Improving Intrusion Detection with Domain-Invariant Representation Learning in Latent Space

TL;DR

This paper presents a multi-task learning approach that creates domain-invariant latent representations to improve zero-day anomaly detection in industrial systems, outperforming traditional methods.

Contribution

It introduces a novel multi-task representation learning technique that fuses domain information into a minimal, invariant latent space for better out-of-distribution anomaly detection.

Findings

Significant improvement in zero-day anomaly detection accuracy.

Effective domain-invariant feature learning demonstrated across multiple datasets.

Enhanced generalization to unseen domains in anomaly detection tasks.

Abstract

Zero-day anomaly detection is critical in industrial applications where novel, unforeseen threats can compromise system integrity and safety. Traditional detection systems often fail to identify these unseen anomalies due to their reliance on in-distribution data. Domain generalization addresses this gap by leveraging knowledge from multiple known domains to detect out-of-distribution events. In this work, we introduce a multi-task representation learning technique that fuses information across related domains into a unified latent space. By jointly optimizing classification, reconstruction, and mutual information regularization losses, our method learns a minimal(bottleneck), domain-invariant representation that discards spurious correlations. This latent space decorrelation enhances generalization, enabling the detection of anomalies in unseen domains. Our experimental results demonstrate significant improvements in zero-day or novel anomaly detection across diverse anomaly detection datasets.