The cyber-physical production systems of Industry 4.0 are increasingly interconnected and rely on different IIoT (Industrial Internet of Things) communication protocols to ensure near-real-time communication between different industrial equipment. The adoption of these protocols makes production more flexible, more autonomous and more remotely controllable. To address this issue, we propose a detection pipeline combining a Markov-model to capture normal operation sequences and two machine learning algorithms (Isolation Forest and OCSVM (One-Class Support Vector Machine). The Markov- model calculates a sequential probability score, which is then used as an additional feature by the anomaly detectors. On a real OPC UA (OPC Unified Architecture) dataset containing attacks (denial of service, man-in-the-middle, spoofing), our approach shows remarkable performance. OCSVM achieves an overall accuracy of 99.90%, detecting 100% of anomalies (74,067 attacks) with only 0.8% false positives on normal traffic. The Isolation Forest, meanwhile, detects around 91.1% of anomalies while generating just 0.1% of false alarms. The ROC (Receiver Operating Characteristic) and PR (Precision Recall) curves confirm these excellent performances, with AUCs (Area Under the Curve) close to 1.0 for both models. The addition of the Markov sequential score specifically improves the detection of subtle attacks, demonstrating the complementarity and effectiveness of this hybrid approach compared with models based solely on statistical characteristics.