Semi-Supervised Anomaly Detection for ICS — 2026
Semi-Supervised Anomaly Detection for ICS 2026
Collecting labeled attack data from live critical infrastructure is near-impossible, making semi-supervised methods essential. This landscape covers architectures, application sectors, and the assignee landscape from patent and literature evidence spanning 2013–2025.
Why Semi-Supervised Methods Are Central to ICS Security
Semi-supervised anomaly detection for ICS occupies the methodological space between fully supervised classifiers—which require extensive labeled attack samples—and fully unsupervised methods that suffer from high false-positive rates under dynamic operational conditions. The field in this dataset spans normal-behavior modeling, weakly supervised contrastive learning, and hybrid ensemble pipelines.
Systems operate across two data modalities: network traffic using protocol-level features from Modbus, DNP3, and IEC 104, and physical process measurements from PLCs, RTUs, and SCADA historians. A recurring finding is that fusing both modalities outperforms single-modality approaches, as network-layer camouflage attacks can still be detected through physical process deviations.
Publication dates in this dataset span from 2013 to late 2023, revealing a field that moved from foundational statistical and rule-based work into deep learning dominance within approximately a decade. The SWaT (Secure Water Treatment) testbed developed at Singapore University of Technology and Design became the dominant benchmark across autoencoder and isolation-forest papers.
Patent assignees in retrieved records include IBM, Kyndryl, General Electric, Singapore University of Technology and Design, IIT Kanpur, ABB Technology, Booz Allen Hamilton, and ASELSAN. Filings span US, DE, IN, SG, GB, IL, and WO jurisdictions, with the US remaining the primary commercial IP battleground in this dataset.
Temporal Evolution and Jurisdiction Distribution
Retrieved records in this dataset span four distinct phases from 2013 to 2023, moving from foundational statistical methods to deep learning consolidation and critical reassessment. Patent filings are distributed across US, DE, IN, SG, GB, WO, and IL jurisdictions.
Publication Phase Distribution — Retrieved Records by Era
In this dataset, the 2020–2023 deep learning consolidation and maturation phases account for the majority of retrieved records, with foundational work from 2013–2016 establishing the statistical baseline.
↗ Click bars to explorePatent Jurisdiction Distribution — Retrieved Patent Records
In this dataset, US and DE jurisdictions account for the largest share of enterprise-sector patent filings, with India (IN) showing a notable cluster of recent filings from 2020–2025.
↗ Click bars to exploreKey Deployment Domains for ICS Anomaly Detection
Retrieved records in this dataset span six application sectors: water treatment, electric power grids, industrial manufacturing, energy asset monitoring, oil and gas, and pipeline security. Each domain presents distinct data modalities and threat models that shape architecture choices.
Water Treatment & Distribution
The SWaT (Secure Water Treatment) and WADI (Water Distribution) testbeds at Singapore University of Technology and Design are the most frequently benchmarked environments in this dataset. Nearly every autoencoder and isolation-forest paper validates against SWaT, including the Lightweight LW-LSTM-VAE designed for edge deployment on water purification datasets and the Dual Isolation Forests framework. A combined digital twin anomaly detection framework specifically for water treatment facilities is also documented in retrieved records.
Critical InfrastructureElectric Power Grids & SCADA
Retrieved records cover detection of false data injection attacks (FDIAs) and protocol-level anomalies in energy infrastructure including DNP3-based substations and smart grid PMU networks. The GRU-OCSVM hybrid was demonstrated on power grid source-network-load systems in 2019. Semi-supervised deep representation learning using PMU data requires only normal instances for training. A 2022 paper addresses SCADA security via unsupervised learning and DNP3 function code analysis.
Energy InfrastructureIndustrial Manufacturing & Process Control
Applications in this dataset include chemical reactors, textile production lines, food processing plants, and coal mines using physical process sensor data and digital twin integrations. A 2023 paper on coal mine ICS applies DFA-based interpretable detection, addressing operator trust requirements. The Semantic Hybrid Signal Temporal Logic approach was evaluated on textile process data in 2023, and a 2022 paper integrates digital twins, machine learning, and Industry 4.0 tools in a food plant setting.
Process IndustryEnergy Assets & Pipeline Security
Semi-supervised fault detection in power-generating assets is evidenced by a 2020 paper using LSTM-SAE and CNN-SAE for wind turbine protection under the proactive critical energy infrastructure protection framework. A scalable architecture for jet engines and gas turbines uses OpenTSDB-based ingestion for anomaly visualization. For pipeline and perimeter security, ASELSAN’s 2022 WO patent covers fusion of spatio-temporal unsupervised anomaly detection with supervised classification for Distributed Acoustic Sensing (DAS) systems.
Asset MonitoringKey Patent Assignees in ICS Anomaly Detection — Dataset Snapshot
In retrieved records, IBM holds the earliest ICS-specific anomaly detection patents in the dataset with filings from 2013–2014 in DE and GB jurisdictions, while Kyndryl holds two US patents from 2021 and 2023 covering ensemble deep learning approaches. In this dataset, US and German enterprise assignees account for the largest share of commercial patent filings.
Top Assignees by Filing Count in Retrieved Records (Dataset Snapshot)
↗ Click bars to exploreInternational Business Machines Corporation
IBM holds three patents in this dataset: two active patents in DE jurisdiction (2013, 2014) and one in GB jurisdiction (2014), covering distributed ICS monitoring networks with integrated security policy wrappers. These represent the earliest ICS-specific anomaly detection patents in the retrieved records. The DE patents focus on anomaly detection system architectures applicable to industrial control network environments.
United States — DE/GB filingsKyndryl, Inc.
Kyndryl holds two US patents in this dataset (2021, 2023) covering ensemble deep learning anomaly detection with clustered time-series training and majority-vote anomaly identification for IT/OT infrastructure convergence monitoring. The 2023 patent specifically addresses downstream grouping and mitigation actions following anomaly identification, indicating continued enterprise ICS/IT convergence investment. Both patents are in US jurisdiction.
United States — US filingsFive Forward-Looking Directions from 2022–2023 Records
Based on the most recent filings and publications (2022–2023) in this dataset, five forward-looking directions are evident, spanning contrastive pretraining, dynamic data abstraction, digital twin ecosystems, formal specification models, and protocol-agnostic generalization.
Contrastive and Self-Supervised Pretraining
The 2023 SimCLR-based approach pretrains a feature extractor using contrastive learning on unlabeled ICS traffic, then adds a supervised linear classification head fine-tuned on minimal labeled data. Evaluated on SWaT and Mississippi State University ICS datasets, it outperformed fully supervised baselines. This signals a pivot from reconstruction-based to representation-learning-based semi-supervision, leveraging the entire unlabeled ICS dataset as a pretraining corpus.
Dynamic Data Abstraction for APT-Style Attacks
The December 2023 Dynamic Data Abstraction-Based Anomaly Detection paper proposes real-time noise reduction and abstraction to optimize both update rate and detection boundary simultaneously. It specifically addresses APT-style attacks exploiting zero-day vulnerabilities in OT/IT converged networks. A Snitch Digital Twin concept from 2023 extends beyond single-asset twins to collaborative DT ecosystems modeling behavioral connections between physical entities for inter-system anomaly detection.
Autoencoder-Based vs. One-Class Boundary Methods for ICS
Click any row to explore further.
| Dimension | Autoencoder / Generative Models | One-Class Boundary Methods (OCSVM, IF, SVDD) |
|---|---|---|
| Training data requirement | Normal data only; zero abnormal samples required (e.g., DAGAN architecture) | Normal data only; boundary learned around normal hypersphere or contour |
| Representative architectures | LSTM-Autoencoder, VAE, GAN, DAGAN encoder-decoder-encoder, LW-LSTM-VAE | OCSVM, Isolation Forest, SVDD; often combined with deep feature extractors (1DCAE, GRU) |
| Anomaly signal | Reconstruction error or adversarial discrimination exceeding a dynamically set threshold | Distance or score relative to learned boundary or isolation depth |
| Benchmark evidence | Validated on SWaT, WADI, water purification and distribution datasets in retrieved records | Validated on SWaT, WADI, PLC memory monitoring, and power grid datasets in retrieved records |
| Handling high-dimensional data | Deep autoencoders with DBSCAN outlier removal and Bayesian GMM boundary estimation (2023 paper) | Requires deep feature extraction pre-stage (e.g., 1DCAE) to compress to manageable dimensions |
| Edge deployment suitability | LW-LSTM-VAE designed specifically for resource-constrained ICS edge environments | Isolation Forest and OCSVM are computationally lighter but less expressive for temporal sequences |
| Multimodal fusion | LSTM-AE + GAN fusion combines cyber and physical features for improved recall (2022 paper) | GRU-OCSVM fuses temporal traffic features with one-class boundary for power grid networks |
| Known limitation | Risk of misclassifying unseen marginal normal samples as anomalies; addressed by dynamic margin learning in DAGAN | Performance degrades with high-dimensional raw input without prior deep feature extraction |
Frequently Asked Questions: Semi-Supervised Anomaly Detection for ICS
According to retrieved records, collecting sufficient labeled attack data from live critical infrastructure is near-impossible. ICS networks operate continuously in production, making controlled attack injection infeasible. This scarcity is described as the central bottleneck driving semi-supervised approaches across the dataset.
SWaT (Secure Water Treatment) is a testbed developed at Singapore University of Technology and Design. It is the dominant benchmark in this dataset, with nearly every autoencoder and isolation-forest-based paper validating against it. WADI (Water Distribution) is a related testbed from the same institution.
Retrieved records reveal four clusters: (1) autoencoder and generative model-based normal behavior learning (including LSTM-AE, VAE, GAN variants); (2) one-class and semi-supervised boundary methods (OCSVM, Isolation Forest, SVDD); (3) weakly supervised, contrastive, and self-supervised learning; and (4) hybrid ensemble and multi-stage pipeline architectures.
The 2022 paper ‘Revisiting the State of Machine Learning-Based Industrial Intrusion Detection’ demonstrated that near-perfect F1 scores on SWaT often reflect train-test contamination on the same attack types, meaning models trained and evaluated on identical attack classes overestimate real-world performance. Real-world generalization requires evaluation on held-out, unseen attack classes.
In retrieved records, patent filings are distributed across US, DE, IN, SG, GB, IL, and WO jurisdictions. The US and DE dominate enterprise-sector patents from IBM, GE, and Kyndryl. India (IN) shows a notable cluster of recent filings from 2020–2025 from both multinational assignees (ABB, SUTD via IN filing) and domestic institutions such as IIT Kanpur.
According to retrieved records, fusing both modalities consistently outperforms single-modality approaches. Network-layer camouflage attacks that mimic normal traffic can still be detected through physical process deviations. Patents covering specific cyber-physical fusion architectures are described as representing higher-quality IP positions than pure network-layer methods.
Data and insights on this page are based on a limited patent and literature dataset and are for reference only. Figures may not represent the complete technology landscape.