HAC-UML: A hybrid autoencoder-enhanced clustering framework for unsupervised anomaly detection in industrial IIoT sensor networks

Abstract

Industrial Internet-of-Things (IIoT) sensor networks generate massive, high-dimensional, and temporally correlated data streams wherein anomalous patterns often signal critical equipment failures, cyber-physical attacks, or process deviations. Conventional supervised anomaly detectors are impractical in IIoT environments due to the acute scarcity of labeled anomaly instances and the non-stationary nature of operational data. Unsupervised learning therefore represents the most tractable paradigm, yet existing methods suffer from limited representational capacity, susceptibility to the curse of dimensionality, and poor generalization across heterogeneous sensor modalities. This study proposes HAC-UML, a Hybrid Autoencoder-Enhanced Clustering framework for Unsupervised Machine Learning, designed to simultaneously learn compact latent representations of multivariate IIoT time series and perform joint deep clustering with adaptive anomaly scoring. HAC-UML integrates a Bi-directional Long Short-Term Memory (BiLSTM) autoencoder with a Deep Embedded Clustering (DEC) module trained via a composite loss function combining Mean Squared Error (MSE) reconstruction loss and Kullback–Leibler (KL) divergence-based cluster assignment loss. Anomaly scores are computed through reconstruction error thresholding at μ+3σ, complemented by cluster membership entropy analysis. Experiments were conducted on three public benchmarks: SWAT, WADI, and MSL, encompassing 87,004 multivariate sensor readings across 12 heterogeneous features. HAC-UML achieves a Precision of 0.937, Recall of 0.924, F1-Score of 0.930, and AUC-ROC of 0.963 on the SWAT benchmark, outperforming six state-of-the-art baselines including DAGMM, USAD, LSTM-AE, and OmniAnomaly by margins of 2.9%–8.3% in F1-Score. Ablation studies confirm the contribution of the joint clustering module (+4.1% F1 over AE-only) and the skip-connection mechanism (+2.3%). The proposed HAC-UML framework demonstrates strong generalizability, computational efficiency (inference latency <12 ms per window), and practical deployability on edge hardware.