{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,11]],"date-time":"2026-09-11T21:20:42Z","timestamp":1789161642134,"version":"build-2803163510"},"reference-count":51,"publisher":"MDPI AG","issue":"16","license":[{"start":{"date-parts":[[2026,8,12]],"date-time":"2026-08-12T00:00:00Z","timestamp":1786492800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>The rapid adoption of Internet of Things (IoT)-enabled applications has significantly expanded the cyberattack surface across a wide range of critical systems such as industrial IoT (IIoT), smart grids, transportation, healthcare, industrial control systems, and smart cities. False data injection attack (FDIA) has emerged as a serious security threat to these applications due to its stealthiness and adversarial nature, silently corrupting the data integrity of critical operational processes without triggering conventional detection mechanisms. Existing FDIA solutions rely on single-model architectures that are built based on classical or limited predefined attack scenarios. Such solutions often fail to achieve robust detection under adversarial and evolving attack conditions; accordingly, they lack generalisability and are insufficient to capture the broader scope of FDIAs. In this study, a hybrid detection framework is proposed that integrates a Random Forest classifier with an unsupervised anomaly detection model based on a deep autoencoder combined through a Logistic Regression metaclassifier. The proposed framework addresses the gap in single-model detectors that either rely on fixed decision boundaries that struggle with gradually evolving stealthy FDIA patterns or on anomaly detection that lacks strong discriminative power in separating subtle adversarial deviations from normal operational variability. Different types of stealthy and adversarial FDIA have been modelled and injected into the dataset samples for use in training the proposed model. The results show that the overall detection performance of the proposed architecture improved by 2.39 percentage points in terms of F1-score while maintaining a low false-positive rate of 0.49%. These findings reflect the effectiveness of feature representation learning via autoencoders and hybrid classification strategies against stealthy and adversarial FDIA patterns. Future work should include temporal modelling for further advancing robust detection against evolving adversarial threats.<\/jats:p>","DOI":"10.3390\/s26165110","type":"journal-article","created":{"date-parts":[[2026,8,12]],"date-time":"2026-08-12T12:53:48Z","timestamp":1786539228000},"page":"5110","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["A Hybrid Deep Autoencoders and Random Forest Framework for False Data Injection Attack Detection in Industrial Internet of Things Networks"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-9140-4339","authenticated-orcid":false,"given":"Abdullah M.","family":"Albarrak","sequence":"first","affiliation":[{"name":"Computer Science Department, College of Computer and Information Sciences, Imam Mohammad Ibn Saud Islamic University (IMSIU), Riyadh 11432, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1468-0655","authenticated-orcid":false,"given":"Fuad A.","family":"Ghaleb","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Birmingham City University, Birmingham B4 7XG, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6575-161X","authenticated-orcid":false,"given":"Sultan Noman","family":"Qasem","sequence":"additional","affiliation":[{"name":"Computer Science Department, College of Computer and Information Sciences, Imam Mohammad Ibn Saud Islamic University (IMSIU), Riyadh 11432, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2822-1708","authenticated-orcid":false,"given":"Faisal","family":"Saeed","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Birmingham City University, Birmingham B4 7XG, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,8,12]]},"reference":[{"key":"ref_1","unstructured":"Market Research Future (2026, August 05). Internet of Things Market Research Report\u2014Forecast Till 2035. Available online: https:\/\/www.marketresearchfuture.com\/reports\/internet-of-things-market-1176."},{"key":"ref_2","unstructured":"Sinha, S. (2026, August 07). Number of Connected IoT Devices Growing 14% to 21.1 Billion; IoT Analytics. Available online: https:\/\/iot-analytics.com\/number-connected-iot-devices\/."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"1949","DOI":"10.1109\/TSG.2017.2784366","article-title":"Financially Motivated FDI on SCED in Real-Time Electricity Markets: Attacks and Mitigation","volume":"10","author":"Liu","year":"2019","journal-title":"IEEE Trans. Smart Grid"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"2505","DOI":"10.1109\/TSG.2017.2703842","article-title":"Real-Time Detection of False Data Injection Attacks in Smart Grid: A Deep Learning-Based Intelligent Mechanism","volume":"8","author":"He","year":"2017","journal-title":"IEEE Trans. Smart Grid"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Qin, Y., Luo, Z., Che, Y., and Cao, L. (2026). False Data Injection Attacks Against UAV Battery State of Health Estimation with A Capacity-informed Latent Diffusion Model. Green Energy Intell. Transp., 100404. (In English).","DOI":"10.1016\/j.geits.2026.100404"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"100508","DOI":"10.1016\/j.ijcip.2022.100508","article-title":"FDI attack detection using extra trees algorithm and deep learning algorithm-autoencoder in smart grid","volume":"37","author":"Majidi","year":"2022","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"ref_7","first-page":"102518","article-title":"Survey of false data injection in smart power grid: Attacks, countermeasures and challenges","volume":"54","author":"Aoufi","year":"2020","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_8","first-page":"3","article-title":"Analysis of the cyber attack on the Ukrainian power grid","volume":"388","author":"Case","year":"2016","journal-title":"Electr. Inf. Shar. Anal. Cent. (E-ISAC)"},{"key":"ref_9","first-page":"455","article-title":"A comprehensive survey on IoT attacks: Taxonomy, detection mechanisms and challenges","volume":"2","author":"Sasi","year":"2024","journal-title":"J. Inf. Intell."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"344","DOI":"10.1016\/j.future.2022.10.021","article-title":"False data injection threats in active distribution systems: A comprehensive survey","volume":"140","author":"Husnoo","year":"2023","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"1121","DOI":"10.1109\/OJCS.2025.3585248","article-title":"A Comprehensive Survey on the Usage of Machine Learning to Detect False Data Injection Attacks in Smart Grids","volume":"6","author":"Nand","year":"2025","journal-title":"IEEE Open J. Comput. Soc."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"112423","DOI":"10.1016\/j.rser.2022.112423","article-title":"Comprehensive survey and taxonomies of false data injection attacks in smart grids: Attack models, targets, and impacts","volume":"163","author":"Reda","year":"2022","journal-title":"Renew. Sustain. Energy Rev."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"572","DOI":"10.1049\/iet-stg.2020.0029","article-title":"Ensemble CorrDet with adaptive statistics for bad data detection","volume":"3","author":"Nagaraj","year":"2020","journal-title":"IET Smart Grid"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"45028","DOI":"10.1109\/ACCESS.2023.3273730","article-title":"Detection of False Data Injection Attacks in Smart Grid Based on Joint Dynamic and Static State Estimation","volume":"11","author":"Hu","year":"2023","journal-title":"IEEE Access"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"4529","DOI":"10.1109\/TAC.2022.3161259","article-title":"False Data Injection Attacks Against State Estimation Without Knowledge of Estimators","volume":"67","author":"Lu","year":"2022","journal-title":"IEEE Trans. Autom. Control"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"3992","DOI":"10.1109\/TSG.2023.3235945","article-title":"A False Data Injection Attack Detection Strategy for Unbalanced Distribution Networks State Estimation","volume":"14","author":"Wei","year":"2023","journal-title":"IEEE Trans. Smart Grid"},{"key":"ref_17","unstructured":"Habib, A.A., and Hasan, M.K.H. (2026, August 09). False Data Injection Attack Dataset for Industrial Internet of Things; IEEE DataPort. Available online: https:\/\/ieee-dataport.org\/documents\/false-data-injection-attack-dataset-industrial-internet-things."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"2758","DOI":"10.1038\/s41598-024-52954-z","article-title":"Detection, differentiation and localization of replay attack and false data injection attack based on random matrix","volume":"14","author":"Shen","year":"2024","journal-title":"Sci. Rep."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Ashrafuzzaman, M., Chakhchoukh, Y., Jillepalli, A.A., Tosic, P.T., de Leon, D.C., Sheldon, F.T., and Johnson, B.K. (2018, January 25\u201329). Detecting Stealthy False Data Injection Attacks in Power Grids Using Deep Learning. Proceedings of the 2018 14th International Wireless Communications & Mobile Computing Conference (IWCMC), Limassol, Cyprus.","DOI":"10.1109\/IWCMC.2018.8450487"},{"key":"ref_20","unstructured":"Rai, P., and Sinha, D. (2024). False Data Injection Attack Detection Using Machine Learning in Industrial Internet of Things. Optimized Computational Intelligence Driven Decision-Making, Scrivener Publishing LLC."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"4862","DOI":"10.1109\/TSG.2022.3204796","article-title":"Detection of False Data Injection Attacks in Smart Grid: A Secure Federated Deep Learning Approach","volume":"13","author":"Li","year":"2022","journal-title":"IEEE Trans. Smart Grid"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Shees, A., Tariq, M., and Sarwat, A.I. (2024). Cybersecurity in Smart Grids: Detecting False Data Injection Attacks Utilizing Supervised Machine Learning Techniques. Energies, 17.","DOI":"10.3390\/en17235870"},{"key":"ref_23","unstructured":"Xu, B., Guo, F., Wen, C., Deng, R., and Zhang, W.-A. (2021). Detecting false data injection attacks in smart grids with modeling errors: A deep transfer learning based approach. arXiv."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"102994","DOI":"10.1016\/j.scs.2021.102994","article-title":"A new distributed architecture for evaluating AI-based security systems at the edge: Network TON_IoT datasets","volume":"72","author":"Moustafa","year":"2021","journal-title":"Sustain. Cities Soc."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Wei, L., Gao, D., and Luo, C. (December, January 30). False Data Injection Attacks Detection with Deep Belief Networks in Smart Grid. Proceedings of the 2018 Chinese Automation Congress (CAC), Xi\u2019an, China.","DOI":"10.1109\/CAC.2018.8623514"},{"key":"ref_26","first-page":"2095","article-title":"Sparse Adversarial Learning for FDIA Attack Sample Generation in Distributed Smart Grids","volume":"139","author":"Li","year":"2024","journal-title":"CMES Comput. Model. Eng. Sci."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"1287","DOI":"10.1109\/TAI.2023.3286831","article-title":"Robust Graph Autoencoder-Based Detection of False Data Injection Attacks Against Data Poisoning in Smart Grids","volume":"5","author":"Takiddin","year":"2024","journal-title":"IEEE Trans. Artif. Intell."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"7763","DOI":"10.1038\/s41598-026-37834-y","article-title":"Efficient detection of intrusions in TON-IoT dataset using hybrid feature selection approach","volume":"16","author":"Dharini","year":"2026","journal-title":"Sci. Rep."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"313","DOI":"10.1049\/cps2.12093","article-title":"A survey on detection and localisation of false data injection attacks in smart grids","volume":"9","author":"Irfan","year":"2024","journal-title":"IET Cyber-Phys. Syst. Theory Appl."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Alsabbagh, W., Kim, C., and Langend\u00f6rfer, P. (2024, January 3\u20136). A Payload of Lies: False Data Injection Attacks on MQTT-based IIoT Systems. Proceedings of the IECON 2024\u201450th Annual Conference of the IEEE Industrial Electronics Society, Chicago, IL, USA.","DOI":"10.1109\/IECON55916.2024.10905487"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"31762","DOI":"10.1109\/ACCESS.2019.2902910","article-title":"Detection of False Data Injection Attacks in Smart Grid Utilizing ELM-Based OCON Framework","volume":"7","author":"Xue","year":"2019","journal-title":"IEEE Access"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Potluri, S., Diedrich, C., and Sangala, G.K.R. (2017, January 12\u201315). Identifying false data injection attacks in industrial control systems using artificial neural networks. Proceedings of the 2017 22nd IEEE International Conference on Emerging Technologies and Factory Automation (ETFA), Limassol, Cyprus.","DOI":"10.1109\/ETFA.2017.8247663"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"86977","DOI":"10.1109\/ACCESS.2023.3303015","article-title":"A Machine Learning Based Framework for Real-Time Detection and Mitigation of Sensor False Data Injection Cyber-Physical Attacks in Industrial Control Systems","volume":"11","author":"Elnour","year":"2023","journal-title":"IEEE Access"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Saurabh, K., Sharma, A.K., Singh, U., and Kumar, A. (February, January 31). SecureIIoT: Hybrid Machine Learning Model Based False Data Injection Attacks Detection. Proceedings of the 2026 IEEE International Students\u2019 Conference on Electrical, Electronics and Computer Science (SCEECS), Bhopal, India.","DOI":"10.1109\/SCEECS68810.2026.11430029"},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1109\/TII.2015.2475695","article-title":"Sparse Malicious False Data Injection Attacks and Defense Mechanisms in Smart Grids","volume":"11","author":"Hao","year":"2015","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"8462","DOI":"10.1109\/JIOT.2020.2991693","article-title":"A Machine-Learning-Based Technique for False Data Injection Attacks Detection in Industrial IoT","volume":"7","author":"Aboelwafa","year":"2020","journal-title":"IEEE Internet Things J."},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"2343","DOI":"10.1038\/s41598-025-32035-5","article-title":"Intelligent cybersecurity management in industrial IoT system using attribute reduction with collaborative deep learning enabled false data injection attack detection approach","volume":"16","author":"Alrashdi","year":"2025","journal-title":"Sci. Rep."},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"111692","DOI":"10.1016\/j.dib.2025.111692","article-title":"False data injection attack dataset for classification, identification, and detection for IIoT in Industry 5.0","volume":"61","author":"Habib","year":"2025","journal-title":"Data Brief"},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"e2201","DOI":"10.1002\/nem.2201","article-title":"Dissemination control in dynamic data clustering for dense IIoT against false data injection attack","volume":"32","author":"Pedroso","year":"2022","journal-title":"Int. J. Netw. Manag."},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Orman, A. (2025). Cyberattack Detection Systems in Industrial Internet of Things (IIoT) Networks in Big Data Environments. Appl. Sci., 15.","DOI":"10.3390\/app15063121"},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"G\u00f6nen, S., Bari\u015fkan, M.A., Kaplan, D.Y., Yilmaz, E.N., and \u00c7etin, A. (2023, January 22\u201325). A Novel Approach Detection for False Data Injection, and Man in the Middle Attacks in IoT and IIoT. Proceedings of the 2023 IEEE PES GTD International Conference and Exposition (GTD), Istanbul, Turkiye.","DOI":"10.1109\/GTD49768.2023.00079"},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Alsabbagh, W., Kim, C., Patil, N.S., and Langend\u00f6rfer, P. (2024, January 29\u201331). Beyond the Lens: False Data Injection Attacks on IIoT-Cameras through MQTT Manipulation. Proceedings of the 2024 7th Conference on Cloud and Internet of Things (CIoT), Montreal, QC, Canada.","DOI":"10.1109\/CIoT63799.2024.10757025"},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"19750","DOI":"10.1109\/TASE.2025.3596563","article-title":"An Extended False Data Injection Attack via Deep Reinforcement Learning: Attack Model and Countermeasures in Cyber-Physical Power Systems","volume":"22","author":"Ran","year":"2025","journal-title":"IEEE Trans. Autom. Sci. Eng."},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"174428","DOI":"10.1109\/ACCESS.2025.3618204","article-title":"Cyber-Resilient Smart Grids: A Randomized Coefficient-Based Defense Mechanism Against False Data Injection Attacks","volume":"13","author":"Shahid","year":"2025","journal-title":"IEEE Access"},{"key":"ref_45","doi-asserted-by":"crossref","unstructured":"Abudin, M.J., Thokchom, S., Naayagi, R.T., and Panda, G. (2024). Detecting False Data Injection Attacks Using Machine Learning-Based Approaches for Smart Grid Networks. Appl. Sci., 14.","DOI":"10.3390\/app14114764"},{"key":"ref_46","doi-asserted-by":"crossref","first-page":"1630","DOI":"10.1109\/TSG.2015.2495133","article-title":"A Review of False Data Injection Attacks Against Modern Power Systems","volume":"8","author":"Liang","year":"2017","journal-title":"IEEE Trans. Smart Grid"},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Chalichalamala, S., Govindan, N., and Kasarapu, R. (2023). Logistic Regression Ensemble Classifier for Intrusion Detection System in Internet of Things. Sensors, 23.","DOI":"10.3390\/s23239583"},{"key":"ref_48","unstructured":"Moustafa, N. (2026, May 23). The TON_IoT Datasets. UNSW Canberra at ADFA. Available online: https:\/\/research.unsw.edu.au\/projects\/toniot-datasets."},{"key":"ref_49","doi-asserted-by":"crossref","first-page":"485","DOI":"10.1109\/JIOT.2021.3085194","article-title":"ToN_IoT: The Role of Heterogeneity and the Need for Standardization of Features and Attack Types in IoT Network Intrusion Data Sets","volume":"9","author":"Booij","year":"2022","journal-title":"IEEE Internet Things J."},{"key":"ref_50","doi-asserted-by":"crossref","first-page":"165130","DOI":"10.1109\/ACCESS.2020.3022862","article-title":"TON_IoT Telemetry Dataset: A New Generation Dataset of IoT and IIoT for Data-Driven Intrusion Detection Systems","volume":"8","author":"Alsaedi","year":"2020","journal-title":"IEEE Access"},{"key":"ref_51","doi-asserted-by":"crossref","unstructured":"Mathur, A.P., and Tippenhauer, N.O. (2016, January 11). SWaT: A water treatment testbed for research and training on ICS security. Proceedings of the 2016 International Workshop on Cyber-Physical Systems for Smart Water Networks (CySWater), Vienna, Austria.","DOI":"10.1109\/CySWater.2016.7469060"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/16\/5110\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,8,12]],"date-time":"2026-08-12T12:56:55Z","timestamp":1786539415000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/16\/5110"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,8,12]]},"references-count":51,"journal-issue":{"issue":"16","published-online":{"date-parts":[[2026,8]]}},"alternative-id":["s26165110"],"URL":"https:\/\/doi.org\/10.3390\/s26165110","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,8,12]]}}}