Zero-Day Threat Discovery via Unsupervised Anomaly Detection in Industrial IoT Networks Using Autoencoders and Variational Autoencoders

Industrial Internet of Things (IIoT) environments, encompassing smart manufacturing, energy grid automation, and critical process control systems, face an increasingly complex threat landscape where novel, previously unseen attack variants continuously emerge faster than supervised intrusion detection systems can acquire labelled training data. Supervised machine learning classifiers are generally limited in detecting previously unseen attack patterns, as their decision boundaries are defined primarily by the attack types represented in training data. This fundamental limitation motivates the development of unsupervised anomaly detection frameworks that learn the statistical structure of legitimate IIoT traffic and flag deviations regardless of their specific attack category or novelty. This paper proposes and evaluates an unsupervised anomaly detection framework for IIoT zero-day threat discovery using the WUSTL-IIoT-2021 benchmark, a realistic IIoT testbed dataset comprising over 1.19 million records across normal traffic and five attack categories. A standard Autoencoder (AE) and a Variational Autoencoder (VAE) are trained exclusively on normal IIoT traffic; anomaly detection is performed by thresholding reconstruction error (AE) and ELBO (VAE) on test instances. Accuracy is reported for completeness but is not the primary evaluation metric due to class imbalance; F1-score, AUC, and Detection Rate are the primary metrics. At optimal thresholds—tuned on validation data and subject to recalibration in deployment environments, the AE achieves F1 of 0.904 and 90.83% detection rate at 6.34% FPR; the VAE achieves F1 of 0.912 and 89.71% detection rate at 6.82% FPR, substantially outperforming Isolation Forest and One-Class SVM baselines without any labelled attack data. All results are averaged over five runs with standard deviation reported. Zero-day simulation experiments confirm VAE detection rates of 71–94% for four novel attack variants; these variants approximate zero-day behaviour but may not fully represent adversary-optimised attacks. More advanced deep anomaly detection baselines were not evaluated, which is acknowledged as a limitation.