Cyber-Physical Anomaly Detection a Deep Adversarial Fusion of Sensor and Network Data

Abstract

In critical infrastructure, the convergence of physical systems with digital networks forms complex Cyber-Physical Systems (CPS), that are vulnerable to threats compromising both data and physical operations. Traditional security systems, often focused solely on network traffic, create a significant security gap by neglecting the rich contextual data provided by physical sensors. To address this issue, the paper introduces a novel unsupervised multimodal framework that synthesizes data from these dual sources for holistic anomaly detection. The proposed architecture combines pre-trained Variational Autoencoder-Long Short-Term Memory (VAE-LSTM) networks to model temporal dependencies with a dual cross-attention mechanism for deep fusion of latent representations. To enhance the detection of subtle, low-observability threats, the model is further regularized through adversarial training using a discriminator that distinguishes between original and reconstructed data. Evaluated on the comprehensive SWAT dataset, the model successfully identifies 24 out of 26 relevant attack scenarios using 10-second time sequences and achieves an Area Under the Curve (AUC) of 0.87, outperforming unimodal benchmarks. This work validates the critical importance of deep data fusion and presents a more resilient, context-aware defense mechanism for modern CPS.