Multi-Scale Sensor-Aware Variational Autoencoders for Adaptive IoT Security: Integrating Drift Calibration and Cyberattack Detection

Abstract

Existing approaches to Industrial Internet of Things (IoT) anomaly detection treat sensor drift calibration and cyberattack detection as separate problems, overlooking their strong interdependence and the compound failure modes that arise when drift dynamics are exploited by stealthy adversaries. Industrial Internet of IoT sensor networks therefore require a unified framework that jointly models both phenomena. This paper proposes the first unified multi-scale sensor-aware variational autoencoder (MS-VAE) framework that jointly models sensor drift and malicious activity within shared latent representations, enabling integrated calibration and security monitoring. The framework introduces three key components: (i) a multi-scale latent architecture that captures short-term anomalies and long-term drift simultaneously, (ii) sensor-aware feature modulation to accommodate heterogeneous sensor characteristics, and (iii) a context-aware adaptive thresholding (CAAT) mechanism that dynamically adjusts decision boundaries under environmental variation and sensor aging. Experimental evaluation on false data injection attacks (FDIAs) demonstrates that the proposed method achieves 94.1% detection accuracy with a 3.1% false alarm rate, significantly outperforming correlation-based, standard VAE, and transformer-based baselines. Robustness evaluation across three non-Gaussian drift conditions (piecewise-linear, exponential, and abrupt step) confirms that the framework retains DR ${\,}{\geq }{\,}91\%$ and FAR ${\,}{\leq }{\,}7\%$ without retraining, validating its applicability under drift distributions not seen during training.