AD-FIT: industrial anomaly detection via fusion of IoT sensing and network traffic data

2.1. Industrial anomaly detection

Industrial data are typically multivariate time series characterized by large volume, high dimensionality, and strong temporal dynamics, and thus the traditional univariate anomaly detection methods^[2-6] may not perform effectively.

To handle complex multivariate time-series data, most existing studies use learning-based techniques (including machine learning and deep learning), which can be roughly divided into two categories, i.e., supervised learning techniques and unsupervised learning techniques. In terms of supervised learning techniques, Griffin et al. proposed an anomaly detection method based on neural networks and decision trees to detect anomalies across multiple industrial processes^[29]. Nanduri et al. proposed the use of recurrent neural networks to detect abnormal events that may reduce flight safety factors^[10]. Janssens et al. proposed a convolutional neural network (CNN)-based feature-learning system for detecting fault states in rotating machinery^[30].

Although supervised learning techniques can better distinguish anomalies by explicitly learning the latent patterns from anomaly samples, their practical deployment is challenging because labeled anomalous training data are severely limited. Because normal industrial data can be easily obtained at scale, unsupervised learning techniques are widely used for industrial multivariate time-series anomaly detection. Earlier studies applied traditional unsupervised machine-learning methods such as clustering, One-Class SVM, and iForest. For example, Amruthnath and Gupta applied multiple clustering algorithms for anomaly detection (e.g., K-Means, fuzzy C-Means)^[31]. These algorithms identify behaviors that deviate from normal patterns. Diez-Olivan et al. proposed an anomaly detection method based on One-Class SVM to detect anomalies in sensor data by obtaining anomaly scores based on the distance between samples and the separating hyperplane^[32]. Joshi et al. conducted anomaly detection based on a hidden Markov model (HMM), which constructs a model by extracting features and estimating anomaly probabilities from the generated state sequence^[33]. Nguyen and Vien proposed AE-1SVM, which combines autoencoder-based representation learning with a One-Class SVM for unsupervised anomaly detection^[34].

However, traditional machine-learning techniques rely heavily on feature engineering, which is challenging for high-dimensional and dynamic industrial data. Consequently, researchers have extensively investigated generative encoder-decoder networks for unsupervised anomaly detection in time-series data. For example, Xu et al. proposed Donut, a variational autoencoder (VAE)-based unsupervised anomaly detection method that identifies abnormal time points using the reconstruction probability of time-series observations^[35]. Lu et al. detected anomalies in rotating mechanical components by using a stacked autoencoder^[36]. Zhang et al. proposed MSCRED, which uses a ConvLSTM autoencoder to learn the multiple levels of system operation patterns characterized by multi-scale signature matrices in different time steps^[37]. Yin et al. integrated a CNN with a recurrent autoencoder for detecting anomalies in IoT systems^[38]. Specifically, they used a two-stage sliding window strategy to design the encoder for better feature extraction. Muneer et al. proposed a hybrid model based on a deep autoencoder neural network (DANN) with five layers for detecting anomalies in a real-world gas turbine dataset^[39]. Although the encoder-decoder deep neural networks have achieved promising results for industrial anomaly detection, their performance may be further improved by explicitly learning the relationships between industrial data and network traffic data and appropriately balancing the two data sources.

2.2. Cross-domain data fusion

IoT sensing data and network traffic data represent distinct modalities with different representations, distributions, scales, and densities. For example, industrial sensing data typically consist of measurements collected by multiple sensor devices on a production line, which may include data such as device temperature and pressure. Network traffic data, by contrast, come from packet analysis and include attributes such as source and destination addresses. Consequently, fusing data across these modalities is challenging. Data fusion methods can be categorized as stage-based fusion methods, feature-level fusion methods, and semantic-level fusion methods^[40].

The stage-based methods use different datasets at different stages of a data fusion task. Thus, these datasets are loosely connected, and cross-modal consistency is not explicitly required. For example, Xiao et al. utilized spatial trajectories to detect stay points, converting them into feature vectors based on surrounding points of interest (POIs)^[41]. These feature vectors are hierarchically clustered to form a tree structure, representing users’ location histories and facilitating similarity measurement between users based on their hierarchical graphs.

For feature-level fusion, a common approach is to learn a unified feature representation from disparate datasets using deep neural networks. For example, Ngiam et al. introduced a deep autoencoder architecture to capture intermediate feature representations across modalities, exploring three learning settings: cross-modality learning, shared representation learning, and multimodal fusion, thereby improving single-modality representations and capturing correlations across multiple modalities^[42]. Nagrani et al. introduced a transformer-based multimodal architecture that uses attention bottlenecks to constrain cross-modal interactions through a small set of bottleneck latent units, thereby improving fusion performance while reducing computational cost^[43]. More recently, IoT-GRAF represents heterogeneous sensing and network observations through graph learning for multimodal IoT anomaly and intrusion detection^[44]. Cross-domain representation learning has also been used to jointly capture network behaviors and physical-process states in industrial control systems^[45].

Feature-based data fusion methods treat features as numerical or categorical values without considering their semantic meaning, whereas semantic-level methods capture the semantic information contained in each dataset, recognize relations between features, and provide interpretable and meaningful fusion by incorporating the significance of each dataset and the interplay among the datasets. Although researchers have investigated cross-domain fusion methods, their scope is often limited to specific data-query or application settings. For example, Sun et al. studied k-nearest-neighbor temporal aggregate queries that rank locations by combining spatial distance with temporally aggregated attributes^[46]. Decision-level fusion of network and physical anomaly detectors has been shown to improve cyber–physical threat detection compared with relying on either data source alone^[47]. More recently, an unsupervised adversarial fusion framework combined sensor and network representations through dual cross-attention to detect subtle cyber–physical anomalies^[48]. Despite this progress, robust unsupervised fusion of heterogeneous sensing and network-traffic modalities for IIoT anomaly detection remains insufficiently explored.

3.1. Preliminary

In this section, we first define the key concepts and formulate the anomaly detection problem. We then introduce the overall AD-FIT architecture, followed by the modality-specific backbone autoencoders, the unsupervised data-fusion framework, and the final anomaly-detection procedure.

Definition 1 (IoT Sensing Sample): The IoT sensing sample of time slot t is denoted as X_t ∈ R^N×W, where N is the number of sensors, and W is the sampling-window length. Here, X_t is a subsequence of the multivariate time series from the N sensors during the time period of (t-W, t]. Note that a physical sensor may generate multiple readings at each time slot, e.g., an accelerometer generates three readings at each time slot. For notational convenience, we treat each univariate time series in X_t as sampled from an individual virtual sensor.

Definition 2 (Network Traffic Sample): The network traffic sample of time slot t (denoted as Y_t) is the collection of network data packets captured during the time period of (t-W, t].

Definition 3 (IIoT Data Sample): The IIoT data sample of time slot t, denoted as S_t = (X_t, Y_t), is composed of an IoT sensing sample and a network traffic sample during the same time period (t-W, t].

Problem Definition: Industrial anomaly detection in this paper is formulated as learning from IIoT data samples to obtain a function f, which takes S_t as input and produces an output value y_t ∈ {0, 1}, where y_t denotes whether an anomaly occurs at time slot t.

Architecture of AD-FIT: Figure 1 shows the architecture of AD-FIT, which comprises three modules, i.e., IoT-AE module, Network-AE module, and Fusion module. The IoT-AE module applies bootstrap sampling to the IoT sensing samples to create multiple training subsets and then trains multiple autoencoders on the IoT sensing data. Each IoT sensing autoencoder consists of three layers: the graph attention network (GAT) layer, the encoder layer, and the decoder layer. The Network-AE module also applies bootstrap sampling to the set of network traffic samples to create multiple training subsets and then trains multiple autoencoders on the network traffic data. Each autoencoder for network traffic data consists of three layers, i.e., the feature extraction layer, the encoder layer, and the decoder layer. The Fusion module can be viewed as a meta-learner on top of the IoT-AE and Network-AE modules. It takes the reconstruction root mean square errors (RMSEs) produced by the local autoencoders as input and trains a global autoencoder to reconstruct these RMSEs.

Figure 1. The architecture of AD-FIT. IIoT: Industrial Internet of Things; IoT: Internet of Things; AE: autoencoder; RMSE: root mean square error.

In the real-time anomaly detection phase, given an IIoT data sample S_t = (X_t, Y_t), X_t and Y_t are fed into the corresponding autoencoders of the IoT-AE and Network-AE modules, respectively, which produce a series of reconstruction RMSEs. The Fusion module then combines these RMSEs to produce a global RMSE for anomaly detection.

AD-FIT assumes that the input IoT sensing and network-traffic data have undergone basic quality control and are sufficiently reliable. In practical IIoT deployments, sensor drift, missing measurements, and corrupted readings may distort reconstruction errors and propagate to the fusion decision. Although the present framework does not explicitly model reliability and trust, reliability-aware data validation or weighting could be incorporated to improve deployment robustness^[49].

3.2. The backbone autoencoders

AD-FIT is essentially an ensemble framework of autoencoders, built separately for IoT sensing data and network traffic data before fusion. Because the two data modalities have different characteristics, we used different backbone autoencoders for each.

3.2.1. IoT sensing data-based autoencoder

The backbone autoencoder for IoT sensing data is composed of three layers, i.e., the GAT layer, the encoder layer, and the decoder layer. The GAT layer learns potential correlations between different sensors. The encoder layer learns spatial and temporal patterns in IoT sensing data. The decoder layer reconstructs the input data.

(1) The GAT Layer
The IoT sensing data are represented as high-dimensional multivariate time series. First, these dimensions, which represent different sensors, may exhibit potential correlations and cross-effects. For example, detecting some anomalies requires considering data from multiple sensors simultaneously. Second, different sensors may contribute differently to anomaly detection. For example, pressure data in a hydraulic system are usually more important for anomaly detection than the data from other sensors. To address these issues, the GAT layer uses a graph to model the correlations between different dimensions of the IoT sensing data (Step 1), and then the correlation strengths are learned using a GAT subnetwork (Step 2).

Step 1 (Sensor graph construction): A sensor graph is represented as G = (V, E, F), where each node v_i ∈ V represents a dimension of the IoT sensing data (corresponding to a sensor), each edge e_ij ∈ E represents a correlation between sensor v_i and v_j, and F represents the set of node features, where each element f_i denotes the original feature of node v_i (i.e., the univariate time-series data collected from sensor v_i). Domain knowledge can determine whether two sensors are correlated when constructing the sensor graph. However, because domain knowledge is often hard to obtain, we design G as a fully connected graph when domain knowledge is unavailable.

Step 2 (Correlation strength learning): Following the graph attention mechanism proposed by Veličković et al.^[50], we apply GAT to learn the correlation strength between each pair of nodes in G. As illustrated in Figure 2, for each edge e_ij in G, its correlation strength w_ij is calculated according to Equation (1), where a_ij is the unnormalized attention score, k is the index of a node in the first-order neighborhood of v_i, and L is the number of nodes in this neighborhood, including v_i itself.

(1) $$ w_{i j}=\frac{\exp \left(a_{i j}\right)}{\sum_{k=1}^{L} \exp \left(a_{i k}\right)} $$

Figure 2. Correlation-strength learning based on GAT. GAT: Graph attention network.

The unnormalized attention score a_ij is further calculated according to Equation (2), where q is a learnable parameter vector and σ(…) is a nonlinear activation function.

(2) $$ a_{i j}=\sigma\left(q^{\mathrm{T}} \cdot\left(f_{i} \oplus f_{j}\right)\right) $$

The normalized correlation strengths are subsequently used to aggregate the neighboring features and update the embedding g_i of node v_i according to Equation (3), where w_ik is the normalized correlation strength from node v_k to node v_i and f_k is the original feature of node v_k.

(3) $$ g_{i}=\sigma\left(\sum_{k=1}^{L} w_{i k} f_{k}\right) $$

After the two steps, each IoT sensing sample X_t is represented as a feature matrix GX_t ∈ R^N×W, where the i-th row of GX_t represents the embedding vector of node v_i (i.e., g_i).

(2) The Encoder Layer
The autoencoder maps the original IoT sensing samples into a lower-dimensional latent feature space using an encoder and then reconstructs the latent features into the original sample space using a decoder. The autoencoder was trained by gradually reducing the errors between original samples and reconstructed samples through backpropagation.

Because the latent features have lower dimensionality than the original samples, the latent features can capture the dominant patterns of the original samples. For the anomaly detection task, the autoencoder is trained based on normal samples (or mostly normal samples), so the latent features learned by the trained autoencoder can represent the dominant patterns of normal samples. If a reconstructed sample deviates greatly from the original, it means the original sample does not conform to the main patterns of normal samples, indicating an anomaly.

Considering the temporal characteristics of IoT sensing samples, we employ an LSTM encoder based on the recurrent architecture proposed by Hochreiter and Schmidhuber^[51]. As shown in Figure 3, given an IoT sensing sample X_t = [x_t-W+1, x_t-W+2, …, x_t] (x_t ∈ R^N×1 denotes the sensor-reading vector at time slot t), we first input X_t into the GAT layer to obtain the updated feature matrix GX_t = [gx_t-W+1, gx_t-W+2, …, gx_t]. At each time slot t, the encoder updates its hidden state h_t^ie from the previous state h_t-1^ie and the current GAT-enhanced feature gx_t according to Equation (4), where the superscript “ie” denotes the IoT sensing data encoder.

(4) $$ h_{t}^{i e}=\operatorname{LSTM}\left(h_{t-1}^{i e}, g x_{t}\right) $$

Figure 3. The architecture of the LSTM autoencoder. LSTM: Long short-term memory; GAT: graph attention network; IoT: Internet of Things.

(3) The Decoder Layer
As shown in Figure 3, the decoder takes h_t^ie as input and also uses an LSTM subnetwork to output W hidden state vectors h_t-W+1^id, h_t-W+2^id, …, h_t^id based on Equation (5). After that, a fully connected subnetwork is used to reconstruct h_t-W+1^id, h_t-W+2^id, …, h_t^id into the same dimensions as the original samples $$ \tilde{X} $$_t ∈ R^N×W.

(5) $$ h_{t}^{i d}=\operatorname{LSTM}\left(h_{t-1}^{i d}, h_{t}^{i e}\right) $$

Following the reconstruction-error objective commonly used in LSTM-based autoencoders, we train the autoencoder for IoT sensing data by minimizing the RMSE between the original sample X_t and its reconstruction $$ \tilde{X} $$_t, as defined in Equation (6), where N is the number of sensors; W is the sampling-window length; and Loss_I denotes the resulting reconstruction loss for sample X_t.

(6) $$ \operatorname{Loss}_{I}=\sqrt{\frac{1}{N W} \sum_{i=1}^{N} \sum_{j=1}^{W}\left(X_{t}[i, j]-\widetilde{X}_{t}[i, j]\right)^{2}} $$

3.3. Data fusion via ensemble of autoencoders

3.3.1. Unsupervised data fusion framework

Because IoT sensing data and network traffic data typically have distinct dimensions and characteristics, a single, unified autoencoder cannot process both. Instead, we used autoencoders with different structures to model them. However, IoT sensing data and network traffic data collected from the same IIoT system may exhibit semantic correlations. For example, in a smart home environment, an attacker could remotely control a door lock. Because attack behaviors involve infiltrating the household’s smart home network and lurking on edge devices, clues can be reflected in both network traffic data and device log data. Therefore, a data fusion mechanism is needed to learn semantic correlations across the IoT sensing data and network traffic data.

However, existing data fusion frameworks are designed for supervised learning tasks. For example, the most popular traditional data fusion frameworks (including Bagging^[52], Boosting^[53], and Stacking^[54]) perform data fusion by exploiting classification consistency, classification residual, or classification probability distribution, whereas such information is unavailable in unsupervised settings. Deep learning models usually perform data fusion by integrating different subnetworks in a unified learning objective. Unfortunately, it is infeasible to simultaneously reconstruct heterogeneous data modalities in a unified autoencoder.

To address this challenge, we propose a data-fusion framework for autoencoders with different data modalities. As shown in Figure 4, this framework comprises three parts: data sampling, local autoencoder training, and global autoencoder training.

Figure 4. The data fusion framework for autoencoders. AE: Autoencoder; RMSE: root mean square error; GAE: global autoencoder.

(1) Data Sampling
Ensembling multiple sub-models is an effective approach for data fusion. Diversity among component models is an important factor affecting ensemble performance^[55]. Thus, we used bootstrap sampling to create multiple training subsets for both IoT sensing data and network traffic data. Specifically, given a training dataset D, we perform K bootstrap iterations. In each iteration, a training subset is generated by randomly selecting N^S samples from D with replacement, which means that a sample in D can be selected multiple times or not at all in the training subset. By applying bootstrap sampling, we can generate diverse training subsets for each data modality.

Finally, we can obtain K training subsets for both IoT sensing data (denoted as IDS = {ID₁, ID₂, …, ID_K}) and network traffic data (denoted as TDS = {TD₁, TD₂, …, TD_K}).

(2) Local Autoencoder Training
After obtaining the collections of training subsets IDS and TDS for both data modalities, we train multiple autoencoders through the following steps. First, for each training subset ID_k in IDS, we train a backbone autoencoder for IoT sensing data (denoted as IAE_k). Second, for each training subset TD_k in TDS, we train a backbone autoencoder for network traffic data (denoted as NAE_k). Finally, we can obtain a set of IoT sensing data-based local autoencoders IAES = {IAE₁, IAE₂, …, IAE_K} and a set of network traffic data-based local autoencoders NAES = {NAE₁, NAE₂, …, NAE_K}. This ensures that each training subset is used to train a dedicated local autoencoder, and the resulting collection of local autoencoders is capable of capturing diverse patterns within the IIoT data.

(3) Global Autoencoder Training
To fuse the multiple local autoencoders from IAES and NAES, we train a global autoencoder to capture their joint semantic correlations and behavioral patterns. The core idea is inspired by stacking, i.e., the global autoencoder is trained on the outputs of the local autoencoders, but in an unsupervised manner. The specific steps are as follows.

RMSE generation: Given an IIoT data sample S_t = (X_t, Y_t), we input the IoT sensing sample X_t into each local autoencoder in IAES. For each local autoencoder IAE_k, it outputs a reconstructed sample $$ \tilde{X} $$_t, and we calculate the RMSE between X_t and $$ \tilde{X} $$_t [denoted as IRMSE(t)_k]. Similarly, we represent the network traffic sample Y_t as a feature vector y_t and input y_t into each local autoencoder in NAES. Each local autoencoder NAE_k outputs a reconstructed sample $$ \tilde{y} $$_t, and we also calculate the RMSE between y_t and $$ \tilde{y} $$_t [denoted as NRMSE(t)_k]. Then, we can obtain an RMSE vector for IIoT data sample S_t [denoted as ES(t) = <IRMSE(t)₁, IRMSE(t)₂, …, IRMSE(t)_K, NRMSE(t)₁, NRMSE(t)₂, …, NRMSE(t)_K>], which represents the distribution of anomaly scores across different semantic spaces. Finally, we can obtain a collection of RMSE vectors for the entire training dataset D [denoted as ES = {ES(1), ES(2), …, ES(|D|)}].

Global autoencoder training: The global autoencoder (denoted as GAE) is trained to capture the normal patterns of the outputs of all the local autoencoders. Specifically, GAE takes an RMSE vector ES(t) as input, and outputs a reconstructed RMSE vector E$$ \tilde{S} $$(t) through an encoder and a decoder. We utilize the same encoder and decoder structures as in Section 3.2.2 (i.e., an MLP encoder and an MLP decoder). We train GAE on the RMSE vector dataset ES by minimizing the loss function in Equation (9).

(9) $$ \operatorname{Loss}_{G}=\frac{1}{|D|} \sum_{t=1}^{|D|} \sqrt{\frac{\sum_{i=1}^{2 K}(E S(t)[i]-E \tilde{S}(t)[i])^{2}}{2 K}} $$

Since GAE is trained on the outputs from all data modalities and all semantic spaces, it is expected to discover latent anomalies that are difficult to detect based on a single autoencoder or a single data modality. For example, some latent and stealthy anomalies might not necessarily cause all local autoencoders to generate high reconstruction RMSEs.

4.1. Experiment setup

4.2. Experiment 1: Comparison Experiment

To evaluate the comparative performance of AD-FIT, we compared it with the following seven baseline methods. All these baseline methods (a) operate in an unsupervised manner without requiring anomalous training samples; (b) consider both data modalities (i.e., the IoT sensing data and network traffic data); and (c) were configured using their best-performing parameter settings.

Threshold: It first calculates the value range for each attribute in the normal samples. Then, given an IIoT data sample, if the value of any of its attributes exceeds the corresponding normal value range, it is identified as abnormal. IoT sensing samples have attributes corresponding to different sensors, while network traffic samples have attributes that are extracted statistical features.

OC-SVM: It refers to the One-Class SVM anomaly detection model^[6]. Specifically, it first learns a boundary that encapsulates the normal samples in a high-dimensional feature space, and then detects abnormal samples that fall outside this boundary.

iForest: It refers to the iForest anomaly detection model, which leverages an ensemble of decision trees^[7]. Specifically, it first splits samples by features using multiple decision trees, then considers samples with shorter average path lengths as anomalies.

MLP-AE: Autoencoder-based anomaly detection identifies anomalous samples according to reconstruction errors^[58]. In our MLP-AE baseline, both the encoder and decoder are implemented using two-layer MLPs.

LSTM-AE: It also refers to an autoencoder-based anomaly detection model, which uses a stacked two-layer LSTM as encoder and decoder^[14].

Hard Voting: It first trains a collection of 2K local autoencoders for both data modalities. Then, these local autoencoders make anomaly detection decisions independently. Finally, given an IIoT data sample, the sample is classified as abnormal if more than K local autoencoders classify it as abnormal.

Soft Voting: It also first trains a collection of 2K local autoencoders for both data modalities. Then, the final anomaly detection decision is based on the local autoencoders’ reconstruction RMSEs. Specifically, for an IIoT data sample, we calculate the average reconstruction RMSE across all local autoencoders and compare it with the predefined threshold δ.

In these baseline methods, Threshold is a rule-based method. OC-SVM, iForest, MLP-AE, and LSTM-AE are feature-level fusion methods. Specifically, given an IIoT data sample S_t = (X_t, Y_t), they first flatten the multivariate time-series IoT sensing sample X_t into a 1-dimensional vector x_t, and extract the statistical feature vector y_t for Y_t. Then, they concatenate x_t and y_t into a unified vector z_t, and train the anomaly detection models based on the unified vectors. Hard Voting, Soft Voting, and AD-FIT are model-level fusion methods. They allow the sub-models to generate outputs independently and fuse these outputs based on a global strategy. The comparison results are shown in Table 1, and the following tendencies could be discerned from the results.

First, although threshold-based detection is widely used in engineering practice, it performs poorly on this dataset, particularly when detecting gradual pattern deviations without abrupt changes in sensor signals. Based on our experimental results, we found that threshold-based detection can detect only simple anomalies in IoT devices, such as significant temperature fluctuations. However, most anomalies in the dataset are caused by complex events, such as network intrusions. For instance, attackers may disrupt the operation of remote sensing devices through intrusion, causing slight deviations from normal patterns in the detected data.

Second, deep-learning-based methods (i.e., MLP-AE and LSTM-AE) perform better than traditional machine-learning-based methods (i.e., OC-SVM and iForest). This is because the deep-learning-based methods have more powerful learning capability that can capture the latent and semantic features of the heterogeneous data, while traditional machine-learning-based methods capture only relatively shallow feature representations.

Third, LSTM-AE outperforms MLP-AE. LSTM is more effective at modeling time-series data as compared to MLP. This indicates that IIoT data samples contain strong temporal patterns, particularly in the IoT sensing time series.

Fourth, the suboptimal performance of Hard Voting is attributed to its difficulty in detecting complex anomalies. For example, anomalies caused by network intrusions may involve subtle deviations from normal behavior. Additionally, because each autoencoder’s decision is weighted equally, the aggregation may be ineffective when an anomaly can be detected by only a small subset of the local autoencoders.

Fifth, among the model-level fusion methods, AD-FIT outperforms Hard Voting and Soft Voting. It shows that learning a global model on the outputs of the sub-models is a better model fusion strategy than the simple voting mechanisms. Although rich supervised signals (e.g., classification probability distributions, classification residuals) are unavailable for data fusion under unsupervised learning, the reconstruction errors generated by diverse local autoencoders can still provide clues for model-level fusion to make joint decisions. AD-FIT also has the best overall performance on anomaly detection.

4.3. Experiment 2: Parameter Tuning Experiment

The most important parameter in AD-FIT is δ, the anomaly-score threshold (Section 3.3.2). Here, we varied δ in the range [0.1, 1], and the experimental results are shown in Figure 5. First, Precision and Recall show opposite trends. As δ increases, the decision criterion becomes more conservative for anomaly detection, so fewer anomalies are detected. As a result, Precision shows a stable increasing phase and Recall shows a stable decreasing phase. Second, Accuracy and F1 exhibit a significant upward trend when increasing δ from 0.1 to 0.2, followed by a stable downward trend by further increasing δ. The best overall performance was achieved at δ = 0.2.

Figure 5. The effect of parameter δ.

4.4. Experiment 3: Ablation Experiment

To investigate the impact of the two data modalities (i.e., IoT sensing data and network traffic data) on anomaly-detection performance, we conducted separate tests on the autoencoder for IoT sensing data (IoT-AE) and the autoencoder for network traffic data (Network-AE). Here, IoT-AE was trained as a global autoencoder according to Section 3.3.1 without local autoencoders of the network traffic data. Similarly, Network-AE was trained as a global autoencoder without local autoencoders of the IoT sensing data.

In the first experiment, we compared IoT-AE with AD-FIT and other baseline methods as follows. These baseline methods consider only IoT sensing data.

MLP-IAE: An autoencoder-based anomaly detection model based only on IoT sensing data. It uses a two-layer MLP as the encoder and decoder.

LSTM-IAE: It is also an autoencoder-based anomaly detection model based only on IoT sensing data. It uses a two-layer stacked LSTM as the encoder and decoder.

MTGNN: This is a prediction-based anomaly detection model. Specifically, it first trains a multivariate time-series prediction model based on a novel GNN proposed in^[59], and then detects anomalies by comparing the predicted values and the true values.

The experimental results are shown in Table 2. First, LSTM-IAE, MTGNN, and IoT-AE achieve better performance than MLP-IAE. This indicates that temporal patterns are crucial for IoT sensing data-based anomaly detection, and therefore should not be ignored. Second, IoT-AE has a slight advantage over LSTM-IAE. This result shows that using a graph to capture spatial correlations across dimensions of multivariate time-series data benefits anomaly detection. Third, MTGNN performs worse than LSTM-IAE. MTGNN detects anomalies by predicting the value at a given time point and comparing it with the observed value at that time point. The prediction-based anomaly detection model evaluates prediction error at a single time point, while the autoencoder-based anomaly detection model evaluates reconstruction error over a time range. This suggests that a large proportion of anomalies in our dataset are subtle and collectively evolving trend anomalies, rather than significant value changes at a given time point.

In the second experiment, we compared Network-AE with AD-FIT and other baseline methods as follows. These baseline methods consider only network traffic data. We extracted statistical features according to Section 3.2.2 as the input to these baseline methods.

iForest: The iForest model was trained using only network traffic data.

MLP-NAE: An autoencoder-based anomaly detection model trained only on network traffic data. It uses a two-layer MLP as the encoder and decoder.

The experimental results are shown in Table 3. First, deep-learning-based models (i.e., MLP-NAE and Network-AE) outperform traditional machine-learning-based models (i.e., iForest). This finding is consistent with the results of the previous experiment presented in Section 4.2. Second, Network-AE outperforms MLP-NAE. It demonstrates the advantages of model ensemble, which can reduce the risk of overfitting. Finally, AD-FIT achieves the best overall performance among the evaluated baseline methods. It demonstrates the advantages of multi-view data fusion.

4.5. Experiment 4: Case Study

In this section, we use three cases to demonstrate the effectiveness of AD-FIT. Figure 6A and B present the IoT sensing data and network traffic data for Case 1, respectively; Figure 6C and D present the corresponding data for Case 2; and Figure 6E and F present the corresponding data for Case 3. For each case, the IoT sensing data comprise five dimensions (latitude, longitude, temperature, pressure, and humidity), and the network traffic data comprise six representative features.

Figure 6. Representative cases illustrating the complementary roles of IoT sensing data and network traffic data in AD-FIT. (A) IoT sensing data of Case 1, which show no obvious deviation from normal patterns; (B) network traffic data of Case 1, which show significant deviations in multiple features; (C) IoT sensing data of Case 2, which show pronounced fluctuations; (D) network traffic data of Case 2, which show no obvious deviation from normal patterns; (E) IoT sensing data of Case 3, in which the humidity dimension shows a slight fluctuation; and (F) network traffic data of Case 3, in which the missed_bytes feature shows a slight deviation. IoT: Internet of Things.

The first case shows an abnormal sample that cannot be detected by considering only the IoT sensing data, since the five displayed IoT sensing dimensions show no obvious deviation from their normal patterns, as shown in Figure 6A. On the other hand, we can observe a significant deviation in most features of the network traffic data, as shown in Figure 6B, where “Norm” stands for the average value of a specific feature in all the normal samples and “Real” stands for the real value of the feature in the target sample. Here, dst_bytes, dst_ip_bytes, dst_pkts, missed_bytes, src_ip_bytes, and src_pkts denote bytes of packets received by the destination system, bytes of the IP header of the destination system, number of packets received by the destination system, bytes of missed packets, bytes of the IP header of the source system, and number of packets sent by the source system. As a result, this sample can be detected by an anomaly detector based on network traffic data. The second case shows the opposite scenario, where the network traffic data show almost no deviation across all features, while the IoT sensing data curve has pronounced fluctuations (as shown in Figure 6C and D). Therefore, this sample cannot be detected by an anomaly detector based on network traffic data alone but can be detected using IoT sensing data.

As shown in Figure 6E and F, the third case shows a more subtle anomalous sample, where neither IoT sensing data nor network traffic data exhibit significant deviations from normal temporal patterns. Nevertheless, the humidity dimension of the IoT sensing data and the missed_bytes feature of the network traffic data show slight fluctuations. By considering the two factors simultaneously, AD-FIT can successfully identify this abnormal sample, highlighting the advantage of the data fusion scheme.