Although the Internet of Things (IoT) can increase efficiency and productivity through intelligent and remote management, it also increases the risk of cyber-attacks. The potential threats to IoT applications and the need to reduce risk have recently become an interesting research topic. It is crucial that effective Intrusion Detection Systems (IDSs) tailored to IoT applications be developed. Such IDSs require an updated and representative IoT dataset for training and evaluation. However, there is a lack of benchmark IoT and IIoT datasets for assessing IDSs-enabled IoT systems. This paper addresses this issue and proposes a new data-driven IoT/IIoT dataset with the ground truth that incorporates a label feature indicating normal and attack classes, as well as a type feature indicating the sub-classes of attacks targeting IoT/IIoT applications for multi-classification problems. The proposed dataset, which is named TON_IoT, includes Telemetry data of IoT/IIoT services, as well as Operating Systems logs and Network traffic of IoT network, collected from a realistic representation of a medium-scale network at the Cyber Range and IoT Labs at the UNSW Canberra (Australia). This paper also describes the proposed dataset of the Telemetry data of IoT/IIoT services and their characteristics. TON_IoT has various advantages that are currently lacking in the state-of-the-art datasets: i) it has various normal and attack events for different IoT/IIoT services, and ii) it includes heterogeneous data sources. We evaluated the performance of several popular Machine Learning (ML) methods and a Deep Learning model in both binary and multi-class classification problems for intrusion detection purposes using the proposed Telemetry dataset.

Cyber-Physical Systems (CPSs) enable Information Technology to be integrated with Operation Technology to efficiently monitor and manage the physical processes of various critical infrastructures. Recent incidents in cyber ecosystems have shown that CPSs are becoming increasingly vulnerable to complex attacks. These incidents often lead to sensing and actuation misbehaviour by illegal manipulations of data, which can severely impact the underlying physical processes of critical infrastructures. Current research acknowledges that IT-based security measures cannot entirely protect CPSs from such threats. Moreover, they are not designed to monitor the measurement level activities of physical processes, and they fail to mitigate blended cyberattacks, especially multi-stage and zero-day ones. This paper addresses these limitations by proposing a framework, named UnSupervised Misbehaviour Detection (USMD), comprising a deep neural network that learns about a systems expected behaviour from data-driven representations. USMD can identify in real-time the attacks on CPSs by using the long-short term memory and Attention method for multi-sensor data. The USMDs performance is evaluated on various known data sets (i.e., ToN IoT, SWaT,WADI and Gas pipeline datasets). The experimental results indicate that the superior performance of USMD compared with six state-of-the-art methods, which we implemented and extensively tested. USMD achieves F-scores of 0.9699 and 0.9702 on SWaT and WADI datasets, respectively.

Idlers are essential to conveyor systems, as well as supporting and guiding belts to ensure production efficiency. Proper idler maintenance prevents failures, reduces downtime, cuts costs, and improves reliability. Most studies on idler fault detection rely on supervised methods, which depend on large labelled datasets for training. However, acquiring such labelled data is often challenging in industrial environments due to the rarity of faults and the labour-intensive nature of the labelling process. To address this, we propose the chroma-augmented semi-supervised anomaly detection (CASSAD) method, designed to perform effectively with limited labelled data. At the core of CASSAD is the one-class SVM (OC-SVM), a model specifically developed for anomaly detection in cases where labelled anomalies are scarce. We also compare CASSAD’s performance with other common models like the local outlier factor (LOF) and isolation forest (iForest), evaluating each with the area under the curve (AUC) to assess their ability to distinguish between normal and anomalous data. CASSAD introduces chroma features, such as chroma energy normalised statistics (CENS), the constant-Q transform (CQT), and the chroma short-time Fourier transform (STFT), enhanced through filtering to capture rich harmonic information from idler sounds. To reduce feature complexity, we utilize the mean and standard deviation (std) across chroma features. The dataset is further augmented using additive white Gaussian noise (AWGN). Testing on an industrial dataset of idler sounds, CASSAD achieved an AUC of 96% and an accuracy of 91%, surpassing a baseline autoencoder and other traditional models. These results demonstrate the model’s robustness in detecting anomalies with minimal dependence on labelled data, offering a practical solution for industries with limited labelled datasets.

The increasing vulnerability of power systems to cyber-attacks has underscored the need for robust data-driven anomaly detection methods. However, existing datasets used to evaluate these methods have several limitations, including restricted availability, limited attack scenarios, and a lack of fidelity assessment. To address these challenges, we first propose a hybrid framework that combines model-based and data-driven methods to generate a dataset under normal operation based on IEEE bus systems (4-, 14-, 39-, and 57-bus systems). The framework solves the direct current (DC) power flow problem to obtain initial measurements. A public load profile is scaled and distributed across these values to generate time-series data. A Kalman filter is integrated for state estimation and filtering. A neural network adaptively fuses the Kalman-filtered data with the original time-series data, generating accurate, temporally correlated measurements that reflect system dynamics. It is trained using physics-informed ground truth derived from DC power flow equations and Kirchhoff’s principles to ensure physical consistency. Second, we simulate two attack scenarios: 1) unpoisoned data, where cyberattacks evade traditional Bad Data Detection (BDD), and 2) data poisoning, where adversarial examples are generated using a Projected Gradient Descent (PGD) attack to improve the robustness of data-driven detection models through adversarial training. Finally, we evaluate supervised and unsupervised machine learning and deep learning models on the proposed dataset under both scenarios. Evaluation results show that the proposed dataset is physically consistent and temporally coherent, offering higher fidelity compared to the benchmark dataset. Moreover, the results reveal that deep neural models remain vulnerable to adversarial threats; however, the proposed poisoned data enhances their robustness through adversarial training.

Cyber-Physical Systems (CPSs) are the backbone of Industry 4.0, seamlessly integrating physical and software components for advanced automation in diverse sectors. Recent cyber incidents have shown that these systems are increasingly vulnerable to targeted attacks. Undetected attacks on CPSs can disrupt operations, compromise safety, and cause significant economic losses. Thus, anomaly-based Intrusion Detection Systems (IDSs) are essential to ensure their safety and security, especially in an unsupervised setting where manual labelling is cost-prohibitive. However, current methods encounter significant challenges with complex and evolving characteristics of data streams generated from CPSs, like high dimensionality, uncertainty, and changing patterns, often resulting in high false alarms and missed attacks. This paper introduces RDSAD, an unsupervised, robust and adaptive anomaly-based intrusion detection method tailored to effectively monitor evolving complex CPS data streams. RDSAD integrates two innovative components: Dynamic Deviation Recognition (DDR) for capturing the underlying system dynamics, and Shift-aware Model Adaptation (SMA) for adaptive model updates in response to changing patterns. Through extensive evaluations, the experimental results demonstrate the superior performance of RDSAD compared with static and streaming state-of-the-art methods. It achieved the best AUC of 0.90 and 0.88 on SWaT and WADI datasets, respectively, and it obtained efficient runtime with large data streams.