Mining sensor data in cyber-physical systems
archive: archived pipeline: cataloged verified
Get this paper ↗ (DOI — opens at the source; we link to it, we don't host it)
Summary
This paper addresses the challenge of mining sensor data in Cyber-Physical Systems (CPS) to detect intruders in real-time amidst noisy, dynamic, and untrustworthy data. CPS applications, such as battlefield surveillance and traffic control, rely on integrating physical sensors with cyber resources. However, sensor data is often unreliable due to hardware limitations and environmental factors, with studies indicating that up to 30–69% of data may be faulty. Existing methods for fault detection often require prior knowledge, large training datasets, or specific statistical assumptions that are unavailable or impractical in real-world CPS deployments. Consequently, the authors propose IntruMine, a framework designed to discover intruders from untrustworthy sensor data using unsupervised learning, without requiring prior knowledge of intruder attributes or labeled training data. The IntruMine framework operates through three main stages: trustworthiness analysis, intruder detection, and verification. First, it analyzes the trustworthiness of sensor data by constructing a monitoring graph that models the relationships between sensors and potential intruders. It calculates the coherence of sensor readings based on spatial and temporal relationships, estimating the probability that an alarm is caused by a specific intruder. Second, it detects intruder locations by identifying "peak reading sensors" and initializing intruder attributes (location and energy) at these positions. The system then iteratively refines these attributes using a gradient descent algorithm to minimize the difference between observed sensor readings and estimated readings derived from the intruder model. Finally, it verifies detections by computing a confidence score based on the likelihood of the observed data given the estimated intruder parameters, filtering out false positives where the reading deviation exceeds a statistical threshold. The authors evaluate IntruMine using both real-world data and synthetic datasets generated from military trajectory simulations involving 64 vehicles and varying numbers of sensors (400 to 10,000). The synthetic datasets include fault rates ranging from 10% to 40%. The performance of IntruMine is compared against baseline methods, including the TruAlarm method and Maximum Likelihood estimation. The results demonstrate that IntruMine effectively handles large-scale, noisy data streams and accurately identifies intruders without relying on supervised learning or extensive prior knowledge. The framework successfully filters false alarms and provides fine-grained situational awareness, addressing the limitations of statistical and feature-based approaches that struggle with scalability and adaptiveness in complex CPS environments. The significance of this work lies in providing a robust, unsupervised solution for real-time intruder detection in CPS, where data reliability is low and prior knowledge is scarce. By leveraging graph-based modeling and iterative optimization, IntruMine enables the transformation of raw, noisy sensor data into actionable knowledge. This approach enhances the feasibility of CPS applications in critical domains like military surveillance and environmental monitoring, where immediate and accurate detection is essential. The paper contributes to the field of data mining by demonstrating that effective knowledge discovery can be achieved in cyber-physical contexts despite the inherent uncertainties and complexities of physical sensor networks.
Provenance
The full processing record for this entry. Every stage of this paper's journey through the pipeline is logged — what ran, with which tool and model, how many attempts it took, and when it last completed.
| Stage | Outcome | Tool | Model | Prompt | Attempts | Completed |
|---|---|---|---|---|---|---|
| discover | success | OpenAlex-citations | — | — | 1 | 2026-06-24 |
| archive | success | unpaywall | — | — | 2 | 2026-06-26 |
| extract | success | cached | — | — | 2 | 2026-06-26 |
| clean | success | clean | — | — | 1 | 2026-06-25 |
| chunk | success | chunk | — | — | 1 | 2026-06-25 |
| embed | success | embed | Qwen/Qwen3-Embedding-8B | — | 1 | 2026-06-25 |
| promote | success | — | — | — | 1 | 2026-06-24 |
| summarize | success | llm | qwen3.6-27b-prismaquant | summ-v5 | 1 | 2026-06-26 |
| tag | success | vector_similarity | — | — | 6 | 2026-06-25 |
| verify | success | — | — | — | 1 | 2026-06-26 |
Summary generated by qwen3.6-27b-prismaquant on 2026-06-26; verification: verified.
Topics
Ranked by relevance to this paper. Hover a topic for its definition.