This work explores the application of pre-trained time-series foundation models (FMs) for detecting anomalies in industrial processes and introduces a new time-series forecasting method that filters out suspicious data and uses previously predicted data as input, called Forecast Fallback (FF).
This study develops and evaluates an AI-based analytical system for detecting anomalies in industrial processes. The work reviews major sources of risk in industrial control systems, distinguishes point, contextual, and collective anomalies, and summarizes the principal machine-learning approaches used for industrial anomaly detection. A synthetic dataset modeled on the Secure Water Treatment (SWaT) testbed was created with 10 sensor and actuator variables and 10,000 one-second observations, including 1,000 anomalous samples. After missing-value interpolation, duplicate removal, low-variance filtering, and standardization for consistent analysis and visualization, an Isolation Forest with 200 trees was trained in a novelty-detection configuration using normal operating data. On the held-out test set, the model achieved 88.63% accuracy, 45.86% precision, 75.67% recall, and an F1-score of 57.11%. The results show that Isolation Forest can detect most simulated anomalies, although the relatively low precision indicates a substantial false-alarm burden. Future work should validate the approach on authorized real SWaT or PLC-SCADA data, investigate hybrid temporal models, and incorporate explainable-AI methods to support operator decision-making.
Mehdiyeva Almaz, Ahmedov Elmar, Uzakov Gulom et al.· 2026 International Conferenc...· 0 citations
Industrial monitoring models must detect operationally relevant deviations while satisfying target-specific data, calibration, and resource constraints. Time-series foundation models (TSFMs) promise reusable representations and zero-shot forecasts, yet evidence for their deployment value remains mixed when task definitions are heterogeneous and lightweight baselines are competitive. This work presents a protocol-aware empirical assessment across three settings: a C-MAPSS degradation-risk proxy, normal-only training for anomalous-sound detection on MIMII, and BDG2 forecasting-residual diagnostics with synthetic target perturbations. We assess classical one-class methods, compact neural autoencoders, residual forecasters, MOMENT-small, Chronos-T5, and TimesFM 2.5 in terms of anomaly-ranking performance, risk-horizon sensitivity, residual forecasting and perturbation sensitivity, and local implementation cost. Across 100 C-MAPSS engines evaluated out of fold, TCN-AE reaches fold-weighted AUROC/AUPRC 0.9570/0.8960, compared with 0.7310/0.3080 for MOMENT reconstruction; paired engine-cluster bootstrap confidence intervals exclude zero for both differences. Across five matched MIMII pump evaluations, OCSVM also exceeds MOMENT reconstruction in AUROC and AUPRC. On a fixed 12-meter BDG2 panel, TimesFM 2.5 has the lowest aligned forecast error and the highest synthetic AUROC point estimate, although synthetic AUPRC is similar across TSFM and fitted residual models. Same-device measurements show that MOMENT incurs higher latency, peak allocated VRAM, and serialized state-dictionary size than TCN-AE. Under the evaluated frozen and zero-shot settings, TSFMs are task-dependent deployment options rather than default replacements for fitted lightweight models.
Predictive Maintenance (PdM) is a key component of Industry 4.0, enabling intelligent and data-driven management of industrial assets. Traditional maintenance strategies are no longer sufficient for complex cyber-physical systems, where reliability and efficiency are critical. With the rise of Industrial IoT (IIoT), large volumes of data can be analyzed using machine learning (ML) techniques to predict equipment failures, estimate remaining useful life (RUL), and optimize maintenance schedules. This paper provides a comprehensive study of ML-based PdM frameworks, covering data-driven, physics-based, and hybrid approaches, including supervised, unsupervised, and deep learning models. A structured methodology is proposed, involving data acquisition, preprocessing, feature engineering, model development, and deployment. Key aspects such as degradation modeling, anomaly detection, and performance evaluation are discussed. Challenges including data imbalance, interpretability, scalability, cybersecurity, and real-time implementation are also analyzed. The paper concludes with future directions such as explainable AI, digital twins, federated learning, and autonomous maintenance systems, offering valuable insights for developing efficient and scalable PdM solutions.
Sithik Shah· International Journal of App...· 0 citations
Detecting anomalies in time-series data has significant implications in various domains, including the early detection of equipment and facility conditions in industrial settings and the identification of risk factors in financial markets. However, sensor-based time-series data obtained from real-world sites predominantly consist of normal patterns, with anomalies being extremely rare, resulting in insufficient data for model training. In this paper, we present a method that addresses the imbalance between normal and anomaly data by transforming time-series data into a structured sentence format and using a large language model to generate and augment diverse anomaly scenarios. The generated sentences are then converted back into time-series data and subjected to an internal validation process. This approach enables the construction of a broader range of anomaly data than existing techniques.The proposed method is designed for univariate, continuous valued time-series and is anticipated to serve as an effective data augmentation tool, with extension to broader domains left to future work.
Geunho Lee, Jieun Lee, Tae-yong Kim et al.· Applied Sciences· 0 citations
Multivariate Time Series Anomaly Detection (MTSAD) is essential for reliability and safety in domains such as industrial process monitoring and financial risk management, yet conventional approaches rely on application-specific models that are costly to train and hard to scale. Foundation Models (FMs), pre-trained on broad data with strong zero-shot generalization, have recently become available for univariate time series forecasting, raising the question of whether they can address MTSAD without task-specific training. We investigate the zero-shot application of a univariate forecasting FM, TimesFM, to industrial MTSAD on the Secure Water Treatment (SWaT) benchmark, evaluating two strategies: treating the FM as a per-feature forecaster with thresholded prediction errors, and as an embedder whose intermediate representations feed standard outlier detectors. Neither of our proposed setups is competitive with established baselines; embeddings reveal only partial separation between normal and anomalous segments, insufficient for reliable detection. The cause is that the FM is too effective at capturing temporal dynamics, yielding low error even within fully anomalous windows, so persistent anomalies become indistinguishable from normal behavior. However, these observations yield valuable insights: the error peaks at anomaly boundaries, indicating FMs reliably detect distribution changes. We conclude that the proposed naive zero-shot FMs are unsuitable for MTSAD but promising for change-point detection.
M. Uray, S. Messineo, Roland Kwitt et al.· 0 citations
Machine-learning-based anomaly detection is increasingly used in industrial control systems (ICS), yet most studies assume that detector training data is trustworthy. In practice, training data may be corrupted through compromised logs, labeling errors, manipulated historian records, or unsafe retraining processes. This paper evaluates the robustness of offline ICS anomaly-detection pipelines on the Secure Water Treatment (SWaT) benchmark under training-time contamination. We assess 11 heterogeneous anomaly detectors under three contamination strategies: random injection, similarity-targeted injection, and feature-noise injection. The first two insert attack samples into the nominal training pool, while the third adds bounded Gaussian noise to selected normal training samples. These attacks are contamination-based rather than gradient-driven poisoning methods. Contamination budgets from 1% to 10% are evaluated using clean validation and test sets under a unified offline protocol. The results show that robustness is strongly model-dependent and cannot be predicted from clean-data performance alone. Injection-based contamination causes the greatest degradation, particularly for local-density and distance-based detectors, whereas feature-noise contamination has a comparatively limited effect. PCA, SVM, HBOS, and IForest remain relatively stable, while the tuned neural detectors demonstrate intermediate robustness. Overall, the findings highlight the importance of training-data integrity in ML-enabled ICS monitoring, subject to the evaluated dataset, models, and threat assumptions.
Mustafa Umut Ozbek, Taiwo P. Ojo, Pooria Madani et al.· 0 citations