Modeling Normal Is All You Need: Joint Latent Clustering for Anomaly Detection in Multimodal Industrial-IoT Cyber-Physical Systems

The Industrial Internet of Things (IIoT) instruments physical processes with networked sensors and controllers that stream multivariate telemetry, and monitoring this telemetry for faults and cyberattacks is essential to reliability and safety. Machine learning is the natural tool, but failures are rare and seldom labeled, so supervised detection is impractical: a detector must learn normal behavior from unlabeled telemetry alone. In cyber-physical systems, this normal law is structured: a union of many imbalanced operating regimes shaped by physics and control, formalized as ten Massive, Implicit, Imbalanced Multimodality (MIIM) assumptions. That structure exposes a blind spot of the dominant approach: a fault can be individually normal on every sensor and reconstruct accurately, yet improbable under normal joint operation, so reconstruction-based detectors measure reachability rather than probability and miss it. Our detector, LatAD (Latent-density Anomaly Detector), learns a latent Gaussian-mixture clustering of regimes (VaDE, Variational Deep Embedding), scores anomalies by density, and factorizes that density over correlation-community subsystems combined by a cohesion-weighted Higher Criticism statistic. On three real IIoT testbeds, LatAD attains the best All-subset AUROC of any learned detector on HAI (0.948) and leads the difficult subset on HAI (0.845; a significant +0.088, 95% CI [0.042, 0.157]); USAD and TranAD fall to 0.44–0.50 on these reconstructable-but-improbable faults.