Modeling Normal Is All You Need: Joint Latent Clustering for Anomaly Detection in Multimodal Cyber-Physical Systems

2026-07-07

AI Summary

This study addresses the challenge of anomaly detection in cyber-physical systems, where anomalies are rare and difficult to model, and existing methods are often compromised by ineffective detectors. The authors propose a reconstruction-free anomaly detection framework that jointly learns latent representations and explicit Gaussian mixture clustering to model and score only normal behavior in the latent space. To better capture the multimodal nature of normal operational patterns, the approach incorporates the MIIM tenet hypotheses and introduces a difficulty-stratified, fair evaluation protocol. Evaluated on three real-world datasets—WADI, HAI, and SKAB—the method achieves state-of-the-art performance, with AUROC scores of 0.726, 0.831, and 0.610 respectively on challenging multimodal subsets, significantly outperforming advanced deep learning baselines such as USAD, TranAD, and GDN.

Abstract

Faults on a cyber-physical system (CPS) are too rare and unrepresentative to characterise, or even to select a model on, so detection must instead model normal behaviour; the standard point-adjusted evaluation, however, rewards detectors that never do. CPS normal behaviour is the union of many imbalanced, curved, thin-fringed operating regimes rather than a single blob; we state this structure as ten assumptions (A1-A10), abbreviated Massive, Implicit, Imbalanced Multimodality (MIIM). We model the normal law with a jointly learned latent representation plus explicit Gaussian-mixture mode clustering, scored in the latent rather than by a global density or a reconstruction residual, and evaluate under a deliberately fair protocol: raw point-wise metrics with no point adjustment, a trivial-detector difficulty split, prevalence-matched F1, and train-normal-only calibration. On three real CPS datasets (WADI, HAI, SKAB), the detector wins both the combined column and the difficult correlation/dynamics-fault column on all three, reaching difficult-subset AUROC 0.831 on HAI, 0.726 on WADI, and 0.610 on SKAB. The margin is largest on the two multimodal datasets the MIIM assumptions target and slimmest on the near-unimodal one, tracking multimodality as the thesis predicts, and it holds against three deep detectors (USAD, TranAD, GDN) re-computed with the same raw metrics, all of which collapse on the difficult subset. The methodological contributions are the MIIM assumption set, the difficulty-stratified fair protocol, and a latent-only score that drops reconstruction because a flexible decoder rebuilds the hard faults faithfully.

Problem

• anomaly detection
• cyber-physical systems
• multimodality
• normal behavior modeling
• imbalanced data

Innovation

• MIIM assumptions
• latent clustering
• anomaly detection
• fair evaluation protocol
• multimodal cyber-physical systems