Modeling Normal Is All You Need: Joint Latent Clustering for Anomaly Detection in Multimodal Cyber-Physical Systems

Jul 16, 2026

Upload by Oliver

Faults in cyber-physical systems are scarce and not representative, making it difficult to learn fault-specific models; anomaly detection must therefore model normal behavior. Conventional point-adjusted evaluation, however, rewards detectors that effectively ignore anomalies. CPS normal behavior is modeled as a union of many imbalanced, curved operating regimes, captured via ten MIIM assumptions. A jointly learned latent representation with explicit Gaussian-mixture mode clustering is scored in latent space and evaluated with a deliberately fair protocol, outperforming baselines on WADI, HAI, and SKAB.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages13

Reading Time33 min

Introduction

Faults and normal behavior in CPS

Why evaluation is difficult

Why modeling is difficult

Contributions and proposed detector

Modeling Normal Is All You Need: Joint Latent Clustering for Anomaly Detection in Multimodal Cyber-Physical Systems Alexander Apartsin Yehudit Aperstein Holon Institute of Technology (HIT), Holon, Israel Afeka Academic College of Engineering, Tel Aviv, Israel Abstract Faults on a cyber-physical system (CPS) are too rare and unrepresentative to characterise, or even to select a model on, so detection must instead model normal behaviour; the standard point-adjusted evaluation, however, rewards detectors that never do. CPS normal behaviour is the union of many imbalanced, curved, thin-fringed operating regimes rather than a single blob; we state this structure as ten assumptions (A1–A10) abbreviated Massive, Implicit, Imbalanced Multimodality (MIIM). We model the normal law with a jointly learned latent representation plus explicit Gaussian-mixture mode clustering, scored in the latent rather than by a global density or a reconstruction residual, and evaluate under a deliberately fair protocol: raw point-wise metrics with no point adjustment, a trivial-detector difficulty split, prevalence-matched F1, and train-normal-only calibration. On three real CPS datasets (WADI, HAI, SKAB) the detector wins both the combined column and the difficult correlation/dynamics-fault column on all three, reaching difficult-subset AUROC 0.831 on HAI, 0.726 on WADI, and 0.610 on SKAB. The margin is largest on the two multimodal datasets theMIIM assumptions target and slimmest on the near-unimodalone, tracking multimodality asthe thesis predicts, and it holds against three deep detectors (USAD, TranAD, GDN) re-computed with the same raw metrics, all of which collapse on the difficult subset. The methodological contributions are the MIIM assumption set, the difficulty-stratified fair protocol, and a latent-only score that drops reconstruction because a flexible decoder rebuilds the hard faults faithfully. 1 Introduction A modern cyber-physical system (CPS), whether a water-treatment plant, an industrial control loop, or a rotating machine, integrates hundreds of sensors, embedded controllers, and physical actuators into a single tightly coupled unit that continuously senses its own state and acts upon it. This complexity puts its faults beyond enumeration: the combinations of component, control mode, and operating condition in which a fault can arise cannot be predefined, tested, or exhaustively sampled before deployment, and many faults develop slowly, as wear, drift, or degradation that shows no obvious symptom until it is well advanced and can escalate into unplanned downtime or a safety-critical failure. Because the faults cannot be specified in advance, they must be discovered from the system’s own behaviour as it operates, which is the task of anomaly detection [22] . That behaviour is richly observable: high-frequency measurements of vibration, current, temperature, pressure, and position, together with internal control signals, are recorded continuously and, in principle, carry an early signature of almost any developing fault. The task is commonly framed as characterising the anomalies, but that framing is misleading. Were a representative set of labelled faults available, the task would reduce to supervised classification; in practice genuine faults are rare and the few on record seldom span the ways a system can fail [24], so scarce faults cannot define the decision boundary and, as revisited below, cannot even be spent reliably on model selec- tion. The information lies on the other side of the boundary, in the normal data, which is abundant and rarely exploited in full. Modelling that normal law faithfully is therefore the hard part of the problem, and cyber-physical normal is a law of a particular kind. Shaped by deterministic physics, hard actuator and setpoint limits, and engineered control, it is the union of many bounded, curved operating regimes, some common and many rare, each with legitimately low-density fringes,

FAQs

Why must anomaly detection in cyber-physical systems model normal behavior instead of faults?

Genuine faults are too rare and too unrepresentative to define reliable decision boundaries or support model selection, while normal data is abundant and captures the system’s legitimate operating regimes.

What problem does point-adjusted F1 create for CPS anomaly detection evaluation?

Point-adjusted F1 can inflate scores so heavily that even simple or random anomaly scoring can outperform published deep models, making headline results misleading.

How does the proposed approach represent and score CPS normality?

It learns a latent representation jointly with explicit Gaussian-mixture mode clustering, and it evaluates anomaly scores in latent space rather than relying on a global density or a reconstruction residual.

Jul 16, 2026

Upload by Oliver