Digital Twin-based Anomaly Detection with Curriculum Learning in Cyber-physical Systems

TL;DR

This paper introduces LATTICE, a digital twin-based anomaly detection method for cyber-physical systems that employs curriculum learning to improve detection accuracy and training efficiency by gradually increasing data difficulty.

Contribution

The paper extends previous digital twin-based anomaly detection with a curriculum learning framework, optimizing training by difficulty scoring and demonstrating improved performance and efficiency.

Findings

LATTICE outperforms baseline methods in F1 score by up to 2.37%.

LATTICE reduces training time by an average of 4.2%.

LATTICE maintains detection delay comparable to baselines.

Abstract

Anomaly detection is critical to ensure the security of cyber-physical systems (CPS). However, due to the increasing complexity of attacks and CPS themselves, anomaly detection in CPS is becoming more and more challenging. In our previous work, we proposed a digital twin-based anomaly detection method, called ATTAIN, which takes advantage of both historical and real-time data of CPS. However, such data vary significantly in terms of difficulty. Therefore, similar to human learning processes, deep learning models (e.g., ATTAIN) can benefit from an easy-to-difficult curriculum. To this end, in this paper, we present a novel approach, named digitaL twin-based Anomaly deTecTion wIth Curriculum lEarning (LATTICE), which extends ATTAIN by introducing curriculum learning to optimize its learning paradigm. LATTICE attributes each sample with a difficulty score, before being fed into a training scheduler. The training scheduler samples batches of training data based on these difficulty scores such that learning from easy to difficult data can be performed. To evaluate LATTICE, we use five publicly available datasets collected from five real-world CPS testbeds. We compare LATTICE with ATTAIN and two other state-of-the-art anomaly detectors. Evaluation results show that LATTICE outperforms the three baselines and ATTAIN by 0.906%-2.367% in terms of the F1 score. LATTICE also, on average, reduces the training time of ATTAIN by 4.2% on the five datasets and is on par with the baselines in terms of detection delay time.