Robust ICS Anomaly Detection Using Multi-Scale Temporal Dependencies and Frequency-Domain Features

Industrial Control Systems (ICSs) are critical infrastructure for maintaining social and economic stability, but they face increasing security threats that require robust anomaly detection mechanisms. Anomaly detection in ICS, based on sensor data, is essential for identifying abnormal behaviors caused by factors such as equipment failures, cyber-attacks, and operational mistakes. However, industrial time series data are often multimodal, noisy, and exhibit both short-term fluctuations and long-term dependencies, making them difficult to model effectively. Additionally, ICS data often contain high-frequency noise and complex periodic patterns, which traditional methods and standalone models, such as Long Short-Term Memory (LSTM), fail to capture effectively. To address these challenges, we propose a novel anomaly detection framework that leverages Gated Recurrent Units for short-term dynamics and PatchTST for long-term dependencies. The GRU module extracts dynamic short-term features, while PatchTST models long-term dependencies by segmenting the feature sequence processed by GRU into overlapping patches. Additionally, we innovatively introduce Frequency-Enhanced Channel Attention Module to capture frequency domain features, mitigating high-frequency noise and enhancing the model’s ability to detect long-term trends and periodic patterns. Experimental results on the SWaT and WADI datasets show that the proposed method achieves strong anomaly detection performance, attaining F1 scores of 0.929 and 0.865, respectively, which are superior to those of representative existing methods, demonstrating the effectiveness of the proposed design for robust anomaly detection in complex ICS environments.