Cyber-physical production systems consist of specialized hardware and software components, such as programmable logic controllers, and are used in domains like factory automation and critical infrastructure. Since most components provide low resistance to cyberattacks, security monitoring can address these limitations. The objective of security monitoring is to identify cyberattacks, which is crucial for initiating countermeasures.

This work introduces CyberLog⁺, a novel approach for efficiently and automatically detecting cyberattacks in large volumes of log data. We present the results of a practical evaluation based on a dataset from a real-world cyber-physical production system. Our findings demonstrate high accuracy rates in detecting anomalies, along with low runtime even on devices with limited resources.