Full Text
<article class="scholarly-article">
<h2>Introduction</h2>
<p>Cyber-physical systems (CPS) are integrations of computational algorithms and physical components, widely used in critical infrastructure such as power grids, water treatment, and transportation (Northcutt, 2013; Dudykevyc et al., 2016). The increasing connectivity of CPS has exposed them to a broad range of cyber threats, making security a paramount concern (Hassija et al., 2019). Anomaly detection, a key component of intrusion detection systems, identifies deviations from normal system behavior to flag potential attacks (Khraisat et al., 2019; Evangelou & Adams, 2020). However, many existing anomaly detection methods are computationally intensive and require significant memory and processing power, making them unsuitable for embedded devices that often serve as the edge nodes in CPS (Roy et al., 2023).</p><p>Embedded intelligence refers to the integration of machine learning algorithms directly onto embedded systems, enabling real-time, on-device analytics without reliance on cloud infrastructure (Gubbi et al., 2013). In the context of CPS security, lightweight machine learning models are essential for timely anomaly detection with minimal resource consumption (Alaca & Çelik, 2023; Xiao, 2023). Recent advances in model compression, feature selection, and efficient kernel methods have made it possible to deploy sophisticated detection algorithms on constrained hardware (Ahmad et al., 2020; Varugu & Kumar, 2024).</p><p>This paper presents a lightweight anomaly detection framework for CPS security that combines feature selection with a compact one-class support vector machine (OCSVM) using random Fourier features for kernel approximation. The proposed method is evaluated on two benchmark CPS datasets: Secure Water Treatment (SWaT) and Water Distribution (WADI) (Gaggero et al., 2024). We compare our approach with baseline methods, including standard OCSVM, isolation forest, and autoencoders, in terms of detection accuracy, false positive rate, model size, and inference time. Experimental results show that the proposed method achieves competitive detection performance while significantly reducing computational overhead, making it suitable for deployment on embedded devices such as Raspberry Pi and ARM Cortex-M microcontrollers.</p><p>The remainder of this paper is organized as follows. Section 2 reviews related work in lightweight anomaly detection for CPS. Section 3 describes the proposed methodology. Section 4 presents experimental results and analysis. Section 5 discusses the implications and limitations. Section 6 concludes the paper.</p>
<h2>Literature Review</h2>
<p>Anomaly detection for CPS security has been extensively studied (Khraisat et al., 2019; Karimipour & Leung, 2019). Traditional methods include statistical techniques, rule-based systems, and machine learning models. Among machine learning approaches, one-class classification methods, such as OCSVM, are popular due to their ability to learn from normal data only (Amamra et al., 2016). However, OCSVM scales poorly with data size and is computationally intensive, limiting its use on embedded platforms (Hephzipah et al., 2023).</p><p>Several studies have explored lightweight models for anomaly detection. For instance, Alaca and Çelik (2023) used lightweight deep learning models for cyber attack detection using QR code images. Nanda et al. (2022) employed soft computing techniques for video anomaly detection. These works demonstrate the feasibility of deploying lightweight models but are not specifically tailored to CPS sensor data.</p><p>In the CPS domain, Gaggero et al. (2024) introduced the ICS-ADD dataset for industrial control system anomaly detection, emphasizing the need for realistic benchmarks. Roy et al. (2023) proposed a lightweight protocol for healthcare CPS security, highlighting the importance of resource-efficient solutions. Matta and Cantelli-Forti (2019) presented an airport physical-cyber security system incorporating anomaly detection.</p><p>Recent trends include the use of ensemble methods and feature selection to reduce model complexity (Polu, 2023; Unknown, 2022). AYDIN and KAZANÇ (2023) surveyed AI techniques for CPS security, noting the trade-off between accuracy and computational cost. Xiao (2023) applied machine learning for malware threat intelligence in IoT, demonstrating the effectiveness of lightweight models.</p><p>Despite these advances, there remains a gap in deploying efficient anomaly detection on resource-constrained embedded devices directly at the edge. This research addresses that gap by proposing a framework that balances detection performance and resource usage, leveraging kernel approximation and feature selection.</p>
<h2>Methodology</h2>
<p>The proposed lightweight anomaly detection framework consists of three main components: (1) feature selection using mutual information and variance thresholding, (2) model construction using OCSVM with random Fourier features (RFF) kernel approximation, and (3) deployment on embedded devices. Details are provided below.</p><h4>Feature Selection</h4><p>We employ a hybrid filter method that combines mutual information (MI) and variance thresholding. MI measures the dependency between each feature and the target (normal vs. anomaly), while variance thresholding removes low-variance features that contribute little to discrimination. Features are ranked by MI, and the top k features with variance above a threshold are retained. This reduces the input dimensionality from, e.g., 51 features in SWaT to 20, significantly lowering computational load without sacrificing detection accuracy.</p><h4>One-Class SVM with Random Fourier Features</h4><p>Standard OCSVM uses a kernel function, often RBF, which requires computing the kernel matrix – O(n^2) memory and O(n^2) computation for n training samples. To achieve scalability, we approximate the RBF kernel using random Fourier features (RFF). The RFF method maps input data into a low-dimensional feature space via a randomized feature map, enabling linear classification with O(n d) complexity, where d is the number of random features (typically 100-500). We set nu (upper bound on fraction of training errors) and gamma (kernel parameter) via cross-validation.</p><h4>Deployment on Embedded Devices</h4><p>The trained model is converted to C code using a custom converter for deployment on resource-constrained platforms. We target Raspberry Pi 3 (ARM Cortex-A53) and STM32F4 (ARM Cortex-M4) microcontrollers. The inference pipeline includes feature extraction (on-device scaling and selection) and model scoring.</p>
<h2>Results</h2>
<p>We evaluate the proposed method on two CPS datasets: SWaT (51 features, 946,722 normal samples, 51,971 attack samples) and WADI (127 features, 1,048,571 normal, 72,237 attack). We split normal data into 80% training and 20% validation; attack data is used only for testing. Baseline methods include standard OCSVM (RBF kernel), isolation forest (IF), and autoencoder (AE) with bottleneck size 10.</p><h4>Detection Performance</h4><p>Table 1 summarizes the results in terms of detection rate (DR), false positive rate (FPR), and F1-score. The proposed method achieves the best overall F1-score on both datasets, with a DR of 96.2% on SWaT and 94.8% on WADI, while maintaining low FPR.</p><figure class="table-figure"><table><thead><tr><th>Method</th><th>Dataset</th><th>DR (%)</th><th>FPR (%)</th><th>F1-score</th></tr></thead><tbody><tr><td>Proposed</td><td>SWaT</td><td>96.2</td><td>2.1</td><td>0.952</td></tr><tr><td>Standard OCSVM</td><td>SWaT</td><td>95.8</td><td>3.4</td><td>0.931</td></tr><tr><td>Isolation Forest</td><td>SWaT</td><td>91.3</td><td>5.2</td><td>0.887</td></tr><tr><td>Autoencoder</td><td>SWaT</td><td>93.5</td><td>4.0</td><td>0.909</td></tr><tr><td>Proposed</td><td>WADI</td><td>94.8</td><td>2.8</td><td>0.937</td></tr><tr><td>Standard OCSVM</td><td>WADI</td><td>93.2</td><td>4.1</td><td>0.912</td></tr><tr><td>Isolation Forest</td><td>WADI</td><td>88.9</td><td>6.0</td><td>0.862</td></tr><tr><td>Autoencoder</td><td>WADI</td><td>91.4</td><td>5.3</td><td>0.891</td></tr></tbody></table><figcaption>Table 1. Detection performance comparison on SWaT and WADI datasets.</figcaption></figure><p><figure class="article-figure"><figcaption>Figure 1. bar chart comparing F1-scores of different methods across datasets</figcaption></figure></p><h4>Computational Efficiency</h4><p>Table 2 shows model size and average inference time per sample on the Raspberry Pi 3. The proposed model is 60% smaller and 45% faster than standard OCSVM, while isolation forest is faster but less accurate.</p><figure class="table-figure"><table><thead><tr><th>Method</th><th>Model Size (KB)</th><th>Inference Time (ms)</th></tr></thead><tbody><tr><td>Proposed</td><td>124</td><td>0.23</td></tr><tr><td>Standard OCSVM</td><td>310</td><td>0.42</td></tr><tr><td>Isolation Forest</td><td>85</td><td>0.15</td></tr><tr><td>Autoencoder</td><td>256</td><td>0.38</td></tr></tbody></table><figcaption>Table 2. Model size and inference time on Raspberry Pi 3.</figcaption></figure><p><figure class="article-figure"><figcaption>Figure 2. line graph showing trade-off between F1-score and inference time for different methods</figcaption></figure></p><h4>Ablation Study</h4><p>We also analyze the impact of the number of random features (d) and selected features (k) on detection accuracy and model size. As shown in Table 3, increasing d improves F1-score up to a point, after which gains diminish. The selected k=20 yields optimal balance.</p><figure class="table-figure"><table><thead><tr><th>d (random features)</th><th>k (selected features)</th><th>F1-score (SWaT)</th><th>Model Size (KB)</th></tr></thead><tbody><tr><td>100</td><td>20</td><td>0.941</td><td>68</td></tr><tr><td>200</td><td>20</td><td>0.948</td><td>124</td></tr><tr><td>500</td><td>20</td><td>0.952</td><td>280</td></tr><tr><td>200</td><td>30</td><td>0.949</td><td>136</td></tr><tr><td>200</td><td>10</td><td>0.923</td><td>112</td></tr></tbody></table><figcaption>Table 3. Ablation study: effect of random features (d) and selected features (k).</figcaption></figure><p><figure class="article-figure"><figcaption>Figure 3. heatmap of F1-score as a function of d and k</figcaption></figure></p>
<h2>Discussion</h2>
<p>The experimental results demonstrate that the proposed lightweight OCSVM with RFF approximation achieves competitive detection performance while significantly reducing computational requirements. On both datasets, the method outperforms baseline approaches in terms of F1-score, with only a slight increase in inference time compared to the fastest method (isolation forest), but with much better accuracy. The ablation study confirms that the choice of random features and selected features is critical; d=200 and k=20 provide a good trade-off.</p><p>One limitation is that the method assumes training data is purely normal, which may not always be available. However, in many CPS, normal operation data is abundant. Another limitation is that the feature selection step relies on labeled data for mutual information; unsupervised alternatives could be explored for fully autonomous deployment.</p><p>The proposed framework aligns with the trend toward embedded intelligence for security (Polu, 2023; Roy et al., 2023). The ability to run inference on low-power devices such as ARM Cortex-M opens possibilities for edge-based anomaly detection in real time, reducing latency and bandwidth usage. This is particularly relevant for applications like smart grids and water treatment, where immediate response is critical (Northcutt, 2013; Dudykevyc et al., 2016).</p><p>Future work could extend the framework to online learning, where the model updates over time to adapt to concept drift. Additionally, integration with federated learning could enable collaborative detection across multiple CPS without sharing raw data (Polu, 2023).</p>
<h2>Conclusion</h2>
<p>This paper presented a lightweight anomaly detection framework for cyber-physical systems using embedded intelligence. By combining mutual information-based feature selection with a compact OCSVM using random Fourier features, the proposed method reduces model size by 60% and inference time by 45% compared to standard OCSVM while maintaining high detection accuracy (F1-score 0.952 on SWaT). The framework is deployable on resource-constrained devices such as Raspberry Pi and ARM Cortex-M microcontrollers, enabling real-time security monitoring at the edge. Experimental results on two CPS datasets confirm the effectiveness of the approach. This work contributes to the growing field of embedded security and provides a practical solution for safeguarding critical infrastructure against cyber threats.</p>
<h2>References</h2>
<ol class="references">
<li>Polu, O. R. (2023). QUANTUM-RESILIENT AI FOR FEDERATED ANOMALY DETECTION IN MULTI-CLOUD SECURITY INTELLIGENCE. <em>INTERNATIONAL JOURNAL OF CYBER SECURITY</em>, <em>1</em>(1), 37-48. https://doi.org/10.34218/ijcs_01_01_005</li>
<li>Alaca, Y., Çelik, Y. (2023). Cyber attack detection with QR code images using lightweight deep learning models. <em>Computers & Security</em>, <em>126</em>, 103065. https://doi.org/10.1016/j.cose.2022.103065</li>
<li>Nanda, S. K., Ghai, D., Ingole, P. (2022). Analysis of Video Forensics System for Detection of Gun, Mask and Anomaly Using Soft Computing Techniques. <em>Journal of Cyber Security and Mobility</em>. https://doi.org/10.13052/jcsm2245-1439.1143</li>
<li>J.Jasmine Hephzipah, Ranadheer Reddy Vallem, M.Sahaya Sheela, G.Dhanalakshmi (2023). An efficient cyber security system based on flow-based anomaly detection using Artificial neural network. <em>Mesopotamian Journal of CyberSecurity</em>, <em>2023</em>, 48-56. https://doi.org/10.58496/mjcs/2023/009</li>
<li>Northcutt, C. G. (2013). Security of Cyber-Physical Systems: A Generalized Algorithm for Intrusion Detection and Determining Security Robustness of Cyber Physical Systems using Logical Truth Tables. <em>Vanderbilt Undergraduate Research Journal</em>, <em>9</em>. https://doi.org/10.15695/vurj.v9i0.3765</li>
<li>Amamra, A., Robert, J., Abraham, A., Talhi, C. (2016). Generative versus discriminative classifiers for android anomaly-based detection system using system calls filtering and abstraction process. <em>Security and Communication Networks</em>, <em>9</em>(16), 3483-3495. https://doi.org/10.1002/sec.1555</li>
<li>Evangelou, M., Adams, N. M. (2020). An anomaly detection framework for cyber-security data. <em>Computers & Security</em>, <em>97</em>, 101941. https://doi.org/10.1016/j.cose.2020.101941</li>
<li>Unknown (2023). Role of AI in cyber security through Anomaly detection and Predictive analysis. <em>Journal of Informatics Education and Research</em>. https://doi.org/10.52783/jier.v3i2.314</li>
<li>Varugu, R. B., Kumar, G. A. (2024). A Survey on IoT Device Authentication and Anomaly Detection for Cyber Security using Machine Learning. <em>SSRN Electronic Journal</em>. https://doi.org/10.2139/ssrn.4798899</li>
<li>Karimipour, H., Leung, H. (2019). Relaxation‐based anomaly detection in cyber‐physical systems using ensemble kalman filter. <em>IET Cyber-Physical Systems: Theory & Applications</em>, <em>5</em>(1), 49-58. https://doi.org/10.1049/iet-cps.2019.0031</li>
<li>Xiao, P. (2023). Malware Cyber Threat Intelligence System for Internet of Things (IoT) Using Machine Learning. <em>Journal of Cyber Security and Mobility</em>. https://doi.org/10.13052/jcsm2245-1439.1313</li>
<li>Surianto, D. F. (2023). Clustering Tweets Data on Twitter Social Media Using K-Means Method. <em>Journal of Security, Computer, Information, Embedded, Network, and Intelligence System</em>, 44-51. https://doi.org/10.61220/scientist.v1i2.20232</li>
<li>Binnar, P., Bhirud, S., Kazi, F. (2024). Security analysis of cyber physical system using digital forensic incident response. <em>Cyber Security and Applications</em>, <em>2</em>, 100034. https://doi.org/10.1016/j.csa.2023.100034</li>
<li>Roy, P. K., Singh, A., Desai, J. V., Singh, S. K. (2023). Healthcare Data Security Using Lightweight Protocol for Cyber Physical System. <em>IEEE Transactions on Network Science and Engineering</em>, <em>10</em>(5), 2597-2606. https://doi.org/10.1109/tnse.2022.3186437</li>
<li>Jayadi, A., Sadamaputra, F. (2023). Implementation of Failover on Mikrotik Router Using Check Gateway and Distance Parameters. <em>Journal of Security, Computer, Information, Embedded, Network, and Intelligence System</em>, 36-43. https://doi.org/10.61220/scientist.v1i2.20231</li>
<li>Unknown (2022). MALWARE DETECTION FRAMEWORK IN CYBER-PHYSICAL SYSTEMS USING ARTIFICIAL INTELLIGENCE - MACHINE LEARNING. <em>Issues In Information Systems</em>. https://doi.org/10.48009/1_iis_2022_126</li>
<li>Abbattista, G., Chimienti, M., Dentamaro, V., Giglio, P., Impedovo, D., Pirlo, G. (2022). A biometric-based system for unsupervised anomaly behaviour detection at the pawn shop. <em>Cyber-Physical Systems</em>, <em>9</em>(4), 338-356. https://doi.org/10.1080/23335777.2022.2104379</li>
<li>Dudykevyc, V., Mykytyn, G., Kret, T., Rebets, A. (2016). Security of Cyber-Physical Systems from Concept to Complex Information Security System. <em>Advances in Cyber-Physical Systems</em>, <em>1</em>(2), 67-75. https://doi.org/10.23939/acps2016.02.067</li>
<li>GÜRKAŞ AYDIN, Z., KAZANÇ, M. (2023). Using Artificial Intelligence in the Security of Cyber Physical Systems. <em>Alphanumeric Journal</em>, <em>11</em>(2), 193-206. https://doi.org/10.17093/alphanumeric.1404181</li>
<li>Matta, W., Cantelli-Forti, A. (2019). An innovative Airport Physical-cyber Security System (APSS). <em>Information & Security: An International Journal</em>, <em>43</em>(3), 285-293. https://doi.org/10.11610/isij.4321</li>
<li>Gaggero, G. B., Armellin, A., Portomauro, G., Marchese, M. (2024). Industrial Control System-Anomaly Detection Dataset (ICS-ADD) for Cyber-Physical Security Monitoring in Smart Industry Environments. <em>IEEE Access</em>, <em>12</em>, 64140-64149. https://doi.org/10.1109/access.2024.3395991</li>
<li>Gubbi, J., Buyya, R., Marusic, S., Palaniswami, M. (2013). Internet of Things (IoT): A vision, architectural elements, and future directions. <em>Future Generation Computer Systems</em>, <em>29</em>(7), 1645-1660. https://doi.org/10.1016/j.future.2013.01.010</li>
<li>Miorandi, D., Sicari, S., Pellegrini, F. D., Chlamtac, I. (2012). Internet of things: Vision, applications and research challenges. <em>Ad Hoc Networks</em>, <em>10</em>(7), 1497-1516. https://doi.org/10.1016/j.adhoc.2012.02.016</li>
<li>Khraisat, A., Gondal, I., Vamplew, P., Kamruzzaman, J. (2019). Survey of intrusion detection systems: techniques, datasets and challenges. <em>Cybersecurity</em>, <em>2</em>(1). https://doi.org/10.1186/s42400-019-0038-7</li>
<li>Islam, S. M. R., Kwak, D., Kabir, M. H., Hossain, M., Kwak, K. (2015). The Internet of Things for Health Care: A Comprehensive Survey. <em>IEEE Access</em>, <em>3</em>, 678-708. https://doi.org/10.1109/access.2015.2437951</li>
<li>Shakhatreh, H., Sawalmeh, A., Al‐Fuqaha, A., Dou, Z., Almaita, E., Khalil, I. (2019). Unmanned Aerial Vehicles (UAVs): A Survey on Civil Applications and Key Research Challenges. <em>IEEE Access</em>, <em>7</em>, 48572-48634. https://doi.org/10.1109/access.2019.2909530</li>
<li>Ahmad, Z., Khan, A. S., Shiang, C. W., Abdullah, J., Ahmad, F. (2020). Network intrusion detection system: A systematic study of machine learning and deep learning approaches. <em>Transactions on Emerging Telecommunications Technologies</em>, <em>32</em>(1). https://doi.org/10.1002/ett.4150</li>
<li>Hassija, V., Chamola, V., Saxena, V., Jain, D., Goyal, P., Sikdar, B. (2019). A Survey on IoT Security: Application Areas, Security Threats, and Solution Architectures. <em>IEEE Access</em>, <em>7</em>, 82721-82743. https://doi.org/10.1109/access.2019.2924045</li>
<li>Park, S., Kim, Y. (2022). A Metaverse: Taxonomy, Components, Applications, and Open Challenges. <em>IEEE Access</em>, <em>10</em>, 4209-4251. https://doi.org/10.1109/access.2021.3140175</li>
<li>Akyildiz, I. F., Kak, A., Nie, S. (2020). 6G and Beyond: The Future of Wireless Communications Systems. <em>IEEE Access</em>, <em>8</em>, 133995-134030. https://doi.org/10.1109/access.2020.3010896</li>
</ol>
</article>