Hybrid models for detecting shadowburst anomaly in industrial IoT traffic

Abstract

The increasing deployment of Industrial Internet of Things (IIoT) systems within Industry 4.0 environments has introduced new cyber-physical vulnerabilities, particularly in the form of stealthy and short-lived anomalies that evade traditional detection mechanisms. This paper introduces and formalizes a novel anomaly type, referred to as ShadowBurst, which consists of protocol-conformant, high-frequency microbursts embedded in otherwise stable traffic streams. We propose a hybrid detection architecture that integrates Kalman filtering for temporal state estimation with machine learning techniques, specifically Isolation Forest, for residual-based outlier detection. The detection function is further enhanced by incorporating statistical scoring and behavioral profiling to improve anomaly visibility. Simulation results confirm that this hybrid Kalman–ML approach enables effective identification of ShadowBurst anomalies in time-sensitive IIoT traffic, addressing gaps left by signature-based and purely statistical models. The proposed model demonstrates high responsiveness to low-duration, protocol-mimicking threats and supports real-time deployment in smart manufacturing environments.