A Precision-First Multi-View Temporal Anomaly Detection Framework for Cyber-Physical Systems

Abstract

Anomaly detection is essential for maintaining the reliability of cyber-physical systems such as industrial control and water treatment plants. Traditional approaches like Isolation Forest are widely used due to their simplicity, but they treat each data point independently and ignore temporal patterns, leading to unstable predictions and frequent false alarms. Deep learning methods, while effective in capturing system behavior. However, They are computationally expensive and difficult to generalize across different applications. In this work, propose CT-MIF (Consensus Temporal Multi-View Isolation Forest), a hybrid framework that enhances Isolation Forest by incorporating temporal information and multi-view data representation. The method works with continuous sensor data using temporal features and handles discrete actuator states through probabilistic scoring, enabling a more accurate understanding of system behavior. CT-MIF is evaluated on the SWaT (Secure Water Treatment) dataset, for cyber-physical anomaly detection. Experimental results show that CT-MIF improves detection stability and reduces false positives compared to traditional Isolation Forest, while maintaining lower complexity than deep learning methods.