Abstract

Industrial Control Systems (ICS) are critical components of modern infrastructure and are increasingly targeted by cyber attacks. Signature-based security mechanisms fail to detect unknown or zero day attacks, motivating the use of unsupervised learning. This paper presents a comprehensive ICS anomaly detection framework using K-Means clustering, Isolation Forest, and a deep autoencoder. An ensemble strategy combines individual model outputs to improve robustness. Experimental results on real ICS network traffic demonstrate effective detection of anomalous behavior without requiring labeled data.