Hybrid Anomaly Detection in OT System Updates: A Comparative Analysis of Isolation Forest and Autoencoders

This research paper explores the application of machine learning–based anomaly detection techniques in Operational Technology (OT) environments, particularly during system updates and patching processes. Given the real-time constraints, legacy dependencies, and high availability requirements of OT systems, failed or compromised updates pose serious operational and security risks. The study presents a comparative analysis of two unsupervised machine learning methods—Isolation Forest and Autoencoders—and evaluates their effectiveness in identifying anomalies in patching activities across light rail systems, SCADA infrastructures, and PLC-based automation networks. A hybrid model combining both approaches is proposed to improve detection accuracy, reduce false positives, and support adaptive thresholding based on real-time and long-term system behavior. The paper includes mathematical formulations, performance evaluations, and real-world use cases. It concludes that a hybrid detection strategy leveraging the complementary strengths of both models offers a robust and scalable solution for anomaly detection in critical OT environments.