MFAD: A Multimodal Feature Fusion-Enhanced Time Series Anomaly Detection Framework in Industrial Cyber-Physical Systems

Industrial Cyber-Physical Systems (ICPS) are increasingly vulnerable to sophisticated attacks and operational disturbances that induce subtle and hard-to-detect anomalies, particularly in industrial edge environments. Existing anomaly detection methods often rely on sufficient labeled data and involve excessive computational overhead, hindering real-time detection and lightweight deployment. To address these challenges, we propose a Multimodal Feature fusion-enhanced time series Anomaly Detection framework (MFAD) in ICPS. MFAD enhances the representation of subtle anomalies by jointly modeling temporal dynamics and industrial characteristics through a unified multimodal feature fusion mechanism. Moreover, MFAD adopts a three-stage detection strategy with adaptive thresholding, which further improves robustness under varying operating conditions, while its lightweight overall architecture supports edge deployment. In addition, we provide the Industrial Gas Cyber-Physical System (IGCPS) dataset collected from real-world industrial operations. Experiments on ICPS benchmark datasets of varying scales, including IGCPS, PUMP, WADI, and SWaT, demonstrate that MFAD achieves an F1 score exceeding 96.7% with efficient resource utilization, validating its effectiveness for real-time detection and lightweight deployment in resource-constrained industrial edge environments. Note to Practitioners—This paper is motivated by the increasing need for reliable and efficient anomaly detection in Industrial Cyber-Physical Systems (ICPS), particularly deployed in resource-constrained industrial edge environments. Existing approaches often treat temporal and industrial features separately, rely on sufficient labeled data, and require substantial computational resources, which limits their applicability in real-world industrial settings. In contrast, the proposed MFAD provides a lightweight and practical solution that integrates multimodal feature fusion with robust semi-supervised detection mechanisms to effectively capture subtle anomalies in time series industrial data. The framework is designed with deployment feasibility that it offers strong detection accuracy, low latency, and efficient resource consumption suitable for industrial edge devices. The methods presented here can inform practitioners seeking to enhance the reliability and real-time performance of ICPS anomaly detection systems. Future extensions may focus on expanding MFAD for broader online industrial applications, integrating it with more edge platforms, and enabling large-scale distributed deployment.