A Comparative Study of Time Series Anomaly Detection Models for Industrial Control Systems.

Current industrial network security lacks clear guidance on selecting optimal detection tools for diverse operational environments. Prior research has shown that various automated systems exist to identify potential faults or malicious intrusions. However, existing literature often evaluates these tools under isolated or narrow conditions. This gap motivated a need for standardized benchmarking across common experimental configurations. No prior work had resolved the confusion regarding which specific model performs best in realistic settings. That uncertainty drove the need for a rigorous, side-by-side evaluation of current state-of-the-art approaches. Researchers previously struggled to compare these diverse architectures due to inconsistent testing protocols. This investigation fills that void by applying uniform metrics to several prominent detection frameworks.

The aim of this study is to provide a comprehensive comparison of state-of-the-art anomaly detection models for industrial control systems. Researchers seek to resolve the confusion surrounding model selection in real-world scenarios. Many existing frameworks lack evaluation under standardized conditions, making it difficult for practitioners to choose the best tool. This investigation addresses the problem by testing five representative models using uniform experimental configurations. The authors intend to identify which architectures perform best across different public datasets. They also examine the impact of training set size on the overall effectiveness of these systems. By clarifying these performance differences, the team hopes to guide better decision-making in industrial security. This work establishes a clear benchmark for evaluating future developments in the field.

Review approach involves a systematic benchmarking of five distinct time-series architectures. The investigators select InterFusion, RANSynCoder, GDN, LSTM-ED, and USAD for this comprehensive assessment. Each framework undergoes evaluation using the SWaT and HAI datasets to ensure consistency. The team measures detection accuracy through the F1-score metric across all trials. They also record the duration required for both training and testing phases to assess computational efficiency. The review approach incorporates an analysis of how training set volume influences final model output. By systematically reducing input data, the authors determine the minimum requirements for maintaining high performance. This structured methodology allows for a direct comparison of diverse models under identical operational conditions.

Key findings from the literature reveal that model performance is highly dependent on the specific dataset. InterFusion achieves the peak F1-score of 90.7% when processing the SWaT dataset. For the HAI dataset, RANSynCoder demonstrates the highest performance with an F1-score of 82.9%. The data indicates that no single model consistently outperforms others across all tested environments. Regarding computational efficiency, the authors document variations in training and testing times for each architecture. The analysis shows that 40% of the total training set is sufficient to reach performance levels similar to using the entire dataset. This observation holds true across the models tested in this comparative framework. These results highlight the importance of dataset-specific model selection for industrial security applications.

The authors demonstrate that performance varies significantly depending on the specific dataset utilized for evaluation. Synthesis and implications suggest that practitioners must carefully select models based on their unique operational environment. The researchers propose that InterFusion provides superior results when applied to the Secure Water Treatment (SWaT) dataset. Conversely, the team identifies RANSynCoder as the most effective option for the HAI dataset. These findings imply that no single architecture serves as a universal solution for industrial security. The study indicates that training data requirements are often lower than previously assumed by many developers. Evidence shows that utilizing 40% of the total training volume produces results comparable to full-scale training. This synthesis highlights the necessity of dataset-specific validation rather than relying on generalized performance claims.