Modeling normality: latent clustering for anomaly detection in CPS

In the realm of cyber-physical systems (CPS), early anomaly detection is a technical challenge that transcends traditional monitoring approaches. Unlike purely digital environments, these systems integrate physical components, communication networks, and software layers, generating normal behavior that rarely conforms to a single, homogeneous distribution. Instead, normality is often the union of multiple unbalanced operating regimes, with fuzzy boundaries and complex curvatures. Modeling this reality requires abandoning point-adjusted metrics—which paradoxically reward detectors that never alert—and adopting fair evaluation protocols, such as difficulty-based partitioning and exclusive calibration with normal data. One of the most promising approaches involves learning a joint latent representation and applying mode clustering via Gaussian mixtures, scoring anomalies in the latent space itself rather than on global density or reconstruction residual. This approach, by eliminating dependence on a flexible decoder, prevents the model from faithfully reconstructing complex faults and thus confusing them with normal patterns. Results on real-world datasets such as WADI, HAI, and SKAB show significant improvements on difficult subsets, especially when multimodality is pronounced. This type of technical challenge requires custom software solutions that integrate advanced artificial intelligence and signal processing capabilities. At Q2BSTUDIO we offer AI for businesses that enables the design of robust anomaly detection systems tailored to the multimodal nature of industrial data. Our artificial intelligence services combine deep learning, latent clustering, and AI agents to monitor critical infrastructures in real time. Additionally, we complement these capabilities with cybersecurity specialized in CPS environments, ensuring that fault detection does not compromise system integrity. All of this is supported by AWS and Azure cloud services to scale data processing, and by business intelligence solutions such as Power BI to visualize alerts and trends. The combination of custom applications, autonomous agents, and advanced analytics allows organizations not only to detect anomalies in complex scenarios but also to anticipate them with normality models that capture the true structure of system operation.