Industrial data are typically multivariate time series characterized by large volume, high dimensionality, and strong temporal dynamics, and thus the traditional univariate anomaly detection methods^[2-6] may not perform effectively.

To handle complex multivariate time-series data, most existing studies use learning-based techniques (including machine learning and deep learning), which can be roughly divided into two categories, i.e., supervised learning techniques and unsupervised learning techniques. In terms of supervised learning techniques, Griffin et al. proposed an anomaly detection method based on neural networks and decision trees to detect anomalies across multiple industrial processes^[29]. Nanduri et al. proposed the use of recurrent neural networks to detect abnormal events that may reduce flight safety factors^[10]. Janssens et al. proposed a convolutional neural network (CNN)-based feature-learning system for detecting fault states in rotating machinery^[30].

Although supervised learning techniques can better distinguish anomalies by explicitly learning the latent patterns from anomaly samples, their practical deployment is challenging because labeled anomalous training data are severely limited. Because normal industrial data can be easily obtained at scale, unsupervised learning techniques are widely used for industrial multivariate time-series anomaly detection. Earlier studies applied traditional unsupervised machine-learning methods such as clustering, One-Class SVM, and iForest. For example, Amruthnath and Gupta applied multiple clustering algorithms for anomaly detection (e.g., K-Means, fuzzy C-Means)^[31]. These algorithms identify behaviors that deviate from normal patterns. Diez-Olivan et al. proposed an anomaly detection method based on One-Class SVM to detect anomalies in sensor data by obtaining anomaly scores based on the distance between samples and the separating hyperplane^[32]. Joshi et al. conducted anomaly detection based on a hidden Markov model (HMM), which constructs a model by extracting features and estimating anomaly probabilities from the generated state sequence^[33]. Nguyen and Vien proposed AE-1SVM, which combines autoencoder-based representation learning with a One-Class SVM for unsupervised anomaly detection^[34].

However, traditional machine-learning techniques rely heavily on feature engineering, which is challenging for high-dimensional and dynamic industrial data. Consequently, researchers have extensively investigated generative encoder-decoder networks for unsupervised anomaly detection in time-series data. For example, Xu et al. proposed Donut, a variational autoencoder (VAE)-based unsupervised anomaly detection method that identifies abnormal time points using the reconstruction probability of time-series observations^[35]. Lu et al. detected anomalies in rotating mechanical components by using a stacked autoencoder^[36]. Zhang et al. proposed MSCRED, which uses a ConvLSTM autoencoder to learn the multiple levels of system operation patterns characterized by multi-scale signature matrices in different time steps^[37]. Yin et al. integrated a CNN with a recurrent autoencoder for detecting anomalies in IoT systems^[38]. Specifically, they used a two-stage sliding window strategy to design the encoder for better feature extraction. Muneer et al. proposed a hybrid model based on a deep autoencoder neural network (DANN) with five layers for detecting anomalies in a real-world gas turbine dataset^[39]. Although the encoder-decoder deep neural networks have achieved promising results for industrial anomaly detection, their performance may be further improved by explicitly learning the relationships between industrial data and network traffic data and appropriately balancing the two data sources.

IoT sensing data and network traffic data represent distinct modalities with different representations, distributions, scales, and densities. For example, industrial sensing data typically consist of measurements collected by multiple sensor devices on a production line, which may include data such as device temperature and pressure. Network traffic data, by contrast, come from packet analysis and include attributes such as source and destination addresses. Consequently, fusing data across these modalities is challenging. Data fusion methods can be categorized as stage-based fusion methods, feature-level fusion methods, and semantic-level fusion methods^[40].

The stage-based methods use different datasets at different stages of a data fusion task. Thus, these datasets are loosely connected, and cross-modal consistency is not explicitly required. For example, Xiao et al. utilized spatial trajectories to detect stay points, converting them into feature vectors based on surrounding points of interest (POIs)^[41]. These feature vectors are hierarchically clustered to form a tree structure, representing users’ location histories and facilitating similarity measurement between users based on their hierarchical graphs.

For feature-level fusion, a common approach is to learn a unified feature representation from disparate datasets using deep neural networks. For example, Ngiam et al. introduced a deep autoencoder architecture to capture intermediate feature representations across modalities, exploring three learning settings: cross-modality learning, shared representation learning, and multimodal fusion, thereby improving single-modality representations and capturing correlations across multiple modalities^[42]. Nagrani et al. introduced a transformer-based multimodal architecture that uses attention bottlenecks to constrain cross-modal interactions through a small set of bottleneck latent units, thereby improving fusion performance while reducing computational cost^[43]. More recently, IoT-GRAF represents heterogeneous sensing and network observations through graph learning for multimodal IoT anomaly and intrusion detection^[44]. Cross-domain representation learning has also been used to jointly capture network behaviors and physical-process states in industrial control systems^[45].

Feature-based data fusion methods treat features as numerical or categorical values without considering their semantic meaning, whereas semantic-level methods capture the semantic information contained in each dataset, recognize relations between features, and provide interpretable and meaningful fusion by incorporating the significance of each dataset and the interplay among the datasets. Although researchers have investigated cross-domain fusion methods, their scope is often limited to specific data-query or application settings. For example, Sun et al. studied k-nearest-neighbor temporal aggregate queries that rank locations by combining spatial distance with temporally aggregated attributes^[46]. Decision-level fusion of network and physical anomaly detectors has been shown to improve cyber–physical threat detection compared with relying on either data source alone^[47]. More recently, an unsupervised adversarial fusion framework combined sensor and network representations through dual cross-attention to detect subtle cyber–physical anomalies^[48]. Despite this progress, robust unsupervised fusion of heterogeneous sensing and network-traffic modalities for IIoT anomaly detection remains insufficiently explored.

In this section, we first define the key concepts and formulate the anomaly detection problem. We then introduce the overall AD-FIT architecture, followed by the modality-specific backbone autoencoders, the unsupervised data-fusion framework, and the final anomaly-detection procedure.

Definition 1 (IoT Sensing Sample): The IoT sensing sample of time slot t is denoted as X_t ∈ R^N×W, where N is the number of sensors, and W is the sampling-window length. Here, X_t is a subsequence of the multivariate time series from the N sensors during the time period of (t-W, t]. Note that a physical sensor may generate multiple readings at each time slot, e.g., an accelerometer generates three readings at each time slot. For notational convenience, we treat each univariate time series in X_t as sampled from an individual virtual sensor.

Definition 2 (Network Traffic Sample): The network traffic sample of time slot t (denoted as Y_t) is the collection of network data packets captured during the time period of (t-W, t].

Definition 3 (IIoT Data Sample): The IIoT data sample of time slot t, denoted as S_t = (X_t, Y_t), is composed of an IoT sensing sample and a network traffic sample during the same time period (t-W, t].

Problem Definition: Industrial anomaly detection in this paper is formulated as learning from IIoT data samples to obtain a function f, which takes S_t as input and produces an output value y_t ∈ {0, 1}, where y_t denotes whether an anomaly occurs at time slot t.

Architecture of AD-FIT: Figure 1 shows the architecture of AD-FIT, which comprises three modules, i.e., IoT-AE module, Network-AE module, and Fusion module. The IoT-AE module applies bootstrap sampling to the IoT sensing samples to create multiple training subsets and then trains multiple autoencoders on the IoT sensing data. Each IoT sensing autoencoder consists of three layers: the graph attention network (GAT) layer, the encoder layer, and the decoder layer. The Network-AE module also applies bootstrap sampling to the set of network traffic samples to create multiple training subsets and then trains multiple autoencoders on the network traffic data. Each autoencoder for network traffic data consists of three layers, i.e., the feature extraction layer, the encoder layer, and the decoder layer. The Fusion module can be viewed as a meta-learner on top of the IoT-AE and Network-AE modules. It takes the reconstruction root mean square errors (RMSEs) produced by the local autoencoders as input and trains a global autoencoder to reconstruct these RMSEs.

In the real-time anomaly detection phase, given an IIoT data sample S_t = (X_t, Y_t), X_t and Y_t are fed into the corresponding autoencoders of the IoT-AE and Network-AE modules, respectively, which produce a series of reconstruction RMSEs. The Fusion module then combines these RMSEs to produce a global RMSE for anomaly detection.

AD-FIT assumes that the input IoT sensing and network-traffic data have undergone basic quality control and are sufficiently reliable. In practical IIoT deployments, sensor drift, missing measurements, and corrupted readings may distort reconstruction errors and propagate to the fusion decision. Although the present framework does not explicitly model reliability and trust, reliability-aware data validation or weighting could be incorporated to improve deployment robustness^[49].

AD-FIT is essentially an ensemble framework of autoencoders, built separately for IoT sensing data and network traffic data before fusion. Because the two data modalities have different characteristics, we used different backbone autoencoders for each.

To evaluate the comparative performance of AD-FIT, we compared it with the following seven baseline methods. All these baseline methods (a) operate in an unsupervised manner without requiring anomalous training samples; (b) consider both data modalities (i.e., the IoT sensing data and network traffic data); and (c) were configured using their best-performing parameter settings.

Threshold: It first calculates the value range for each attribute in the normal samples. Then, given an IIoT data sample, if the value of any of its attributes exceeds the corresponding normal value range, it is identified as abnormal. IoT sensing samples have attributes corresponding to different sensors, while network traffic samples have attributes that are extracted statistical features.

OC-SVM: It refers to the One-Class SVM anomaly detection model^[6]. Specifically, it first learns a boundary that encapsulates the normal samples in a high-dimensional feature space, and then detects abnormal samples that fall outside this boundary.

iForest: It refers to the iForest anomaly detection model, which leverages an ensemble of decision trees^[7]. Specifically, it first splits samples by features using multiple decision trees, then considers samples with shorter average path lengths as anomalies.

MLP-AE: Autoencoder-based anomaly detection identifies anomalous samples according to reconstruction errors^[58]. In our MLP-AE baseline, both the encoder and decoder are implemented using two-layer MLPs.

LSTM-AE: It also refers to an autoencoder-based anomaly detection model, which uses a stacked two-layer LSTM as encoder and decoder^[14].

Hard Voting: It first trains a collection of 2K local autoencoders for both data modalities. Then, these local autoencoders make anomaly detection decisions independently. Finally, given an IIoT data sample, the sample is classified as abnormal if more than K local autoencoders classify it as abnormal.

Soft Voting: It also first trains a collection of 2K local autoencoders for both data modalities. Then, the final anomaly detection decision is based on the local autoencoders’ reconstruction RMSEs. Specifically, for an IIoT data sample, we calculate the average reconstruction RMSE across all local autoencoders and compare it with the predefined threshold δ.

In these baseline methods, Threshold is a rule-based method. OC-SVM, iForest, MLP-AE, and LSTM-AE are feature-level fusion methods. Specifically, given an IIoT data sample S_t = (X_t, Y_t), they first flatten the multivariate time-series IoT sensing sample X_t into a 1-dimensional vector x_t, and extract the statistical feature vector y_t for Y_t. Then, they concatenate x_t and y_t into a unified vector z_t, and train the anomaly detection models based on the unified vectors. Hard Voting, Soft Voting, and AD-FIT are model-level fusion methods. They allow the sub-models to generate outputs independently and fuse these outputs based on a global strategy. The comparison results are shown in Table 1, and the following tendencies could be discerned from the results.

First, although threshold-based detection is widely used in engineering practice, it performs poorly on this dataset, particularly when detecting gradual pattern deviations without abrupt changes in sensor signals. Based on our experimental results, we found that threshold-based detection can detect only simple anomalies in IoT devices, such as significant temperature fluctuations. However, most anomalies in the dataset are caused by complex events, such as network intrusions. For instance, attackers may disrupt the operation of remote sensing devices through intrusion, causing slight deviations from normal patterns in the detected data.

Second, deep-learning-based methods (i.e., MLP-AE and LSTM-AE) perform better than traditional machine-learning-based methods (i.e., OC-SVM and iForest). This is because the deep-learning-based methods have more powerful learning capability that can capture the latent and semantic features of the heterogeneous data, while traditional machine-learning-based methods capture only relatively shallow feature representations.

Third, LSTM-AE outperforms MLP-AE. LSTM is more effective at modeling time-series data as compared to MLP. This indicates that IIoT data samples contain strong temporal patterns, particularly in the IoT sensing time series.

Fourth, the suboptimal performance of Hard Voting is attributed to its difficulty in detecting complex anomalies. For example, anomalies caused by network intrusions may involve subtle deviations from normal behavior. Additionally, because each autoencoder’s decision is weighted equally, the aggregation may be ineffective when an anomaly can be detected by only a small subset of the local autoencoders.

Fifth, among the model-level fusion methods, AD-FIT outperforms Hard Voting and Soft Voting. It shows that learning a global model on the outputs of the sub-models is a better model fusion strategy than the simple voting mechanisms. Although rich supervised signals (e.g., classification probability distributions, classification residuals) are unavailable for data fusion under unsupervised learning, the reconstruction errors generated by diverse local autoencoders can still provide clues for model-level fusion to make joint decisions. AD-FIT also has the best overall performance on anomaly detection.

The most important parameter in AD-FIT is δ, the anomaly-score threshold (Section 3.3.2). Here, we varied δ in the range [0.1, 1], and the experimental results are shown in Figure 5. First, Precision and Recall show opposite trends. As δ increases, the decision criterion becomes more conservative for anomaly detection, so fewer anomalies are detected. As a result, Precision shows a stable increasing phase and Recall shows a stable decreasing phase. Second, Accuracy and F1 exhibit a significant upward trend when increasing δ from 0.1 to 0.2, followed by a stable downward trend by further increasing δ. The best overall performance was achieved at δ = 0.2.

To investigate the impact of the two data modalities (i.e., IoT sensing data and network traffic data) on anomaly-detection performance, we conducted separate tests on the autoencoder for IoT sensing data (IoT-AE) and the autoencoder for network traffic data (Network-AE). Here, IoT-AE was trained as a global autoencoder according to Section 3.3.1 without local autoencoders of the network traffic data. Similarly, Network-AE was trained as a global autoencoder without local autoencoders of the IoT sensing data.

In the first experiment, we compared IoT-AE with AD-FIT and other baseline methods as follows. These baseline methods consider only IoT sensing data.

MLP-IAE: An autoencoder-based anomaly detection model based only on IoT sensing data. It uses a two-layer MLP as the encoder and decoder.

LSTM-IAE: It is also an autoencoder-based anomaly detection model based only on IoT sensing data. It uses a two-layer stacked LSTM as the encoder and decoder.

MTGNN: This is a prediction-based anomaly detection model. Specifically, it first trains a multivariate time-series prediction model based on a novel GNN proposed in^[59], and then detects anomalies by comparing the predicted values and the true values.

The experimental results are shown in Table 2. First, LSTM-IAE, MTGNN, and IoT-AE achieve better performance than MLP-IAE. This indicates that temporal patterns are crucial for IoT sensing data-based anomaly detection, and therefore should not be ignored. Second, IoT-AE has a slight advantage over LSTM-IAE. This result shows that using a graph to capture spatial correlations across dimensions of multivariate time-series data benefits anomaly detection. Third, MTGNN performs worse than LSTM-IAE. MTGNN detects anomalies by predicting the value at a given time point and comparing it with the observed value at that time point. The prediction-based anomaly detection model evaluates prediction error at a single time point, while the autoencoder-based anomaly detection model evaluates reconstruction error over a time range. This suggests that a large proportion of anomalies in our dataset are subtle and collectively evolving trend anomalies, rather than significant value changes at a given time point.

In the second experiment, we compared Network-AE with AD-FIT and other baseline methods as follows. These baseline methods consider only network traffic data. We extracted statistical features according to Section 3.2.2 as the input to these baseline methods.

iForest: The iForest model was trained using only network traffic data.

MLP-NAE: An autoencoder-based anomaly detection model trained only on network traffic data. It uses a two-layer MLP as the encoder and decoder.

The experimental results are shown in Table 3. First, deep-learning-based models (i.e., MLP-NAE and Network-AE) outperform traditional machine-learning-based models (i.e., iForest). This finding is consistent with the results of the previous experiment presented in Section 4.2. Second, Network-AE outperforms MLP-NAE. It demonstrates the advantages of model ensemble, which can reduce the risk of overfitting. Finally, AD-FIT achieves the best overall performance among the evaluated baseline methods. It demonstrates the advantages of multi-view data fusion.

In this section, we use three cases to demonstrate the effectiveness of AD-FIT. Figure 6A and B present the IoT sensing data and network traffic data for Case 1, respectively; Figure 6C and D present the corresponding data for Case 2; and Figure 6E and F present the corresponding data for Case 3. For each case, the IoT sensing data comprise five dimensions (latitude, longitude, temperature, pressure, and humidity), and the network traffic data comprise six representative features.

The first case shows an abnormal sample that cannot be detected by considering only the IoT sensing data, since the five displayed IoT sensing dimensions show no obvious deviation from their normal patterns, as shown in Figure 6A. On the other hand, we can observe a significant deviation in most features of the network traffic data, as shown in Figure 6B, where “Norm” stands for the average value of a specific feature in all the normal samples and “Real” stands for the real value of the feature in the target sample. Here, dst_bytes, dst_ip_bytes, dst_pkts, missed_bytes, src_ip_bytes, and src_pkts denote bytes of packets received by the destination system, bytes of the IP header of the destination system, number of packets received by the destination system, bytes of missed packets, bytes of the IP header of the source system, and number of packets sent by the source system. As a result, this sample can be detected by an anomaly detector based on network traffic data. The second case shows the opposite scenario, where the network traffic data show almost no deviation across all features, while the IoT sensing data curve has pronounced fluctuations (as shown in Figure 6C and D). Therefore, this sample cannot be detected by an anomaly detector based on network traffic data alone but can be detected using IoT sensing data.

As shown in Figure 6E and F, the third case shows a more subtle anomalous sample, where neither IoT sensing data nor network traffic data exhibit significant deviations from normal temporal patterns. Nevertheless, the humidity dimension of the IoT sensing data and the missed_bytes feature of the network traffic data show slight fluctuations. By considering the two factors simultaneously, AD-FIT can successfully identify this abnormal sample, highlighting the advantage of the data fusion scheme.