Sandhy Fernandez
Department of Information System, Telkom University, Indonesia

Published : 1 Documents Claim Missing Document
Claim Missing Document
Check
Articles

Found 1 Documents
Search

Hybrid Model of Isolation Forest and Long Short-Term Memory Autoencoder for Digital Forensic Anomaly Detection in Manufacturing IoT Networks Muammar; Sandhy Fernandez; Arif Riyandi; Sena Wijayanto
JURNAL TEKNOLOGI DAN OPEN SOURCE Vol. 9 No. 1 (2026): Jurnal Teknologi dan Open Source, June 2026
Publisher : Universitas Islam Kuantan Singingi

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.36378/jtos.v9i1.5732

Abstract

The development of Internet of Things (IoT) technology in the manufacturing sector creates opportunities for efficiency while also increasing vulnerability to sabotage threats that are difficult to detect manually. This study aims to design and evaluate an artificial intelligence-based hybrid model that combines Isolation Forest and Long Short-Term Memory Autoencoder to detect anomalies in the context of digital forensics in manufacturing industrial IoT networks. The research design uses an experimental approach with a simulated dataset representing 35 working days of smart factory operations, covering 127 sabotage scenarios distributed across six types of logs. The methodology applied is a two-layer cascade architecture, where Isolation Forest serves as a statistical anomaly detector in the first layer, followed by Long Short-Term Memory Autoencoder as a time-series pattern validator in the second layer. The evaluation results show that Isolation Forest independently achieved an F1-score of 0.84, Long Short-Term Memory Autoencoder achieved 0.87, while the hybrid model produced an F1-score of 0.93 with a precision of 0.91 and a recall of 0.95. These findings confirm that the hybrid cascade approach significantly outperforms each individual method. This study concludes that the integration of both methods provides a more accurate and efficient digital forensic solution for detecting sabotage incidents in industrial IoT environments.