TFDPM: Attack detection for cyber-physical systems with diffusion probabilistic models

TL;DR

This paper introduces TFDPM, a novel attack detection framework for cyber-physical systems that leverages diffusion probabilistic models and graph neural networks to improve accuracy and speed in identifying cyber-attacks.

Contribution

The paper proposes TFDPM, a new framework combining energy-based generative models and graph neural networks for more effective and faster attack detection in complex CPSs.

Findings

Outperforms existing attack detection methods.

Increases detection speed by three times.

Effectively models data correlations in CPSs.

Abstract

With the development of AIoT, data-driven attack detection methods for cyber-physical systems (CPSs) have attracted lots of attention. However, existing methods usually adopt tractable distributions to approximate data distributions, which are not suitable for complex systems. Besides, the correlation of the data in different channels does not attract sufficient attention. To address these issues, we use energy-based generative models, which are less restrictive on functional forms of the data distribution. In addition, graph neural networks are used to explicitly model the correlation of the data in different channels. In the end, we propose TFDPM, a general framework for attack detection tasks in CPSs. It simultaneously extracts temporal pattern and feature pattern given the historical data. Then extract features are sent to a conditional diffusion probabilistic model. Predicted values can be obtained with the conditional generative network and attacks are detected based on the difference between predicted values and observed values. In addition, to realize real-time detection, a conditional noise scheduling network is proposed to accelerate the prediction process. Experimental results show that TFDPM outperforms existing state-of-the-art attack detection methods. The noise scheduling network increases the detection speed by three times.