AD-FIT: industrial anomaly detection via fusion of IoT sensing and network traffic data

Abstract

Anomaly detection is an important research topic in the Industrial Internet of Things (IIoT). In recent years, deep learning has been exploited to analyze complex IIoT data and build anomaly detection models. Due to the lack of abnormal samples and the difficulty of labeling industrial data, unsupervised deep learning has become the mainstream technique for IIoT anomaly detection, with autoencoders being the most representative approaches. However, the existing autoencoder-based IIoT anomaly detection models predominantly focus on a single data modality, since existing data fusion frameworks are mostly designed for supervised learning tasks, while it is infeasible to simultaneously reconstruct heterogeneous data modalities in a unified autoencoder. To address this limitation, this paper focuses on IoT sensing data and network traffic data and proposes AD-FIT, a novel autoencoder framework for IIoT anomaly detection via the fusion of IoT sensing and network traffic data in an unsupervised manner. Specifically, it creates multiple local autoencoders with different architectures to fit the two data modalities, and then fuses their reconstruction errors through a global autoencoder. We conducted extensive experiments based on a public IIoT dataset. Experimental results show that AD-FIT achieves the best overall anomaly detection performance among the evaluated baseline methods, with F1-score improvements ranging from 7.1% to 38.6%.

Keywords

Anomaly detection / Industrial Internet of Things / autoencoder / heterogeneous data fusion

References

[1] Pang G,Cao L.Deep learning for anomaly detection: a review.ACM Comput Surv2022;54:1-38

[2] Omar S,Jebur HH.Machine learning techniques for anomaly detection: an overview.Int J Comput Appl2013;79:33-41

[3] Audibert J,Guyard F,Zuluaga MA.USAD: unsupervised anomaly detection on multivariate time series. In Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Min. Association for Computing Machinery; 2020. pp. 3395-404.

[4] Singhal A.Clustering multivariate time‐series data.J Chemometrics2005;19:427-38

[5] Karim S,Yunus PA,Asif M.Implementation of K-means clustering for intrusion detection.Int J Sci Res Comput Sci Eng Inf Technol2019;5:1232-41

[6] Erfani SM,Karunasekera S.High-dimensional and large-scale anomaly detection using a linear one-class SVM with deep learning.Pattern Recognit2016;58:121-34

[7] Liu FT,Zhou ZH.Isolation forest. In 2008 Eighth IEEE International Conference on Data Mining, Pisa, Italy. Dec 15-19, 2008. IEEE; 2008. pp. 413-22.

[8] Malhotra P,Anand G,Agarwal P. LSTM-based encoder-decoder for multi-sensor anomaly detection. arXiv 2016, arXiv:1607.00148. Available online: https://doi.org/10.48550/arXiv.1607.00148. (accessed 2026-09-21)

[9] Zeng F,Qian C,Zhou Y.Multivariate time series anomaly detection with adversarial transformer architecture in the Internet of Things.Future Gener Comput Syst2023;144:244-55

[10] Nanduri A.Anomaly detection in aircraft data using recurrent neural networks (RNN). In 2016 Integrated Communications Navigation and Surveillance (ICNS), Herndon, USA. Apr 19-21, 2016. IEEE; 2016. pp. 5C2-1-8.

[11] Hwang R,Huang C,Nguyen V.An unsupervised deep learning model for early network traffic anomaly detection.IEEE Access2020;8:30387-99

[12] Dutta V,Kozik R.Unsupervised network traffic anomaly detection with deep autoencoders.Log J IGPL2022;30:912-25

[13] Xu W,Singh A,Sabrina F.Improving performance of autoencoder-based network anomaly detection on NSL-KDD dataset.IEEE Access2021;9:140136-46

[14] Said Elsayed, M.; Le-Khac, N. A.; Dev, S.; Jurcut, A. D. Network anomaly detection using LSTM based autoencoder. In Proceedings of the 16th ACM Symposium on QoS and Security for Wireless and Mobile Networks. Association for Computing Machinery; 2020. pp. 37-45.

[15] Zare F,Yousefpour R.A real-time network based anomaly detection in industrial control systems.Int J Crit Infrastruct Prot2024;45:100676

[16] Xu J,Wang J. Anomaly transformer: time series anomaly detection with association discrepancy. In ICLR 2022 Conference. 2022. https://openreview.net/forum?id=LzQQ89U1qm_. (accessed 2026-09-21)

[17] Tuli S,Jennings NR.TranAD: deep transformer networks for anomaly detection in multivariate time series data.Proc VLDB Endow2022;15:1201-14

[18] Zhang W,Tsung F.GRELEN: multivariate time series anomaly detection from the perspective of graph relational learning. In Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence (IJCAI-22). 2022. pp. 2390-7.

[19] Zhou Q,Liu H,Meng W.Detecting multivariate time series anomalies with zero known label.Proc AAAI Conf Artif Intell2023;37:4963-71

[20] Song J,Oh J.MEMTO: memory-guided transformer for multivariate time series anomaly detection. In Proceedings of the 37th International Conference on Neural Information Processing Systems. Curran Associates Inc.; 2023. pp. 57947-63.

[21] Wang C,Qi Q.Drift doesn’t matter: dynamic decomposition with diffusion reconstruction for unstable multivariate time series anomaly detection. In Proceedings of the 37th International Conference on Neural Information Processing Systems. Curran Associates Inc.; 2023. pp. 10758-74.

[22] Dai Z,Yang SH.SARAD: spatial association-aware anomaly detection and diagnosis for multivariate time series. In Proceedings of the 38th International Conference on Neural Information Processing Systems. Curran Associates Inc.; 2024. pp. 48371-410.

[23] Huang X,Hu B.Graph mixture of experts and memory-augmented routers for multivariate time series anomaly detection.Proc AAAI Conf Artif Intell2025;39:17476-84

[24] Liu S,Liu D.FOCAL: contrastive learning for multimodal time-series sensing signals in factorized orthogonal latent space. In Proceedings of the 37th International Conference on Neural Information Processing Systems. Curran Associates Inc.; 2023. pp. 47309-38.

[25] Ferrag MA,Hamouda D,Janicke H.Edge-IIoTset: a new comprehensive realistic cyber security dataset of IoT and IIoT applications for centralized and federated learning.IEEE Access2022;10:40281-306

[26] Neto ECP,Ferreira R,Lu R.CICIoT2023: a real-time dataset and benchmark for large-scale attacks in IoT environment.Sensors2023;23:5941 PMCID:PMC10346235

[27] Qathrady MA,Alshehri MS.SACNN‐IDS: a self‐attention convolutional neural network for intrusion detection in industrial Internet of Things.CAAI Trans Intell Technol2024;9:1398-411

[28] Li X,Zhang G,Wang T.A novel interpretable dynamic weighted domain adaptation network for cross-domain fault diagnosis of bearings under time-varying speeds.Eng Appl Artif Intell2026;170:114173

[29] Griffin JM,Hernández V,Vélez MA.Multiple classification of the force and acceleration signals extracted during multiple machine processes: part 1 intelligent classification from an anomaly perspective.Int J Adv Manuf Technol2017;93:811-23

[30] Janssens O,Vervisch B.Convolutional neural network based fault detection for rotating machinery.J Sound Vib2016;377:331-45

[31] Amruthnath N.A research study on unsupervised machine learning algorithms for early fault detection in predictive maintenance. In 2018 5th International Conference on Industrial Engineering and Applications (ICIEA), Singapore. Apr 26-28, 2018. IEEE; 2018. pp. 355-61.

[32] Diez-Olivan A,Khoa NLD,Sierra B.Kernel-based support vector machines for automated health status assessment in monitoring sensor data.Int J Adv Manuf Technol2018;95:327-40

[33] Joshi SS.Investigating hidden Markov models capabilities in anomaly detection. In Proceedings of the 43rd Annual ACM Southeast Conference. Association for Computing Machinery; 2005. pp. 98-103.

[34] Nguyen MN.Scalable and interpretable one-class SVMs with deep learning and random fourier features. In Berlingerio, M.; Bonchi, F.; Gärtner, T.; Hurley, N.; Ifrim, G.; eds. Machine learning and knowledge discovery in databases. Cham: Springer International Publishing; 2019. pp. 157-72.

[35] Xu H,Zhao N.Unsupervised anomaly detection via variational auto-encoder for seasonal KPIs in web applications. In Proceedings of the 2018 World Wide Web Conference. International World Wide Web Conferences Steering Committee; 2018. pp. 187-96.

[36] Lu C,Qin W.Fault diagnosis of rotary machinery components using a stacked denoising autoencoder-based health state identification.Signal Process2017;130:377-88

[37] Zhang C,Chen Y.A deep neural network for unsupervised anomaly detection and diagnosis in multivariate time series data.Proc AAAI Conf Artif Intell2019;33:1409-16

[38] Yin C,Wang J.Anomaly detection based on convolutional recurrent autoencoder for IoT time series.IEEE Trans Syst Man Cybern Syst2022;52:112-22

[39] Muneer A,Mohamed Fati S,Abdul Aziz I.A hybrid deep learning-based unsupervised anomaly detection in high dimensional data.Comput Mater Contin2022;70:5363-81

[40] Zheng Y.Methodologies for cross-domain data fusion: an overview.IEEE Trans Big Data2015;1:16-34

[41] Xiao X,Luo Q.Inferring social ties between users with human location history.J Ambient Intell Human Comput2014;5:3-19

[42] Ngiam J,Kim M,Lee H. Multimodal deep learning. In Proceedings of the 28th International Conference on Machine Learning, Bellevue, USA. 2011. pp. 689-96. https://ai.stanford.edu/~jngiam/papers/NgiamKhoslaKimNamLeeNg2011.pdf. (accessed 2026-09-21)

[43] Nagrani A,Arnab A,Schmid C. Attention bottlenecks for multimodal fusion. arXiv 2021, arXiv:2107.00135. Available online: https://doi.org/10.48550/arXiv.2107.00135. (accessed 2026-09-21)

[44] Yasaei R,Al Faruque MA.IoT-GRAF: IoT graph learning-based anomaly and intrusion detection through multi-modal data fusion. In 2024 Design, Automation & Test in Europe Conference & Exhibition (DATE), Valencia, Spain. Mar 25-27, 2024. IEEE; 2024. p. 1-6.

[45] Zhan D,Ye L,Zhang H.Anomaly detection in industrial control systems based on cross-domain representation learning.IEEE Trans Dependable Secure Comput2025;22:2505-18

[46] Sun Y,Zheng Y. K-nearest neighbor temporal aggregate queries. In Proceedings of the 18th International Conference on Extending Database Technology. 2015. pp. 493-504. https://www.microsoft.com/en-us/research/publication/k-nearest-neighbor-temporal-aggregate-queries/. (accessed 2026-09-21)

[47] Canonico R,Navarro A,Sperlì G.Empowered cyber–physical systems security using both network and physical data.Comput Secur2025;152:104382

[48] Pinto A,Donoso Y.Cyber-physical anomaly detection a deep adversarial fusion of sensor and network data.Discov Comput2026;29:10064

[49] Shafin SS,Mareels I,Kolluri RR.Sensor self-declaration of numeric data reliability in Internet of Things.IEEE Trans Reliab2025;74:2751-65

[50] Veličković P,Casanova A,Liò P. Graph attention networks. arXiv 2017, arXiv:1710.10903. Available online: https://doi.org/10.48550/arXiv.1710.10903. (accessed 2026-09-21)

[51] Hochreiter S.Long short-term memory.Neural Comput1997;9:1735-80

[52] Ngo G,Chandra R.Evolutionary bagging for ensemble learning.Neurocomputing2022;510:1-14

[53] Kadkhodaei HR,Dehghan M.HBoost: a heterogeneous ensemble classifier based on the boosting method and entropy measurement.Expert Syst Appl2020;157:113482

[54] Zhang H,Liu X.Multi-dimensional feature fusion and stacking ensemble mechanism for network intrusion detection.Future Gener Comput Syst2021;122:130-43

[55] Kuncheva LI.Measures of diversity in classifier ensembles and their relationship with the ensemble accuracy.Mach Learn2003;51:181-207

[56] Booij TM,Meeuwissen E,Hartog FTHD.ToN_IoT: the role of heterogeneity and the need for standardization of features and attack types in IoT network intrusion data sets.IEEE Internet Things J2022;9:485-96

[57] Sokolova M.A systematic analysis of performance measures for classification tasks.Inf Process Manag2009;45:427-37

[58] Li R,He W,Luo J.Multi-layer reconstruction errors autoencoding and density estimate for network anomaly detection.Comput Model Eng Sci2021;128:381-97

[59] Wu Z,Long G,Chang X.Connecting the dots: multivariate time series forecasting with graph neural networks. In Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining. Association for Computing Machinery; 2020. pp. 753-63.