Autoencoder

Autoencoders learn exclusively from normal operational data without requiring labeled attack samples. This is critical for OT environments where zero-day threats and novel attack vectors have no pre-existing signatures.

• Trains only on benign SCADA traffic baselines
• No dependency on historical breach data
• Adapts to unique network topologies without manual rule creation

The network forces data through a latent space bottleneck—a compressed hidden layer with fewer neurons than the input. This constraint prevents the model from simply memorizing and regurgitating data, compelling it to learn the essential statistical structure of legitimate Modbus or DNP3 traffic.

• Encoder compresses high-dimensional protocol fields
• Latent space captures normal behavioral patterns
• Decoder reconstructs expected command sequences

The core detection mechanism: Mean Squared Error (MSE) between the original input vector and the reconstructed output. Legitimate SCADA commands produce low error; malicious function codes or manipulated payloads yield high error.

• Threshold-based alerting on error magnitude
• Per-feature error analysis pinpoints the anomalous field
• Enables detection of malformed Modbus write requests

Autoencoders serve as non-linear alternatives to Principal Component Analysis (PCA) for compressing high-dimensional sensor data. In substation automation, they reduce thousands of telemetry points into compact representations while preserving the relationships critical for anomaly detection.

• Handles non-linear correlations in IEC 61850 traffic
• Reduces computational load on edge monitoring devices
• Preserves temporal dependencies across polling cycles

Variational Autoencoders extend the architecture by learning a probability distribution over the latent space rather than a fixed vector. This enables probabilistic anomaly scoring—measuring how likely a given SCADA command is under the learned distribution of normal behavior.

• Provides confidence intervals for anomaly scores
• More robust to noisy sensor data
• Enables generative replay for concept drift mitigation

When implemented with LSTM or GRU layers, autoencoders learn the sequential grammar of industrial protocols. They predict the next expected command in a sequence and flag deviations—critical for detecting attacks that inject valid but out-of-order function codes.

• Models command ordering in DNP3 polling loops
• Detects replay attacks with stale timestamps
• Captures multi-step attack chains across time windows

The fundamental metric used by autoencoders to flag anomalies. It quantifies the difference between the original input and the model's reconstructed output, typically using Mean Squared Error (MSE) or Mean Absolute Error (MAE).

• A high reconstruction error indicates the input does not conform to the learned manifold of normal data.
• In SCADA networks, a Modbus write command that deviates from normal operational sequences will produce a high error score.
• The anomaly threshold is set statistically, often at the 99th percentile of reconstruction errors observed on a clean validation set.

The compressed, lower-dimensional bottleneck representation where the autoencoder captures the essential structure of the input data. The encoder forces data through this informational constraint.

• The dimensionality of the latent space is a critical hyperparameter; too small loses fidelity, too large allows the model to memorize noise.
• A well-trained latent space on DNP3 traffic will cluster normal read requests tightly, while malformed function codes map to distant, sparse regions.
• Visualization techniques like t-SNE or UMAP are often applied to the latent vectors to visually inspect the separation of normal and anomalous clusters.

A probabilistic spin on the classic autoencoder. Instead of encoding an input to a fixed point in latent space, a VAE encodes it to a distribution (parameterized by a mean and variance).

• This generative property allows a VAE to not just reconstruct, but to sample new, synthetic data points from the learned distribution.
• In anomaly detection, the reconstruction probability—not just the error—provides a more principled statistical measure of outlier status.
• VAEs are particularly useful for modeling the stochastic nature of sensor telemetry in Operational Technology (OT) environments.

A variant trained to reconstruct a clean input from a deliberately corrupted version. The model learns to filter out noise and focus on the robust, underlying features of the data.

• Training involves adding Gaussian noise or dropout to the input while the loss is still computed against the original, uncorrupted data.
• This forces the hidden layers to learn more resilient feature representations, preventing the model from simply learning the identity function.
• Highly effective for predictive maintenance on transformers, where the model must ignore normal sensor drift and only flag true mechanical degradation patterns.

An autoencoder that imposes a sparsity constraint on the activations of the hidden units, forcing only a small fraction of neurons to fire for any given input.

• This is typically achieved by adding a KL divergence penalty or an L1 regularization term to the loss function.
• Sparse representations mimic the behavior of biological visual systems and tend to learn highly interpretable, edge-like features.
• In ICS protocol analysis, a sparse autoencoder can isolate the specific, rare command structures that define a unique operational mode, making deviations instantly detectable.

The defining architectural constraint of a standard autoencoder. The bottleneck hidden layer must have strictly fewer dimensions than the input layer.

• This dimensionality reduction prevents the model from trivially copying the input and forces it to learn a compressed, salient representation.
• If the hidden layer is too wide (overcomplete), the model risks memorizing the training data, leading to low reconstruction error even on anomalies.
• For high-dimensional phasor measurement unit (PMU) data, an undercomplete bottleneck is essential to capture the low-dimensional manifold of stable grid oscillations.