Imbalance-Sensitive Broad Learning System for Industrial Multivariate Time Series Anomaly Detection

2.1 Industrial time series anomaly detection

In industrial time-series anomaly detection, early studies mainly relied on physics-based models [20]. However, with the growth of sensor networks and high-dimensional multivariate data, traditional methods have become increasingly insufficient [21]. Recent studies show that data-driven approaches have gradually become mainstream [22, 23]. These methods usually construct a baseline from historical normal data and identify anomalies when real-time monitoring data deviates from this baseline [24, 25].

However, in practical applications, most collected data represent normal operating conditions, while data related to faults or cyberattacks are relatively scarce. This leads to a serious class imbalance problem [26, 27], causing models to focus excessively on normal patterns during training and reducing their sensitivity to critical minority faults [28]. In addition, dynamic noise caused by electromagnetic interference, sensor aging, and other factors further complicates anomaly detection [29, 30]. Such noise may mask weak anomalous signals and cause missed detections, or be incorrectly identified as anomalies and trigger false alarms [31]. Therefore, developing a robust anomaly detection model with high detection accuracy and a low false alarm rate remains a major challenge.

2.2 Broad learning system

To address the computational bottlenecks of traditional DNN when processing massive industrial time series, the BLS [32], is a significant expansion of the traditional Random Vector Functional-Link (RVFL) neural network in terms of topological structure and solution paradigm. Its core idea is to abandon the deeply stacked hierarchical structure in DNN and instead adopt a "horizontally expanded" flat topology. Specifically, BLS first maps the original input data into feature nodes through randomly initialized weights, and subsequently performs nonlinear transformations on the feature nodes to generate enhancement nodes. These two groups of nodes are concatenated to form a high-dimensional generalized state matrix. During the parameter solution phase, BLS employs a pseudo-inverse algorithm based on Ridge Regression to directly analytically determine the optimal output layer weights. Compared to deep learning methods relying on backpropagation (BP), the BLS exhibits significant theoretical advantages: first, due to its single-layer structure and closed-form algebraic solution, it completely avoids gradient vanishing and local optima problems in multi-layer networks; second, the matrix inversion process demonstrates extremely high computational efficiency when handling large-scale industrial data, and naturally supports rapid online incremental learning of network structures (new nodes) or data samples [33, 34].

To intuitively illustrate the structural and computational differences, Figure 1 presents a comparison of the topology and solution mechanism between traditional DNN and the proposed BLS framework. As depicted in Figure 1(a), the traditional DNN heavily relies on a deeply stacked hierarchical architecture, where parameter updating necessitates time-consuming error gradient backpropagation, making it highly susceptible to vanishing gradients. Conversely, as shown in Figure 1(b), the BLS adopts a horizontally expanded flat architecture. By concatenating the feature nodes group and the enhancement nodes group, the model calculates the output weights directly through a one-step analytical pseudo-inverse solution. This fundamental structural innovation effectively bypasses the gradient descent dilemmas and significantly accelerates the training process.

Figure 1. Comparison of topology and solution mechanism between traditional deep neural network (DNN) and broad learning system (BLS)

However, the standard broad learning model still exhibits obvious limitations in real industrial scenarios. Its objective function defaults to unweighted Ordinary Least Squares (OLS) for uniform optimization. When confronted with severely imbalanced industrial data, the global mean square error is easily dominated or "hijacked" by the massive majority class (e.g., normal operating state). To minimize the overall error, the model tends to sacrifice the fitting accuracy of the minority class (e.g., weak anomalies), causing the classification hyperplane to shift and severely compress towards the minority class space, leading to anomalous samples being incorrectly enclosed within the majority class boundary [35, 36].

2.3 Class imbalance learning strategies

To resolve the aforementioned "majority class hijacking" vulnerability inherent in standard BLS and other global classifiers, current processing strategies for class imbalance are mainly divided into data-level and algorithm-level systems. Data-level methods, represented by the Synthetic Minority Over-sampling Technique (SMOTE) and its evolutionary variants (e.g., ADASYN), generate synthetic samples by linearly interpolating neighboring minority samples in the feature space to forcefully balance the data categories [37]. However, for multivariate time series generated by industrial systems, such data—which possesses strong physical constraints and spatiotemporal coupling characteristics—is particularly sensitive to interpolation. Simple linear interpolation easily destroys original temporal dependencies and physical causality logic, and is highly prone to generating numerous "fake samples" and extra noise that deviate from physical reality in the sparse regions of minority decision boundaries, subsequently leading to a significant increase in false alarm rates during industrial deployment.

Therefore, algorithm-level strategies have proven to be a more feasible path when handling rigorous industrial time-series data [38, 39]. Algorithm-level methods do not alter the physical topology of the original dataset but rather implement interventions by reconstructing the optimization objective function. Among them, cost-sensitive learning balances the loss by assigning a higher preset misclassification cost to the minority class. Fuzzy weighting learning goes a step further by dynamically assigning continuous membership weights to each sample based on its distribution density or classification difficulty (e.g., margin from the hyperplane). This soft adjustment mechanism based on fuzzy membership can guide the model to autonomously strip away baseline noise and strengthen focus on difficult samples and minority anomaly boundaries, thereby significantly enhancing discriminative sensitivity to anomalous states while preserving the genuine temporal coupling of the data [40].

Figure 2 provides a conceptual diagram illustrating the decision boundary shifting and reshaping process under extreme class imbalance. As shown, the standard OLS boundary (dashed line) is severely compressed toward the minority class (anomaly) area due to the overwhelming numerical superiority of the majority class (normal) samples, inherently leading to a high probability of missed detections. In contrast, the proposed IS-BLS constructs a weighted boundary (solid line) fortified by a fuzzy membership-based "resistance ring," which assigns exponentially amplified penalty weights to misjudged minority anomalies. This targeted mechanism successfully corrects the boundary offset, ensuring a robust and clear separation between the rare anomalies and the massive normal baseline.

Figure 2. Class imbalance decision boundary shifting and reshaping conceptual diagram

2.4 Section summary

In summary, while existing studies have independently explored time-series feature extraction and imbalanced learning, directly applying existing BLS-based variants to industrial anomaly detection is sub-optimal. Conventional imbalance-oriented BLS models are designed for static data distributions; when exposed to raw, high-frequency industrial time series, dynamic environmental noise can easily disrupt their fuzzy memberships or distance-based weights, leading to severe performance degradation. Therefore, this study adopts a specific architectural combination: sliding-window feature reconstruction coupled with an IS-BLS. The sliding-window mechanism serves as a necessary physical shield, flattening dynamic waveforms into a stable, noise-resistant macroscopic feature space. Operating exclusively on this stabilized space, the IS-BLS can then fully leverage its large-margin asymmetric membership to severely penalize extreme minority anomalies without the computational burden of backpropagation. This combination explicitly decouples the dual challenges of intense noise and extreme class imbalance in real-world ICS environments.

4.1 Dataset description and model initialization parameter settings

This study adopts the SWaT dataset, a recognized benchmark dataset in the field of industrial control security. This dataset is generated by a modern water treatment testbed encompassing 51 multi-dimensional sensors and actuators. The data records 7 days of normal continuous operating states and 4 days of anomalous states subjected to specific cyberattacks (36 attack scenarios). The anomalous samples account for a very small proportion (less than $12 \%$), presenting a significant class imbalance characteristic, making it highly suitable as the industrial validation object for this study.

Strictly Isolated Validation Scheme (Preventing Data Leakage): To rigorously evaluate the proposed IS-BLS model and strictly prevent the temporal data leakage commonly associated with overlapping sliding windows, we implemented a robust validation scheme defined as Chronological Hold-out Testing with Internal Cross-Validation. Specifically, the data partitioning was executed strictly at the raw temporal sequence level rather than at the randomized window level. The continuous industrial multivariate time series was split based on absolute chronological order: the initial 80% of the temporal sequence was designated as the global training and validation pool, while the subsequent 20% of the sequence was strictly reserved as the unseen hold-out test set. Because the split point is applied to the raw timeline prior to window generation, there is absolutely zero physical overlap or information leakage between the training windows and the testing windows.

Model initial parameter suggestions and settings: To ensure model convergence efficiency and prevent overfitting, combining validation set grid search and the asymmetric topology principles of the BLS, this paper sets the following recommended initial parameters for the feature dimensions based on the SWaT dataset $(D=51 \times 10=510$ dimensions):

Network node scale In practical applications, to fully extract diversified representations of high-dimensional input data while controlling the redundancy of the enhancement space, the number of feature mapping nodes should generally be set larger than the number of enhancement nodes. Therefore, the number of feature mapping node groups is set to maptimes $=40$, the enhancement node groups to enhencetimes $=20$, and the batch size per group is 20. Under this configuration, the feature nodes and enhancement nodes are 800 and 400 respectively (forming a generalized state matrix of 1200 dimensions), achieving a good balance between model capacity and computational overhead.

Imbalance weighting parameters: The majority class position tolerance hyperparameter $a$ is set to 1.5, and the fuzzy membership decay coefficient $\beta$ is set to 0.5 .

Training optimization parameters: The regularization coefficient $\lambda$ is set to 0.001, the maximum number of closedoop iterations MaxIter is set to 20 and the weight convergence residual threshold $\epsilon$ is set to $1 \times 10^{-3}$.

To eliminate data dimension impacts, input data is first standardized using Z-score. As emphasized in our strictly isolated validation scheme, the Stratified 5-Fold Cross Validation (CV) was adopted exclusively within the boundaries of the 80% training pool for robust internal hyperparameter optimization. The final comprehensive evaluation metrics reported in this study were derived entirely from the isolated 20% future hold-out test set.

4.2 Comparative experiments and result analysis

To verify the comprehensive discriminative capability of the proposed IS-BLS algorithm, representative advanced baseline algorithms were selected for comparison, including deep autoencoder models (LSTM-AE [41], DAGMM, USAD) and graph neural network-based models (GCN, GAT [42], VGAE [43], GAE-AD [44], GDN).

To ensure a strictly transparent and fair comparison, all baseline models were evaluated under equivalent experimental conditions. First, regarding input processing, all models ingested data from the exact same chronological split (80% training, 20% unseen testing) and utilized the identical temporal context (window length "L=60") after Z-score standardization. Second, regarding the supervision level and thresholding, since the deep autoencoder and graph-based baselines are primarily unsupervised reconstruction or forecasting models, they were trained exclusively on the normal samples within the shared training pool.

Hardware and software environment: To ensure computational efficiency and a fair comparison, all experiments were conducted on a 64-bit Windows platform equipped with an Intel Core i7-14650HX CPU (2.20 GHz), 32 GB RAM, and an NVIDIA GeForce RTX 4070 GPU (8 GB VRAM). The algorithms were implemented in Python 3.9, utilizing PyTorch for deep learning baselines and NumPy/SciPy for the matrix analytical derivations of IS-BLS.

This study utilizes four core indicators to comprehensively evaluate the model's anomaly detection performance: Precision, Recall, AUC-PR, and F1-score. The experimental result comparison on the SWaT dataset is summarized in Table 1.

An in-depth analysis of the data in Table 1 reveals that because the SWaT dataset has severe class imbalance, traditional deep reconstruction models and graph learning models perform excellently in Precision by fitting the majority class, but generally perform poorly in the Recall metric (mainly hovering between 0.60 and 0.68). This indicates that the aforementioned comparison models are severely constrained by the "majority class trap", leading to over 30% of actual industrial anomalies being treated as normal data and missed, which is unacceptable in actual industrial security scenarios.

Table 1. Performance comparison of different methods on secure water treatment (SWaT) dataset

Figure 4. Comprehensive performance comparison of different methods on secure water treatment (SWaT)

In contrast, the IS-BLS detection algorithm proposed in this paper implements targeted compensation for the minority class by introducing a slack factor and fuzzy membership weighting mechanism. Under the premise of maintaining high precision (0.9857), the anomaly recall is boosted to 0.8443, and the AUC-PR and F1-score metrics reach 0.9207 and 0.9087 respectively, outperforming all comparative baseline models. This demonstrates that the method effectively reshapes the decision boundary, well balancing the core industrial demands of "low missed detection" and "low false alarms".

To visually demonstrate this performance gap, Figure 4 displays the comprehensive performance comparison of different methods on the SWaT dataset. The grouped bar chart intuitively reveals that while most deep reconstruction and graph learning models maintain high precision, their recall bars drop significantly, reflecting their vulnerability to the majority class trap. Conversely, the IS-BLS method achieves a highly balanced and superior performance across all metrics, particularly highlighting its distinct advantage in recall and overall F1-score.

The significant enhancement in Recall is fundamentally driven by the synergy of three coupled mechanisms within the IS-BLS architecture. Specifically, the window-based feature reconstruction smooths out high-frequency environmental noise. By flattening transient signal fluctuations, it secures a highly stable normal baseline, which is crucial for maintaining high Precision. Concurrently, the minority-class penalization restructures the optimization objective. Rather than being dominated by the overwhelming volume of normal data, the network assigns exponentially higher costs to undetected anomalies. Most critically, the asymmetric fuzzy membership drives a direct adjustment of the decision boundary. By deliberately relaxing the margin around the majority class, the classification hyperplane is pushed closer to the normal data space. This targeted boundary reshaping ensures that marginal cyber-physical attacks, which typically disguise themselves near the normal baseline, are effectively captured. This direct boundary adjustment serves as the primary catalyst for the substantial surge in Recall, effectively mitigating the missed-detection bottleneck in industrial anomaly detection.

4.3 Analysis of feature reconstruction effectiveness and label mechanisms

4.3.1 Validation of time window feature mapping effectiveness

To verify the necessity of the "task-oriented sliding window feature reconstruction" foundation, an ablation experiment was designed. We compared the performance difference between directly inputting high-frequency raw time-series waveforms into the model (No Windowing) and adopting the feature reconstruction mechanism (With Windowing, L = 60, step S = 10). The results are shown in Figure 5.

Figure 5 directly illustrates the magnitude of performance improvement achieved by the sliding window feature reconstruction in the ablation study. The data indicates that directly inputting raw high-frequency dynamic time series severely degrades the model's discriminative capability, performing particularly poorly in Recall (only 0.6533) with an overall F1-score of merely 0.7278 . This deficiency is primarily attributed to the pervasive environmental white noise and sensor jitter in the raw data, which severely disrupt the analytical solving process. Conversely, after introducing the feature reconstruction mechanism, the model systematically extracts 10 -dimensional static statistical and kinetic features, effectively filtering out transient glitches and capturing macroscopic evolutionary patterns. This mechanism results in substantial improvements across all evaluative metrics: Precision increases from 0.8214 to 0.9857, and AUCPR increases from 0.7650 to 0.9207. Most crucially, recall experiences a remarkable surge of $+29.2 \%$ (reaching 0.8443), which ultimately drives the overall F1-score up by $+24.9 \%$ (reaching 0.9087). This significant data span compellingly verifies that the feature reconstruction step is an indispensable prequisite for constructing a highly robust industrial anomaly detection baseline.

Figure 5. Performance gain via windowed feature reconstruction in the ablation study

4.3.2 Comparison of window anomaly label allocation mechanisms

When slicing continuous time series into windows, how to define the binary classification label (normal or anomalous) for the entire sliding window is a critical step. It is crucial to clarify that selecting a label allocation mechanism is not merely an algorithmic hyperparameter choice, but a fundamental definition of the anomaly detection task itself. This paper designed and compared two mainstream allocation mechanisms:

• Any Mechanism: As long as the window contains at least 1 anomalous sample point, the window is marked as an anomaly (minority class).
• Majority Mechanism: Only when over $50 \%$ (more than half) of the data points within the window are confirmed as anomalous is the entire window marked as an anomaly.

Figure 6 quantitatively demonstrate the multi-dimensional performance trade-offs when transitioning from the lenient 'Any' mechanism to the strict 'Majority' mechanism. The data reveals a distinct "give-and-take" characteristic. Specifically, adopting the 'Majority' mechanism incurs a marginal decline in theoretical Recall (decreasing from "0.8950" to "0.8443"). However, this is accompanied by a massive leap in Precision by "+15.8%" (surging from "0.8512" to "0.9857").

Figure 6. Performance trade-offs between "Any" and "Majority" window label allocation mechanisms

To cleanly interpret these metric changes, we must explicitly link them to the physical realities of ICS. In an actual ICS environment, a single or highly transient anomalous data point (e.g., lasting merely milliseconds) is highly likely to be environmental electromagnetic noise or a momentary sensor glitch rather than a destructive attack. By transitioning to the 'Majority' mechanism, we are effectively redefining the mathematical task to align with the true industrial definition of a sustained "System-level Event" or a continuous cyber-physical attack.

Therefore, the substantial improvement in Precision is not an arbitrary metric shift, but a direct result of this task redefinition. The 'Majority' mechanism successfully eliminates the contamination of massive normal baseline signals (and transient glitches) within the anomaly feature representations. By forcing the model to cease chasing transient noise and correctly focus on purifying genuine, sustained anomaly patterns, this mechanism drives a net positive gain of "+4.1%" in the comprehensive F1-score (rising from "0.8725" to "0.9087"). This firmly validates that redefining the task via strict anomaly purification is decisive for suppressing system false alarms and enhancing practical detection efficacy in complex industrial settings.

4.4 Core parameter sensitivity and computational efficiency analysis

4.4.1 Sliding window length (L) experimental analysis

The sliding window length L determines the temporal receptive field for feature extraction. To analyze its impact on performance, this experiment set the window length L to 10, 30, 60, 90, 120, 150 and 180 time steps respectively.

Figure 7. Sensitivity analysis of sliding window length with physical smoothing regimes

Figure 7 illustrates the sensitivity of the model's F1-score to the sliding window length $L$, systematically categorized into distinct physical smoothing regimes. The experimental trajectory manifests a prominent inverted-U non-linear curve. In the "Under-smoothed" region (e.g., $L=10$), the insufficient sample capacity within a brief window fails to generate robust statistical and kinetic features. This renders the model highly susceptible to transient environmental noise interference, yielding a suboptimal F1-score of only 0.8245. As the temporal window expands, the model transitions into the "Optimal Feature Extraction Region," reaching its performance zenith at $L=60$ (F1-score $=0.9087$). At this exact scale, a perfect equilibrium is struck between microscopic local information representation and macroscopic ⋅ noise reduction. However, when the window is blindly extended deeper into the "Over-smoothed" region (e.g., as $L$ scales from 120 all the way to 180), the excessively long temporal span forcibly incorporates massive volumes of normal baseline data. Consequently, short and abrupt anomaly. features are severely diluted by this "over-averaging" effect, leading to a continuous, long-tail degradation in detection sensitivity (with the F1-score progressively dropping to 0.8325). This comprehensive data span firmly corroborates that configuring a moderate sliding window $(L=60)$ is the optimal strategic choice for balancing noise robustness and anomaly sensitivity.

4.4.2 Trade-off between network node scale and computational efficiency

The discriminative performance of the BLS is closely related to the network width. To find the optimal scale that guarantees recognition accuracy while meeting industrial computational timeliness requirements, this paper kept the batch size = 20 constant and gradually expanded the mapping groups and enhancement groups roughly at a $2: 1$ ratio. Experimental results are shown in Table 2.

As observed in Table 2, maintaining an asymmetric topological structure helps the model strike a reasonable balance. When the mapping groups reach 40 and enhancement groups reach 20 , the F1-score hits 0.9087 , and its actual average single iteration running time stabilizes at around 6.79 seconds. After this, if the node scale continues to increase, the accuracy gain is very limited (only an increase of 0.0025 ), but the single iteration time escalates to over 36 seconds. Therefore, adopting a configuration of maptimes $=40$, enhencetimes $=20$. is an ideal configuration point balancing recognition accuracy and computational efficiency.

Table 2. Impact analysis of asymmetric network node scale on computational efficiency

To intuitively illustrate the data trends presented in Table 2, Figure 8 employs a Pareto frontier bubble chart to visually unpack the multi-dimensional trade-off among node scale (represented by bubble size), detection performance, and time cost. As depicted, during the initial network expansion, the model's performance improves significantly with marginal time overhead. However, once surpassing the optimal configuration of 40:20 (highlighted by the red bubble), the model abruptly enters the "Diminishing Returns Region" (shaded area). Within this regime, the computational time escalates exponentially, whereas the F1-score curve virtually flatlines. This striking visual trajectory perfectly echoes the quantitative findings in Table 2, firmly validating that the 40:20 configuration achieves the optimal equilibrium between detection precision and industrial real-time computational feasibility.

Figure 8. Pareto frontier analysis of network node scale versus computational efficiency

During the preparation of this manuscript, the author utilized generative artificial intelligence technology (Large Language Models) strictly for language and presentation support, specifically to improve grammatical correctness, stylistic clarity, and sentence structure. The AI tools were not used to generate substantive academic content, data, or experimental results. After using these tools, the author meticulously reviewed and edited the content, taking full responsibility for the final publication.