New Anomaly Detection Method Models Normal Behavior in Cyber-Physical Systems.

Traditional anomaly detection in cyber-physical systems (CPS) struggles because faults are rare and don't represent normal operation well. This new approach tackles this by focusing on modeling the diverse, complex "normal" states of a CPS, which often involve multiple imbalanced and curved operating regimes. The method uses a jointly learned latent representation combined with explicit Gaussian-mixture clustering to define these normal modes. Instead of relying on global density or reconstruction errors, the system scores anomalies within this latent space. The researchers also developed a more rigorous evaluation protocol, avoiding standard point adjustments and using prevalence-matched F1 scores. This new detector significantly outperforms existing deep learning methods on real CPS datasets like WADI, HAI, and SKAB, especially in scenarios with complex, multimodal normal behavior.