What question did this study set out to answer?

The central aim is to develop a federated learning framework that enhances anomaly detection in industrial control systems while addressing privacy and efficiency.

January 23, 2026Open Access

Federated Learning Framework for Efficient and Secure Anomaly Detection in Industrial Control Systems

Key Points

The central aim is to develop a federated learning framework that enhances anomaly detection in industrial control systems while addressing privacy and efficiency.
Develop a federated learning framework for anomaly detection in ICS.
Implement compression techniques: weight clustering with adaptive bit allocation and energy-aware knowledge distillation.
Utilize differential delta compression and adaptive clustering to minimize data transmission.
Employ a robust aggregation mechanism to filter out suspicious model updates.
Incorporate differential privacy techniques to safeguard against inference attacks.
Demonstrated superior anomaly detection performance on SWaT and WADI datasets.
Achieved reduced communication costs compared to traditional centralized methods.
Lowered computational demand for anomaly detection in ICS environments.

Abstract

Industrial control systems (ICS) are increasingly vulnerable to cybersecurity threats due to the integration of IoT devices and operational technology networks. Traditional centralized anomaly detection methods face significant challenges, including privacy concerns, bandwidth limitations, and single points of failure. Federated learning (FL) offers a promising alternative by enabling collaborative model training across distributed devices without sharing raw data. However, FL in industrial settings introduces challenges such as communication overhead, resource heterogeneity, and the risk of Byzantine failures. This study proposes a comprehensive framework for efficient and secure FL‐based anomaly detection in ICS. We introduce two novel compression techniques, weight clustering with adaptive bit allocation (WC‐ABA) and energy‐aware knowledge distillation (EA‐KD), to reduce communication overhead while maintaining detection accuracy. Additionally, we implement differential delta compression with adaptive clustering and entropy coding, which further minimizes data transmission by sending only the differences between model updates. Our robust aggregation mechanism, SparseVariance Aggregator, filters out suspicious updates and ensures model integrity. The framework also integrates differential privacy techniques to protect against inference attacks. Evaluated on the Secure Water Treatment (SWaT) and Water Distribution Attack Dataset (WADI) datasets, our approach demonstrates superior anomaly detection performance, reduced communication costs, and lower computational demand compared to centralized alternatives. The results highlight the effectiveness of our framework in enhancing the security and efficiency of ICS environments.

Read Full Paperexternally

Mark Helpful

Bookmark

Relay

View Full Paper