalies in ICSs are based on machine learning and, more recently, deep learning. Cybersecurity in ICSs is still an emerging field, and industrial datasets that can be used to develop anomaly detection techniques are rare. In this paper, we propose an unsupervised deep learning methodology for anomaly detection in ICSs, specifically, a lightweight long short-term memory variational auto-encoder (LW-LSTM-VAE) architecture. We successfully demonstrate our solution under two ICS applications, namely, water purification and water distribution plants. Our proposed method proves to be efficient in detecting anomalies in these applications and improves upon reconstruction-based anomaly detection methods presented in previous work. For example, we successfully detected 82.16% of the anomalies in the scenario of the widely used Secure Water Treatment (SWaT) benchmark. The deep learning architecture we propose has the added advantage of being extremely lightweight.<\/jats:p>","DOI":"10.3390\/s22082886","type":"journal-article","created":{"date-parts":[[2022,4,9]],"date-time":"2022-04-09T05:13:08Z","timestamp":1649481188000},"page":"2886","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":48,"title":["Lightweight Long Short-Term Memory Variational Auto-Encoder for Multivariate Time Series Anomaly Detection in Industrial Control Systems"],"prefix":"10.3390","volume":"22","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-5820-5733","authenticated-orcid":false,"given":"Daniel","family":"F\u00e4hrmann","sequence":"first","affiliation":[{"name":"Fraunhofer Institute for Computer Graphics Research IGD, 64283 Darmstadt, Germany"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7910-7895","authenticated-orcid":false,"given":"Naser","family":"Damer","sequence":"additional","affiliation":[{"name":"Fraunhofer Institute for Computer Graphics Research IGD, 64283 Darmstadt, Germany"},{"name":"Department of Computer Science, Technical University of Darmstadt, 64283 Darmstadt, Germany"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3790-3732","authenticated-orcid":false,"given":"Florian","family":"Kirchbuchner","sequence":"additional","affiliation":[{"name":"Fraunhofer Institute for Computer Graphics Research IGD, 64283 Darmstadt, Germany"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6413-0061","authenticated-orcid":false,"given":"Arjan","family":"Kuijper","sequence":"additional","affiliation":[{"name":"Fraunhofer Institute for Computer Graphics Research IGD, 64283 Darmstadt, Germany"},{"name":"Department of Computer Science, Technical University of Darmstadt, 64283 Darmstadt, Germany"}]}],"member":"1968","published-online":{"date-parts":[[2022,4,9]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.comcom.2020.03.007","article-title":"Industrial Control Systems: Cyberattack trends and countermeasures","volume":"155","author":"Alladi","year":"2020","journal-title":"Comput. Commun."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"48","DOI":"10.1109\/MSPEC.2013.6471059","article-title":"The real story of stuxnet","volume":"50","author":"Kushner","year":"2013","journal-title":"IEEE Spectr."},{"key":"ref_3","unstructured":"(2022, February 17). Cyber-Physical Systems (CPS), Available online: https:\/\/www.nsf.gov\/pubs\/2010\/nsf10515\/nsf10515.htm."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"129","DOI":"10.1145\/3152042.3152080","article-title":"CPS-based Threat Modeling for Critical Infrastructure Protection","volume":"45","author":"Ding","year":"2017","journal-title":"ACM SIGMETRICS Perform. Eval. Rev."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Chandola, V., Mithal, V., and Kumar, V. (2008, January 15\u201319). Comparative Evaluation of Anomaly Detection Techniques for Sequence Data. Proceedings of the 8th IEEE International Conference on Data Mining (ICDM 2008), Pisa, Italy.","DOI":"10.1109\/ICDM.2008.151"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"1735","DOI":"10.1162\/neco.1997.9.8.1735","article-title":"Long Short-Term Memory","volume":"9","author":"Hochreiter","year":"1997","journal-title":"Neural Comput."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Mathur, A.P., and Tippenhauer, N.O. (2016, January 11). SWaT: A water treatment testbed for research and training on ICS security. Proceedings of the 2016 International Workshop on Cyber-physical Systems for Smart Water Networks (CySWater), Vienna, Austria.","DOI":"10.1109\/CySWater.2016.7469060"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Aggarwal, C.C. (2017). An Introduction to Outlier Analysis. Outlier Analysis, Springer International Publishing.","DOI":"10.1007\/978-3-319-47578-3"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/1541880.1541882","article-title":"Anomaly detection: A survey","volume":"41","author":"Chandola","year":"2009","journal-title":"ACM Comput. Surv."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Chalapathy, R., and Chawla, S. (2019). Deep Learning for Anomaly Detection: A Survey. arXiv.","DOI":"10.1145\/3394486.3406704"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"132330","DOI":"10.1109\/ACCESS.2020.3010274","article-title":"Anomalous Example Detection in Deep Learning: A Survey","volume":"8","author":"Bulusu","year":"2020","journal-title":"IEEE Access"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"81664","DOI":"10.1109\/ACCESS.2019.2921912","article-title":"Anomaly Detection, Analysis and Prediction Techniques in IoT Environment: A Systematic Literature Review","volume":"7","author":"Fahim","year":"2019","journal-title":"IEEE Access"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"3496","DOI":"10.1109\/COMST.2018.2844742","article-title":"A Critical Review of Practices and Challenges in Intrusion Detection Systems for IoT: Toward Universal and Resilient Systems","volume":"20","author":"Benkhelifa","year":"2018","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"21","DOI":"10.1186\/s13677-018-0123-6","article-title":"Intrusion detection systems for IoT-based smart environments: A survey","volume":"7","author":"Elrawy","year":"2018","journal-title":"J. Cloud Comput."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Santos, L., Rabadao, C., and Goncalves, R. (2018, January 13\u201316). Intrusion detection systems in Internet of Things: A literature review. Proceedings of the 2018 13th Iberian Conference on Information Systems and Technologies (CISTI), Caceres, Spain.","DOI":"10.23919\/CISTI.2018.8399291"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"165","DOI":"10.1016\/j.comnet.2019.05.014","article-title":"Intrusion detection systems in the Internet of things: A comprehensive investigation","volume":"160","author":"Hajiheidari","year":"2019","journal-title":"Comput. Netw."},{"key":"ref_17","unstructured":"Golubchik, L., Ammar, M.H., and Harchol-Balter, M. (2007, January 12\u201316). Sensitivity of PCA for traffic anomaly detection. Proceedings of the 2007 ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS 2007), San Diego, CA, USA."},{"key":"ref_18","unstructured":"Grossman, R., Bayardo, R.J., and Bennett, K.P. (2005, January 21\u201324). An approach to spacecraft anomaly detection problem using kernel feature space. Proceedings of the Eleventh ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Chicago, IL, USA."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Inoue, J., Yamagata, Y., Chen, Y., Poskitt, C.M., and Sun, J. (2017, January 18\u201321). Anomaly Detection for a Water Treatment System Using Unsupervised Machine Learning. Proceedings of the 2017 IEEE International Conference on Data Mining Workshops (ICDM Workshops 2017), New Orleans, LA, USA.","DOI":"10.1109\/ICDMW.2017.149"},{"key":"ref_20","unstructured":"Kravchik, M., and Shabtai, A. (2021). Efficient Cyber Attack Detection in Industrial Control Systems Using Lightweight Neural Networks and PCA. IEEE Trans. Dependable Secur. Comput., 1\u201318."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Deng, A., and Hooi, B. (2021, January 2\u20139). Graph Neural Network-Based Anomaly Detection in Multivariate Time Series. Proceedings of the AAAI Conference on Artificial Intelligence, Virtually.","DOI":"10.1609\/aaai.v35i5.16523"},{"key":"ref_22","unstructured":"Kim, J., Ahn, G., Kim, S., Kim, Y., L\u00f3pez, J., and Kim, T. (2018, January 4\u20138). TABOR: A Graphical Model-based Approach for Anomaly Detection in Industrial Control Systems. Proceedings of the 2018 on Asia Conference on Computer and Communications Security (AsiaCCS 2018), Incheon, Korea."},{"key":"ref_23","unstructured":"Lie, D., and Mannan, M. (2018, January 19). Detecting Cyber Attacks in Industrial Control Systems Using Convolutional Neural Networks. Proceedings of the 2018 Workshop on Cyber-Physical Systems Security and PrivaCy (CPS-SPC@CCS 2018), Toronto, ON, Canada."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"88348","DOI":"10.1109\/ACCESS.2020.2993335","article-title":"Multivariate Abnormal Detection for Industrial Control Systems Using 1D CNN and GRU","volume":"8","author":"Xie","year":"2020","journal-title":"IEEE Access"},{"key":"ref_25","first-page":"703","article-title":"MAD-GAN: Multivariate Anomaly Detection for Time Series Data with Generative Adversarial Networks","volume":"Volume 11730","author":"Tetko","year":"2019","journal-title":"Proceedings of the Artificial Neural Networks and Machine Learning\u2014ICANN 2019: Text and Time Series\u201428th International Conference on Artificial Neural Networks"},{"key":"ref_26","unstructured":"Li, D., Chen, D., Goh, J., and Ng, S. (2018). Anomaly Detection with Generative Adversarial Networks for Multivariate Time Series. arXiv."},{"key":"ref_27","unstructured":"Gupta, R., Liu, Y., Tang, J., and Prakash, B.A. (2020, January 23\u201327). USAD: UnSupervised Anomaly Detection on Multivariate Time Series. Proceedings of the KDD \u201920: The 26th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Virtual Event, CA, USA."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Goh, J., Adepu, S., Tan, M., and Lee, Z.S. (2017, January 12\u201314). Anomaly Detection in Cyber Physical Systems Using Recurrent Neural Networks. Proceedings of the 18th IEEE International Symposium on High Assurance Systems Engineering (HASE 2017), Singapore.","DOI":"10.1109\/HASE.2017.36"},{"key":"ref_29","unstructured":"Chakravarti, I.M., Laha, R.G., and Roy, J. (1967). Handbook of methods of applied statistics. Wiley Series in Probability and Mathematical Statistics (USA) eng, Wiley."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Faber, K., Pietron, M., and Zurek, D. (2021). Ensemble Neuroevolution-Based Approach for Multivariate Time Series Anomaly Detection. Entropy, 23.","DOI":"10.3390\/e23111466"},{"key":"ref_31","unstructured":"An, J., and Cho, S. (2015). Variational Autoencoder Based Anomaly Detection Using Reconstruction Probability, SNU Data Mining Center."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"504","DOI":"10.1126\/science.1127647","article-title":"Reducing the Dimensionality of Data with Neural Networks","volume":"313","author":"Hinton","year":"2006","journal-title":"Science"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"721","DOI":"10.1016\/j.robot.2014.03.003","article-title":"Multimodal integration learning of robot behavior using deep neural networks","volume":"62","author":"Noda","year":"2014","journal-title":"Robot. Auton. Syst."},{"key":"ref_34","unstructured":"Russo, S., Disch, A., Blumensaat, F., and Villez, K. (2020). Anomaly Detection using Deep Autoencoders for in-situ Wastewater Systems Monitoring Data. arXiv."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"1544","DOI":"10.1109\/LRA.2018.2801475","article-title":"A Multimodal Anomaly Detector for Robot-Assisted Feeding Using an LSTM-Based Variational Autoencoder","volume":"3","author":"Park","year":"2018","journal-title":"IEEE Robotics Autom. Lett."},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"859","DOI":"10.1080\/01621459.2017.1285773","article-title":"Variational Inference: A Review for Statisticians","volume":"112","author":"Blei","year":"2017","journal-title":"J. Am. Stat. Assoc."},{"key":"ref_37","unstructured":"Bayer, J., and Osendorfer, C. (2014). Learning Stochastic Recurrent Networks. arXiv."},{"key":"ref_38","unstructured":"Soelch, M., Bayer, J., Ludersdorfer, M., and van der Smagt, P. (2016). Variational Inference for On-line Anomaly Detection in High-Dimensional Time Series. arXiv."},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"177460","DOI":"10.1109\/ACCESS.2019.2958284","article-title":"On the Generation of Anomaly Detection Datasets in Industrial Control Systems","volume":"7","author":"Clemente","year":"2019","journal-title":"IEEE Access"},{"key":"ref_40","unstructured":"Tsakalides, P., and Beferull-Lozano, B. (2017, January 21). WADI: A water distribution testbed for research in the design of secure cyber physical systems. Proceedings of the 3rd International Workshop on Cyber-Physical Systems for Smart Water Networks (CySWATER@CPSWeek 2017), Pittsburgh, PA, USA."},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Beaver, J.M., Borges-Hink, R.C., and Buckner, M.A. (2013, January 4\u20137). An Evaluation of Machine Learning Methods to Detect Malicious SCADA Communications. Proceedings of the 12th International Conference on Machine Learning and Applications, (ICMLA 2013), Miami, FL, USA.","DOI":"10.1109\/ICMLA.2013.105"},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"88","DOI":"10.1016\/j.ijcip.2011.06.005","article-title":"A control system testbed to validate critical infrastructure protection concepts","volume":"4","author":"Morris","year":"2011","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"ref_43","unstructured":"(2022, January 06). Centre for Research In Cyber Security, Itrust. Available online: https:\/\/itrust.sutd.edu.sg."},{"key":"ref_44","first-page":"37","article-title":"EPIC: An Electric Power Testbed for Research and Training in Cyber Physical Systems Security","volume":"Volume 11387","author":"Katsikas","year":"2018","journal-title":"Proceedings of the Computer Security\u2014ESORICS 2018 International Workshops, (CyberICPS 2018 and SECPRE 2018)"},{"key":"ref_45","doi-asserted-by":"crossref","first-page":"04018065","DOI":"10.1061\/(ASCE)WR.1943-5452.0000983","article-title":"Deep-learning approach to the detection and localization of cyber-physical attacks on water distribution systems","volume":"144","author":"Taormina","year":"2018","journal-title":"J. Water Resour. Plan. Manag."},{"key":"ref_46","unstructured":"Kingma, D.P., and Welling, M. (2014, January 14\u201316). Auto-Encoding Variational Bayes. Proceedings of the 2nd International Conference on Learning Representations (ICLR 2014), Banff, AB, Canada."},{"key":"ref_47","first-page":"15","article-title":"Machine Learning for Sequential Data: A Review","volume":"Volume 2396","author":"Caelli","year":"2002","journal-title":"Proceedings of the Structural, Syntactic, and Statistical Pattern Recognition, Joint IAPR International Workshops SSPR 2002 and SPR 2002"},{"key":"ref_48","first-page":"88","article-title":"A Dataset to Support Research in the Design of Secure Water Treatment Systems","volume":"Volume 10242","author":"Setola","year":"2016","journal-title":"Proceedings of the Critical Information Infrastructures Security\u201411th International Conference (CRITIS 2016)"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/8\/2886\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T22:50:56Z","timestamp":1760136656000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/8\/2886"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,4,9]]},"references-count":48,"journal-issue":{"issue":"8","published-online":{"date-parts":[[2022,4]]}},"alternative-id":["s22082886"],"URL":"https:\/\/doi.org\/10.3390\/s22082886","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,4,9]]}}}