d -TV-DBN: A Hierarchical and Distributed Architecture for Scalable Cyber-Physical Anomaly Detection With Bayesian Networks
Simone Guarino, Francesco Vitale, Ernesto Del Prete, Luca Faramondi, Nicola Mazzocca, Roberto Setola · IEEE Transactions on Emerging Topics in Computing · 2025
The wide availability of diverse data from monitoring industrial cyber-physical systems enables data-driven anomaly detection. In particular, the scientific literature has addressed explainable cyber-physical anomaly detection using Bayesian networks, involving decision fusion from an ensemble of detectors. However, the aggregation of multiple decisions from different detectors within a single Bayesian network may negatively affect anomaly detection performance due to the heterogeneity of distributed environments. Furthermore, such decision fusion may be affected by scalability issues due to Bayesian inference being NP-hard. To address these issues, we presentd-TV-DBN, a hierarchical and distributed architecture to scale cyber-physical anomaly detection with the state-of-the-art ensemble decision fusion technique based on Time-Varying Dynamic Bayesian networks. We provide a Proof-of-Concept evaluation ofd-TV-DBN and evaluate its scalability and detection performance, comparing the results with several ensemble decision fusion approaches. The results demonstrate that the proposedd-TV-DBN outperforms the current state-of-the-art decision fusion techniques while maintaining a remarkably low mean inference time for reaching the final decision.