Few-shot Detection of Anomalies in Industrial Cyber-Physical System via Prototypical Network and Contrastive Learning

TL;DR

This paper introduces a few-shot anomaly detection model for industrial CPS using prototypical networks and contrastive learning, effectively identifying anomalies with limited labeled data and improving security.

Contribution

It proposes a novel few-shot detection method combining prototypical networks and contrastive learning, addressing overfitting and enhancing detection performance in industrial CPS.

Findings

Significantly improves F1 score in few-shot anomaly detection.

Reduces false alarm rate in experimental datasets.

Demonstrates robustness on imbalanced datasets.

Abstract

The rapid development of Industry 4.0 has amplified the scope and destructiveness of industrial Cyber-Physical System (CPS) by network attacks. Anomaly detection techniques are employed to identify these attacks and guarantee the normal operation of industrial CPS. However, it is still a challenging problem to cope with scenarios with few labeled samples. In this paper, we propose a few-shot anomaly detection model (FSL-PN) based on prototypical network and contrastive learning for identifying anomalies with limited labeled data from industrial CPS. Specifically, we design a contrastive loss to assist the training process of the feature extractor and learn more fine-grained features to improve the discriminative performance. Subsequently, to tackle the overfitting issue during classifying, we construct a robust cost function with a specific regularizer to enhance the generalization capability. Experimental results based on two public imbalanced datasets with few-shot settings show that the FSL-PN model can significantly improve F1 score and reduce false alarm rate (FAR) for identifying anomalous signals to guarantee the security of industrial CPS.