FROM PATTERNS TO THREATS: A DEEP LEARNING MODEL FOR ANOMALY DETECTION IN CYBER-PHYSICAL SYSTEMS

Cyber-physical systems increasingly rely on interconnected sensing, communication, and control components, creating a need for reliable detection of abnormal behavior. This study proposes a Deep Autoencoder for anomaly detection using the Edge-IIoTset dataset. After preprocessing the full dataset, 2,219,201 observations and 38 numerical features were retained. The proposed model employed a 38–24–12–6–12–24–38 encoder-decoder architecture and was trained exclusively on normal observations to learn representative patterns of expected system behavior. Anomaly decisions were based on reconstruction error, with the classification threshold selected independently from validation data by maximizing the F1-score. To assess model stability, five independent runs were conducted using different random seeds, and results were reported as mean ± standard deviation. The proposed Deep Autoencoder achieved an accuracy of 0.9195 ± 0.0061, precision of 0.9602 ± 0.0204, recall of 0.7348 ± 0.0095, F1-score of 0.8325 ± 0.0121, ROC-AUC of 0.8825 ± 0.0339, and PR-AUC of 0.8640 ± 0.0286. Compared with a Simple Autoencoder baseline, the proposed model improved recall and F1-score while reducing the false positive rate. The results demonstrate that the proposed reconstruction-based representation learning approach can provide an effective and reproducible method for detecting anomalous behavior in cyber-physical environments.