Hybrid Model of Isolation Forest and Long Short-Term Memory Autoencoder for Digital Forensic Anomaly Detection in Manufacturing IoT Networks - Muammar; Sandhy Fernandez; Arif Riyandi; Sena Wijayanto (JURNAL TEKNOLOGI DAN OPEN SOURCE, 2026)
The development of Internet of Things (IoT) technology in the manufacturing sector creates opportunities for efficiency while also increasing vulnerability to sabotage threats that are difficult to detect manually. This study aims to design and evaluate an artificial intelligence-based hybrid model that combines Isolation Forest and Long Short-Term Memory Autoencoder to detect anomalies in the context of digital forensics in manufacturing industrial IoT networks. The research design uses an experimental approach with a simulated dataset representing 35 working days of smart factory operations, covering 127 sabotage scenarios distributed across six types of logs. The methodology applied is a two-layer cascade architecture, where Isolation Forest serves as a statistical anomaly detector in the first layer, followed by Long Short-Term Memory Autoencoder as a time-series pattern validator in the second layer. The evaluation results show that Isolation Forest independently achieved an F1-score of 0.84, Long Short-Term Memory Autoencoder achieved 0.87, while the hybrid model produced an F1-score of 0.93 with a precision of 0.91 and a recall of 0.95. These findings confirm that the hybrid cascade approach significantly outperforms each individual method. This study concludes that the integration of both methods provides a more accurate and efficient digital forensic solution for detecting sabotage incidents in industrial IoT environments.