Industrial control systems quietly run the modern world. They purify drinking water, route electricity through power grids, manage chemical plants, and keep assembly lines moving. When something goes wrong in these systems—whether through mechanical failure or a deliberate cyberattack—the consequences can cascade from a single factory floor to entire cities. Detecting anomalies in these environments before they escalate is therefore one of the most consequential challenges in modern cybersecurity. A new study published in Applied Intelligence by researchers at Xi’an University of Posts and Telecommunications introduces a method that could significantly sharpen that detection capability, and it does so by borrowing one of the oldest and most elegant ideas in science: information theory.
The research, led by Zhongmin Wang, Zhongjian Yuan, Cong Gao, and Yanping Chen, addresses a long-standing weakness in a classical machine learning technique known as the One-Class Support Vector Machine, or OCSVM. The OCSVM has been a workhorse of anomaly detection since its introduction in the early 2000s. Its appeal lies in its ability to learn from a single class of data—normally, it needs to see only examples of healthy behavior to build a model of what ‘normal’ looks like. Anything that falls outside that learned boundary is flagged as an anomaly. This is crucial in industrial settings, where attack examples are rare, dangerous to stage, and endlessly varied, making conventional supervised learning impractical.
Yet the OCSVM carries two stubborn Achilles’ heels. First, its performance depends heavily on the choice of kernel function and, in particular, on the parameters of the Gaussian kernel that defines how similarity between data points is measured. Getting these parameters right often requires laborious trial and error or expensive cross-validation, and a poor choice can gut the model’s accuracy. Second, industrial sensor data is increasingly high-dimensional, with hundreds or thousands of measurements streaming from pumps, valves, and controllers. As dimensionality rises, data points spread farther apart, distributions become sparse, and the notion of distance itself loses meaning—a phenomenon statisticians call the curse of dimensionality. The Gaussian kernel, which relies on Euclidean distances, struggles to capture the true distribution of normal samples in this sparse high-dimensional space, and detection performance degrades.
The Xi’an team’s answer, which they call Information Clustering One-Class Support Vector Machine (IC-OCSVM), tackles both problems in a single framework built on information-theoretic foundations. The method begins with a preprocessing stage that treats each feature dimension of the industrial data as if it were a separate information system. For every dimension, the researchers compute the Shannon information entropy—a measure of the uncertainty or unpredictability carried by that variable. Dimensions with low information content contribute little to distinguishing between samples and are treated as redundant and removed. This entropy-based pruning reduces dimensionality in a principled way, concentrating the model’s attention on the sensors and signals that actually carry meaningful variability, and simultaneously softening the effects of sparsity before the learning stage even begins.
The second and more novel stage replaces the conventional Gaussian kernel entirely. Instead of measuring similarity through Euclidean distance, IC-OCSVM introduces the concept of information content to characterize the differences between samples. Information content, a concept descending from Claude Shannon’s mathematical theory of communication, quantifies how surprising or informative one sample is relative to another. The researchers design an explicit mapping function based on this information-content measure, which serves the same mathematical role as the implicit feature mapping performed by a kernel trick—but with a crucial advantage. Because the mapping is explicit and constructed directly from information theory, the method no longer depends on the delicate selection of Gaussian kernel parameters. The model essentially builds its own geometry from the information structure of the data rather than relying on a pre-chosen distance metric.
This design choice has a second benefit that matters greatly for industrial deployments. By measuring the distance between samples through information content rather than raw coordinate differences, the constructed OCSVM is far less susceptible to the sparsity problem that plagues high-dimensional data. Samples that would appear arbitrarily far apart in a high-dimensional Euclidean space may share substantial information structure, allowing the model to recognize the common signature of normal behavior even when the raw feature space is vast and thinly populated. In effect, the method asks a more meaningful question of the data: not ‘how far apart are these points?’ but ‘how much do these observations tell us about each other?’
To test the approach, the team turned to two of the most demanding and widely respected benchmark datasets in industrial control system security: SWaT and WADI. SWaT, the Secure Water Treatment testbed developed at the Singapore University of Technology and Design, simulates a full-scale water purification process complete with realistic cyberattack scenarios, while WADI extends the same experimental philosophy to water distribution networks. Both datasets feature multivariate time series from dozens of sensors and actuators, injected attacks of varying sophistication, and the noisy, correlated measurements that make real industrial anomaly detection so difficult. The researchers compared IC-OCSVM against a roster of state-of-the-art anomaly detection algorithms, including deep-learning approaches built on autoencoders, generative adversarial networks, and graph neural networks.
The results were striking. IC-OCSVM achieved an F1-score of 85.91 percent on SWaT and 68.28 percent on WADI, outperforming the best competing baseline by 3.2 and 3.3 percentage points respectively. In a field where incremental gains of a fraction of a percentage point frequently justify publication, improvements of this size—particularly on the notoriously difficult WADI dataset—are significant. The F1-score, which balances precision and recall into a single number, is especially meaningful in industrial security, where a detector that cries wolf too often wastes operator attention and one that stays silent too long allows attacks to proceed. IC-OCSVM’s edge on both fronts suggests that the information-theoretic framing genuinely captures structure that Gaussian-kernel and deep-learning baselines miss.
The implications extend well beyond water treatment. Any setting where anomalies must be learned from normal data alone—power grid monitoring, manufacturing quality control, aircraft engine health tracking, building automation—faces the same twin burdens of kernel tuning and high-dimensional sparsity. A method that sidesteps kernel parameter selection removes a costly and error-prone step from the deployment pipeline, while entropy-based dimension reduction offers a computationally light alternative to heavyweight deep architectures. Notably, IC-OCSVM achieves its results without the massive training datasets and GPU resources that deep learning methods typically demand, which could make sophisticated anomaly detection accessible to smaller operators and resource-constrained facilities that cannot maintain large labeled datasets or dedicated machine learning infrastructure.
The work also represents a broader and somewhat counterintuitive trend in machine learning research: the return of classical theory to solve problems that modern deep learning has struggled with. Shannon’s information theory, formulated in the 1940s, provides tools that are interpretable, mathematically grounded, and robust in ways that black-box neural networks often are not. By fusing information-theoretic feature analysis with the boundary-learning power of support vector machines, the Xi’an researchers have demonstrated that careful mathematical design can still beat brute-force complexity in the right domain. As industrial systems become ever more connected and the attack surface for critical infrastructure continues to expand, tools like IC-OCSVM point toward a future in which the sentinels guarding our water, power, and factories are built not just on more data, but on a deeper understanding of what information itself reveals.
Subject of Research: A hybrid information clustering and one-class support vector machine method for anomaly detection in industrial control systems
Article Title: A hybrid method integrating information clustering and one-class support vector machine for industrial anomaly detection
Article References: Wang, Z., Yuan, Z., Gao, C., & Chen, Y. (2026). A hybrid method integrating information clustering and one-class support vector machine for industrial anomaly detection. Applied Intelligence, 56(14), Article 418. https://doi.org/10.1007/s10489-026-07447-z
Image Credits: AI Generated
DOI: 10.1007/s10489-026-07447-z
Keywords: anomaly detection, industrial control systems, one-class support vector machine, information entropy, information content, SWaT dataset, WADI dataset, industrial cybersecurity, machine learning, high-dimensional data, Gaussian kernel, Applied Intelligence
Cite Scienmag News
APA MLA Chicago
Teresa Odom. (September 12, 2026). Information Theory Meets Machine Learning to Catch Industrial Cyberattacks. Scienmag. https://scienmag.com/information-theory-meets-machine-learning-to-catch-industrial-cyberattacks/
Teresa Odom. “Information Theory Meets Machine Learning to Catch Industrial Cyberattacks.” Scienmag, 12 September 2026, https://scienmag.com/information-theory-meets-machine-learning-to-catch-industrial-cyberattacks/. Accessed 12 September 2026.
Teresa Odom. “Information Theory Meets Machine Learning to Catch Industrial Cyberattacks.” Scienmag. September 12, 2026. https://scienmag.com/information-theory-meets-machine-learning-to-catch-industrial-cyberattacks/
Copy citation Download RIS
Tags: anomaly detectionanomaly detection in industrial environmentsanomaly detection in power gridsApplied Intelligenceapplying information theory to anomaly detectionchemical plant cybersecuritycyberattack prevention in manufacturingdata-driven cybersecurity methodsearly detection of industrial cyber threatsGaussian kernelhigh-dimensional dataIndustrial control system cybersecurityindustrial control systemsindustrial cybersecurityinformation contentinformation entropyinformation theory applications in machine learningMachine learningmachine learning for cyberattack detectionmachine learning techniques for industrial safetyone-class support vector machineOne-Class Support Vector Machine limitationsSWaT datasetWADI dataset
