Cyber-Physical Systems (CPSs) are increasingly exposed to sophisticated cyberattacks, necessitating the development of robust, real-time anomaly detection solutions to maintain system reliability and operational continuity. This study proposes a hybrid deep learning approach that combines CNN, BiLSTM, and an attention mechanism to detect the anomalies in an industrial CPS environments. This architecture uses (a) CNNs to extract spatial features from input data; (b) BiLSTM networks to model temporal sequences; and (c) an attention mechanism included to emphasise the significant trends and enhance the interpretability. The model uses the sliding window inference technique to enable the real-time usage. It also includes an adaptive thresholding method based on statistical estimation. The system is tested on two popular CPSs benchmark datasets: Secure Water Treatment (SWaT) and Water Distribution (WADI), which include 36 labelled attack scenarios and multiple stealthy attack patterns, respectively. Experimental results shows that the proposed model achieves high accuracy (98.7% on SWaT and 97.4% on WADI) and F1-scores above 97.5%, with the inference latency below 50 ms per prediction. Compared with baseline CNN, LSTM, and SVM detectors, the hybrid approach improves precision under noisy and imbalanced conditions, demonstrating superiority in real-time CPS anomaly detection. An ablation study verifies the individual impact of each component in the model. Furthermore, this study presents a theoretical detection-delay bound, and confirming the framework’s suitability for real-time CPS monitoring.
Smilarubavathy et al. (Wed,) studied this question.