Abstract
Industrial Internet of Things (IIoT)-based technologies are becoming increasingly popular in water-distribution cyber-physical systems (CPS) for automated, real-time control and information-based decision-making. Nevertheless, this increased digital connectivity has also expanded the attack surface, allowing adversaries to interfere with sensor data and control logic, and to cause harmful hydraulic disturbances. To overcome them, this paper proposes a comprehensive secure IIoT architecture that integrates blockchain-based data integrity with a sophisticated anomaly-detection framework tailored to a water-distribution CPS. The architecture uses a permissioned blockchain to provide tamper-resistant recording of sensor telemetry, device identity validation via smart contracts, and verifiable provenance for the operator and forensic analysis. To supplement the trust layer, a hybrid anomaly-detection model based on LSTM autoencoders with cyber-physical feature fusion can provide real-time detection of both sudden and covert attacks. Three popular benchmark datasets, BATADAL, WADI, and SWaT, are used to evaluate the proposed system, simulated hydraulic networks, and full-scale industrial testbeds. The results of the experiments show that the proposed framework is more accurate, has higher recall, and achieves a higher AUC than classical machine-learning and modern deep-learning baselines. The cross-dataset analysis demonstrates the framework's ability to be transferred into a cross-dataset and heterogeneous water and industrial CPS environment, where performance depends on the density of sensors, complexity of processes, and distribution of attacks. The result shows the strength of the proposed model and the potential necessity of further domain adaptation-based methods in the case of highly heterogeneous deployments.