# Time Series Anomaly Detection for Cyber-Physical Systems via Neural System Identification and Bayesian Filtering

arXiv: https://arxiv.org/abs/2106.07992 · HTML: https://mlsanity.com/paper/2106.07992/

## Key facts

- Cited by 31 papers in the map (data through 14 Oct 2026).
- Builds on 18 of its 58 references that are in the map.
- First posted on arXiv 15 Jun 2021.

## Builds on (most cited first, 18 of 18)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [DeepAR: Probabilistic Forecasting with Autoregressive Recurrent Networks](https://mlsanity.com/paper/1704.04110/) (2017)
- [Detecting Spacecraft Anomalies Using LSTMs and Nonparametric Dynamic Thresholding](https://mlsanity.com/paper/1802.04431/) (2018)
- [A Recurrent Latent Variable Model for Sequential Data](https://mlsanity.com/paper/1506.02216/) (2015)
- [Deep Learning for Anomaly Detection: A Survey](https://mlsanity.com/paper/1901.03407/) (2019)
- [Unsupervised Anomaly Detection via Variational Auto-Encoder for Seasonal KPIs in Web Applications](https://mlsanity.com/paper/1802.03903/) (2018)
- [LSTM-based Encoder-Decoder for Multi-sensor Anomaly Detection](https://mlsanity.com/paper/1607.00148/) (2016)
- [A Multimodal Anomaly Detector for Robot-Assisted Feeding Using an LSTM-based Variational Autoencoder](https://mlsanity.com/paper/1711.00614/) (2017)
- [Structured Inference Networks for Nonlinear State Space Models](https://mlsanity.com/paper/1609.09869/) (2016)
- [A Deep Neural Network for Unsupervised Anomaly Detection and Diagnosis in Multivariate Time Series Data](https://mlsanity.com/paper/1811.08055/) (2018)
- [Deep Kalman Filters](https://mlsanity.com/paper/1511.05121/) (2015)
- [Deep Variational Bayes Filters: Unsupervised Learning of State Space Models from Raw Data](https://mlsanity.com/paper/1605.06432/) (2016)
- [A Disentangled Recognition and Nonlinear Dynamics Model for Unsupervised Learning](https://mlsanity.com/paper/1710.05741/) (2017)
- [Deep Learning-Based Anomaly Detection in Cyber-Physical Systems: Progress and Opportunities](https://mlsanity.com/paper/2003.13213/) (2020)
- [Interpretable, Multidimensional, Multimodal Anomaly Detection with Negative Sampling for Detection of Device Failure](https://mlsanity.com/paper/2007.10088/) (2020)
- [Cyber-Physical Systems Security -- A Survey](https://mlsanity.com/paper/1701.04525/) (2017)
- [Recurrent Neural Filters: Learning Independent Bayesian Filtering Steps for Time Series Prediction](https://mlsanity.com/paper/1901.08096/) (2019)
- [Learning from Mutants: Using Code Mutation to Learn and Monitor Invariants of a Cyber-Physical System](https://mlsanity.com/paper/1801.00903/) (2018)

## Built on by (most cited first, 30 of 31)

- [Deep Learning for Time Series Anomaly Detection: A Survey](https://mlsanity.com/paper/2211.05244/) (2022)
- [TAB: Unified Benchmarking of Time Series Anomaly Detection Methods](https://mlsanity.com/paper/2506.18046/) (2025)
- [Calibrated One-class Classification for Unsupervised Time Series Anomaly Detection](https://mlsanity.com/paper/2207.12201/) (2022)
- [Navigating the Metric Maze: A Taxonomy of Evaluation Metrics for Anomaly Detection in Time Series](https://mlsanity.com/paper/2303.01272/) (2023)
- [Position: Quo Vadis, Unsupervised Time Series Anomaly Detection?](https://mlsanity.com/paper/2405.02678/) (2024)
- [Are we certain it's anomalous?](https://mlsanity.com/paper/2211.09224/) (2022)
- [Multivariate Time-Series Anomaly Detection based on Enhancing Graph Attention Networks with Topological Analysis](https://mlsanity.com/paper/2408.13082/) (2024)
- [Masked Bayesian Neural Networks : Theoretical Guarantee and its Posterior Inference](https://mlsanity.com/paper/2305.14765/) (2023)
- [A Co-training Approach for Noisy Time Series Learning](https://mlsanity.com/paper/2308.12551/) (2023)
- [STAR: Boosting Time Series Foundation Models for Anomaly Detection through State-aware Adapter](https://mlsanity.com/paper/2510.16014/) (2025)
- [Cyber-Physical Systems Security: A Comprehensive Review of Anomaly Detection Techniques](https://mlsanity.com/paper/2502.13256/) (2025)
- [DeepFIB: Self-Imputation for Time Series Anomaly Detection](https://mlsanity.com/paper/2112.06247/) (2021)
- [Robust Learning of Deep Time Series Anomaly Detection Models with Contaminated Training Data](https://mlsanity.com/paper/2208.01841/) (2022)
- [INVARLLM: LLM-assisted Physical Invariant Extraction for Cyber-Physical Systems Anomaly Detection](https://mlsanity.com/paper/2411.10918/) (2024)
- [ChronosAD: Leveraging Time Series Foundation Models for Accurate Anomaly Detection](https://mlsanity.com/paper/2606.01300/) (2026)
- [Learning Invariant Rules from Data for Interpretable Anomaly Detection](https://mlsanity.com/paper/2211.13577/) (2022)
- [Angel or Devil: Discriminating Hard Samples and Anomaly Contaminations for Unsupervised Time Series Anomaly Detection](https://mlsanity.com/paper/2410.21322/) (2024)
- [A Problem-Oriented Taxonomy of Evaluation Metrics for Time Series Anomaly Detection](https://mlsanity.com/paper/2511.18739/) (2025)
- [ASTER: Latent Pseudo-Anomaly Generation for Unsupervised Time-Series Anomaly Detection](https://mlsanity.com/paper/2604.13924/) (2026)
- [An Unsupervised Short- and Long-Term Mask Representation for Multivariate Time Series Anomaly Detection](https://mlsanity.com/paper/2208.09240/) (2022)
- [BSSAD: Towards A Novel Bayesian State-Space Approach for Anomaly Detection in Multivariate Time Series](https://mlsanity.com/paper/2301.13031/) (2023)
- [Time series anomaly detection with reconstruction-based state-space models](https://mlsanity.com/paper/2303.03324/) (2023)
- [CyPhERS: A Cyber-Physical Event Reasoning System providing real-time situational awareness for attack and fault response](https://mlsanity.com/paper/2305.16907/) (2023)
- [PARs: Predicate-based Association Rules for Efficient and Accurate Model-Agnostic Anomaly Explanation](https://mlsanity.com/paper/2312.10968/) (2023)
- [iADCPS: Time Series Anomaly Detection for Evolving Cyber-physical Systems via Incremental Meta-learning](https://mlsanity.com/paper/2504.04374/) (2025)
- [SRLR: Symbolic Regression based Logic Recovery to Counter Programmable Logic Controller Attacks](https://mlsanity.com/paper/2512.11298/) (2025)
- [Flowcean - Model Learning for Cyber-Physical Systems](https://mlsanity.com/paper/2603.12015/) (2026)
- [MO-SAE:Multi-Objective Stacked Autoencoders Optimization for Edge Anomaly Detection](https://mlsanity.com/paper/2603.13895/) (2026)
- [An Insight on Evaluation Metrics Under the Imbalanced Case of Anomaly Detection](https://mlsanity.com/paper/2607.22286/) (2026)
- [GT-PSSM: Unified Probabilistic Framework for Stochastic Dynamics Modeling and Dependency Learning in Multivariate Time Series Anomaly Detection](https://mlsanity.com/paper/2609.34161/) (2026)

## Abstract (arXiv)

Recent advances in AIoT technologies have led to an increasing popularity of utilizing machine learning algorithms to detect operational failures for cyber-physical systems (CPS). In its basic form, an anomaly detection module monitors the sensor measurements and actuator states from the physical plant, and detects anomalies in these measurements to identify abnormal operation status. Nevertheless, building effective anomaly detection models for CPS is rather challenging as the model has to accurately detect anomalies in presence of highly complicated system dynamics and unknown amount of sensor noise. In this work, we propose a novel time series anomaly detection method called Neural System Identification and Bayesian Filtering (NSIBF) in which a specially crafted neural network architecture is posed for system identification, i.e., capturing the dynamics of CPS in a dynamical state-space model; then a Bayesian filtering algorithm is naturally applied on top of the "identified" state-space model for robust anomaly detection by tracking the uncertainty of the hidden state of the system recursively over time. We provide qualitative as well as quantitative experiments with the proposed method on a synthetic and three real-world CPS datasets, showing that NSIBF compares favorably to the state-of-the-art methods with considerable improvements on anomaly detection in CPS.