Cross-modal feature learning for multi-sensor IOT anomaly detection: a comprehensive empirical analysis of cyber physical systems

Richard Chukwuebuka Nwachukwu

Abstract


The proliferation of Internet of Things (IoT) devices has created unprecedented security challenges, with traditional single-modal anomaly detection systems proving inadequate against sophisticated multi-vector attacks. This paper presents a novel cross-modal feature learning framework that synergistically integrates environmental sensor telemetry with network traffic patterns for enhanced anomaly detection across heterogeneous IoT architectures. Through comprehensive experimentation on the TON_IoT dataset encompassing 380,609 synchronized records across three distinct IoT systems (weather monitoring, smart refrigeration, and GPS tracking), we demonstrate that cross-modal integration consistently outperforms single-modal approaches. Our Random Forest implementation achieved 95.35% accuracy for weather systems (0.50% improvement over sensor-only), 78.13% for refrigeration systems (37.34% improvement), and 95.24% for GPS systems (9.45% improvement). Feature importance analysis reveals system-specific optimization patterns: atmospheric pressure emerges as the primary discriminator in weather systems (19.8% importance), while network features dominate refrigeration systems (86.6% combined importance). Most significantly, we provide the quantitative evidence that 24.7% of anomalies manifest simultaneously across both sensor and network modalities, indicating sophisticated coordinated attacks that single-modal systems would partially miss. The proposed temporal alignment methodology successfully addresses heterogeneous timestamp formats and sampling rates, creating a reusable framework for cross-modal IoT security research. These findings establish cross-modal feature learning as essential for comprehensive IoT security, with practical implications for designing resilient cyber-physical systems.

 

Received on, 28 September 2025

Accepted on, 28 January 2026

Published on, 02 April 2025


Keywords


IoT security, Cross-modal Learning, Anomaly Detection, Sensor Fusion, Cyber-Physical Systems, Machine Learning

Full Text:

PDF

References


[1] D. Ratasich, F. Khalid, F. Geissler, R. Grosu, M. Shafique, and E. Bartocci, “A Roadmap Toward the Resilient Internet of Things for Cyber-Physical Systems,” IEEE Access, vol. 7, pp. 13260–13283, 2019, doi: https://doi.org/10.1109/access.2019.2891969.

[2] K. A. P. da Costa, J. P. Papa, C. O. Lisboa, R. Munoz, and V. H. C. de Albuquerque, “Internet of Things: A survey on machine learning-based intrusion detection approaches,” Computer Networks, vol. 151, pp. 147–157, Mar. 2019, doi: https://doi.org/10.1016/j.comnet.2019.01.023.

[3] M. S. Mahdavinejad, M. Rezvan, M. Barekatain, P. Adibi, P. Barnaghi, and A. P. Sheth, “Machine learning for internet of things data analysis: a survey,” Digital Communications and Networks, vol. 4, no. 3, pp. 161–175, Aug. 2019, doi: https://doi.org/10.1016/j.dcan.2017.10.002.

[4] A. A. Cook, G. Mısırlı, and Z. Fan, “Anomaly Detection for IoT Time-Series Data: A Survey,” IEEE Internet of Things Journal, vol. 7, no. 7, pp. 6481–6494, Jul. 2020, doi: https://doi.org/10.1109/JIOT.2019.2958185.

[5] R. Al-amri, R. K. Murugesan, M. Man, A. F. Abdulateef, M. A. Al-Sharafi, and A. A. Alkahtani, “A Review of Machine Learning and Deep Learning Techniques for Anomaly Detection in IoT Data,” Applied Sciences, vol. 11, no. 12, p. 5320, Jan. 2021, doi: https://doi.org/10.3390/app11125320.

[6] M. Fahim and A. Sillitti, “Anomaly Detection, Analysis and Prediction Techniques in IoT Environment: A Systematic Literature Review,” IEEE Access, vol. 7, pp. 81664–81681, 2019, doi: https://doi.org/10.1109/access.2019.2921912.

[7] Jiong Zhang, M. Zulkernine, and A. Haque, “Random-Forests-Based Network Intrusion Detection Systems,” IEEE Transactions on Systems, Man, and Cybernetics, Part C (Applications and Reviews), vol. 38, no. 5, pp. 649–659, Sep. 2008, doi: https://doi.org/10.1109/tsmcc.2008.923876.

[8] M. Wu, Z. Song, and Y. B. Moon, “Detecting cyber-physical attacks in CyberManufacturing systems with machine learning methods,” Journal of Intelligent Manufacturing, vol. 30, no. 3, pp. 1111–1123, Feb. 2017, doi: https://doi.org/10.1007/s10845-017-1315-5.

[9] R. A. Ariyaluran Habeeb, F. Nasaruddin, A. Gani, I. A. Targio Hashem, E. Ahmed, and M. Imran, “Real-time big data processing for anomaly detection: A Survey,” International Journal of Information Management, vol. 45, pp. 289–307, Apr. 2019, doi: https://doi.org/10.1016/j.ijinfomgt.2018.08.006.

[10] S. Xing and Y. Wang, “Cross-Modal Attention Networks for Multi-Modal Anomaly Detection in System Software,” IEEE Open Journal of the Computer Society, vol. 6, pp. 1463–1474, 2025, doi: https://doi.org/10.1109/ojcs.2025.3607975.

[11] R. Langner, “Stuxnet: Dissecting a Cyberwarfare Weapon,” IEEE Security & Privacy Magazine, vol. 9, no. 3, pp. 49–51, May 2011, doi: https://doi.org/10.1109/msp.2011.67.

[12] S. Garg, K. Kaur, S. Batra, G. Kaddoum, N. Kumar, and A. Boukerche, “A multi-stage anomaly detection scheme for augmenting the security in IoT-enabled applications,” Future Generation Computer Systems, vol. 104, pp. 105–118, Mar. 2020, doi: https://doi.org/10.1016/j.future.2019.09.038.

[13] G. Wu, Y. Zhang, L. Deng, J. Zhang, and T. Chai, “Cross-Modal Learning for Anomaly Detection in Complex Industrial Process: Methodology and Benchmark,” IEEE Transactions on Circuits and Systems for Video Technology, pp. 1–1, Jan. 2024, doi: https://doi.org/10.1109/tcsvt.2024.3491865.

[14] S. Khan, M. Yüksel, and F. Kirchner, “Robust anomaly detection through multi-modal autoencoder fusion for small vehicle damage detection,” Machine Learning with Applications, vol. 22, p. 100794, Dec. 2025, doi: https://doi.org/10.1016/j.mlwa.2025.100794.

[15] M. Munir, S. A. Siddiqui, A. Dengel, and S. Ahmed, “DeepAnT: A Deep Learning Approach for Unsupervised Anomaly Detection in Time Series,” IEEE Access, vol. 7, pp. 1991–2005, 2019, doi: https://doi.org/10.1109/access.2018.2886457.

[16] N. Ding, H. Ma, H. Gao, Y. Ma, and G. Tan, “Real-time anomaly detection based on long short-Term memory and Gaussian Mixture Model,” Computers & Electrical Engineering, vol. 79, p. 106458, Oct. 2019, doi: https://doi.org/10.1016/j.compeleceng.2019.106458.

[17] Y. Dong and N. Japkowicz, “Threaded ensembles of autoencoders for stream learning,” Computational Intelligence, vol. 34, no. 1, pp. 261–281, Oct. 2017, doi: https://doi.org/10.1111/coin.12146.

[18] M. Salehi and L. Rashidi, “A Survey on Anomaly detection in Evolving Data,” ACM SIGKDD Explorations Newsletter, vol. 20, no. 1, pp. 13–23, May 2018, doi: https://doi.org/10.1145/3229329.3229332.

[19] W. Li et al., “Multi-Sensor Object Anomaly Detection: Unifying Appearance, Geometry, and Internal Properties,” 2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 9984–9993, Jun. 2025, doi: https://doi.org/10.1109/cvpr52734.2025.00933.

[20] Y. Wang, H. Cai, Z. Chen, P. Hu, H. Yu, and B. Xu, “HybridCube: Integrating Multi-Sensor Cross-Modal Data for Early Fault Detection in Power Transformers,” 2024 IEEE International Conference on e-Business Engineering (ICEBE), pp. 250–255, Oct. 2024, doi: https://doi.org/10.1109/icebe62490.2024.00046.

[21] University of New South Wales (UNSW), “The TON_IoT Datasets | UNSW Research,” research.unsw.edu.au. https://research.unsw.edu.au/projects/toniot-datasets (accessed Aug. 27, 2025).

[22] M. Goldstein and S. Uchida, “A Comparative Evaluation of Unsupervised Anomaly Detection Algorithms for Multivariate Data,” PLOS ONE, vol. 11, no. 4, p. e0152173, Apr. 2016, doi: https://doi.org/10.1371/journal.pone.0152173.

[23] N. S. K. M. K. Tirumanadham, S. Thaiyalnayaki, and V. Ganesan, “Towards Smarter E-Learning: Real-Time Analytics and Machine Learning for Personalized Education,” International Journal of Computational and Experimental Science and Engineering, vol. 11, no. 1, Jan. 2025, doi: https://doi.org/10.22399/ijcesen.786.

[24] M. Roopak, G. Yun Tian, and J. Chambers, “Deep Learning Models for Cyber Security in IoT Networks,” 2019 IEEE 9th Annual Computing and Communication Workshop and Conference (CCWC), Jan. 2019, doi: https://doi.org/10.1109/ccwc.2019.8666588.

[25] A. A. Diro and N. Chilamkurti, “Distributed attack detection scheme using deep learning approach for Internet of Things,” Future Generation Computer Systems, vol. 82, pp. 761–768, May 2018, doi: https://doi.org/10.1016/j.future.2017.08.043.

[26] J. Gu, Y. Wang, J. Chen, M. Zhang, Z. Wang, and J. Chen, “Multi-modal contrastive causal consistency fusion for anomaly detection in additive manufacturing,” Additive Manufacturing, vol. 107, p. 104816, Jun. 2025, doi: https://doi.org/10.1016/j.addma.2025.104816.

[27] M. da Silva Ferreira, L. F. Vismari, P. S. Cugnasca, J. R. de Almeida, J. B. Camargo, and G. Kallemback, “A Comparative Analysis of Unsupervised Learning Techniques for Anomaly Detection in Railway Systems,” IEEE Xplore, Dec. 01, 2019. https://ieeexplore.ieee.org/document/8999070/ (accessed Jun. 01, 2023).

[28] A. Punia, M. Tiwari, and S. S. Verma, “A machine learning-based efficient anomaly detection system for enhanced security in compromised and maligned IoT Networks,” Results in Engineering, vol. 26, p. 105562, Jun. 2025, doi: https://doi.org/10.1016/j.rineng.2025.105562.




DOI: https://dx.doi.org/10.21622/ACE.2026.06.1.1704

Refbacks

  • There are currently no refbacks.


Copyright (c) 2026 Richard Chukwuebuka Nwachukwu

Advances in Computing and Engineering

E-ISSN: 2735-5985

P-ISSN: 2735-5977

 

Published by:

Academy Publishing Center (APC)

Arab Academy for Science, Technology and Maritime Transport (AASTMT)

Alexandria, Egypt

ace@aast.edu