WENFlow: Wavelet-Enhanced Normalizing Flows for Real-Time Anomaly Detection in CPS

Jacob Buckelew, Jose Paolo Talusan, Vasavi Sivaramakrishnan, Ayan Mukhopadhyay, Anurag Srivastava, Abhishek Dubey

Proceedings of the HSCC/ICCPS 2026: 29th ACM International Conference on Hybrid Systems: Computation and Control and 17th ACM/IEEE International Conference on Cyber-Physical Systems 2026 HSCC/ICCPS '26

Acceptance rate: 28%; Regular Paper; Track: Foundations

PDF

Why This Matters

Real-time anomaly detection in complex infrastructure systems requires capturing both slow operational trends and fast localized disruptions, with scalable robustness to contaminated training data and high dimensionality. Existing methods struggle with spatiotemporal dependencies and contamination from unlogged maintenance events. WENFlow is innovative because it achieves linear complexity scaling with sensor dimensionality through wavelet decomposition and feature-wise attention, providing both accurate anomaly detection and interpretable explanations of which sensors and temporal patterns indicate anomalies.

What We Did

WENFlow proposes a wavelet-enabled normalizing flow framework for unsupervised anomaly detection in high-dimensional cyber-physical systems. The work addresses the challenge of detecting subtle anomalies in systems like power grids and water networks that exhibit complex spatiotemporal patterns. WENFlow combines discrete wavelet transform for multi-scale temporal feature extraction with gated selective self-attention to identify critical sensors, conditional density estimation for likelihood-based anomaly scoring, and interpretable analysis through log-density and feature importance.

Key Results

Extensive evaluation on power grid and water treatment benchmarks demonstrates WENFlow achieves superior anomaly detection performance compared to state-of-the-art methods including transformers and density-based approaches, while maintaining linear scaling with system dimensionality and robustness to contaminated training data. The framework provides interpretable analysis through feature importance scores and temporal pattern visualization.

Full Abstract

Cite This Paper

@inproceedings{iccps2026_wenflow,
  author = {Buckelew, Jacob and Talusan, Jose Paolo and Sivaramakrishnan, Vasavi and Mukhopadhyay, Ayan and Srivastava, Anurag and Dubey, Abhishek},
  title = {WENFlow: Wavelet-Enhanced Normalizing Flows for Real-Time Anomaly Detection in CPS},
  year = {2026},
  booktitle = {Proceedings of the HSCC/ICCPS 2026: 29th ACM International Conference on Hybrid Systems: Computation and Control and 17th ACM/IEEE International Conference on Cyber-Physical Systems},
  location = {Saint Malo, France},
  abstract = {Real-time anomaly detection in high-dimensional data is crucial for ensuring the security of cyber-physical systems (CPS) such as power grids and water distribution networks. Such data commonly take the form of multivariate time series, often unlabeled and necessitating the need for unsupervised detection methods. However, many unsupervised deep learning methods make assumptions about the normality of training data, which is unrealistic in real-world CPS where training data often contain anomalies or rare patterns. Furthermore, these methods rely on inefficient mechanisms to learn spatiotemporal dependencies in the data and scale quadratically with the number of system features. To address these problems, we propose Wavelet-Enhanced Normalizing Flows (WENFlow), an unsupervised deep learning model that identifies anomalies in low-density regions of the data distribution and does not assume access to anomaly-free training data. Notably, WENFlow leverages a scalable Gated Selective Self-Attention mechanism for capturing the most critical spatial dependencies between features. Compared to existing models, WENFlow scales linearly with respect to the number of system features and meets real-time inference requirements for anomaly detection. In our experiments, WENFlow achieves superior AUC scores against baseline methods across datasets with varying anomaly ratios, showcasing its robustness against contaminated training data. We evaluate WENFlow on 2 real-world benchmark datasets and a simulated phasor measurement unit dataset collected from a power grid testbed.},
  keywords = {anomaly detection, cyber-physical systems, wavelet transforms, normalizing flows, spatiotemporal analysis, unsupervised learning, interpretability},
  note = {Acceptance rate: 28\%; Regular Paper; Track: Foundations},
  series = {HSCC/ICCPS '26}
}
Quick Info
Year 2026
Series HSCC/ICCPS '26
Keywords
anomaly detection cyber-physical systems wavelet transforms normalizing flows spatiotemporal analysis unsupervised learning interpretability
Research Areas
CPS ML for CPS Explainable AI
Search Tags

WENFlow, Wavelet, Enhanced, Normalizing, Flows, Real, Time, Anomaly, Detection, anomaly detection, cyber-physical systems, wavelet transforms, normalizing flows, spatiotemporal analysis, unsupervised learning, interpretability, CPS, ML for CPS, Explainable AI, 2026, Buckelew, Talusan, Sivaramakrishnan, Mukhopadhyay, Srivastava, Dubey, HSCC/ICCPS26