A Hybrid Machine Learning Framework for Real-Time Anomaly Detection and Cyberattack Mitigation in Industrial Environment

Industrial Control Systems (ICS), encompassing SCADA and DCS environments, are increasingly targeted by sophisticated cyberattacks. Traditional signature-based detection mechanisms are inadequate against zero-day and stealthy anomalies. This paper presents a result-oriented analysis of a deep learning-based unsupervised anomaly detection framework utilizing a Stacked Autoencoder (SAE). The model is trained exclusively on normal operational data from a critical ICS dataset. An anomaly is detected when the data reconstruction error exceeds a dynamically validated threshold (set at 2× the validation loss). Evaluation metrics, including Precision, Recall, and the F1-Score, demonstrate the system’s efficacy, achieving a high True Positive Rate (TPR) of [Insert high percentage, e.g., 96.8%] while maintaining a low False Positive Rate (FPR) of [Insert low percentage, e.g., 1.2%]. The findings confirm that the reconstruction error of the SAE serves as a robust and scalable indicator for real-time anomaly detection in high-dimensional time-series ICS data.