A Deep Q-Network Optimized Thresholding based GNN-BiLSTM Approach to Anomaly Detection in Cyber Physical Systems

Detecting anomalies in Industrial Internet of Things (IIoT) environments is essential for protecting Industrial Control Systems (ICS) and Cyber-Physical Systems (CPS) from false data injection and other malicious attacks. The growing complexity of sensor networks and interconnected control loops makes it difficult to identify abnormal behavior hidden within highdimensional, time-dependent signals. This paper introduces a hybrid deep learning framework that combines Graph Neural Networks (GNNs), Bidirectional Long Short-Term Memory (BiLSTM) networks, and a Multi-Head Attention mechanism to improve anomaly detection accuracy. The GNN component models spatial relations among sensors, the BiLSTM captures temporal dependencies, and the attention layer highlights the most informative time steps. The model generates continuous anomaly scores, which are transformed into binary decisions using an adaptive threshold, optimized via a Deep Q-Network (DQN). The approach is evaluated on the Secure Water Treatment (SWAT) dataset, a real industrial benchmark containing both normal and attack sequences. Balanced sampling and stratified data splits were used to ensure reliable evaluation. The proposed model achieves an accuracy of 0.99, precision of 0.986, recall of 0.993, and an F1-score of 0.990, exceeding the performance of existing baselines. Results across multiple runs confirm consistent generalization and stability. The framework provides a practical and scalable method for strengthening cyberphysical infrastructures.