An Attention-Based Deep Generative Model for Anomaly Detection in Industrial Control Systems

TL;DR

This paper introduces a novel attention-based deep generative model using a variational autoencoder architecture for improved anomaly detection in industrial control systems, demonstrating superior performance on SWaT testbed data.

Contribution

The paper proposes a new deep generative model with an attention mechanism for anomaly detection, enhancing feature representation and detection accuracy in cyber-physical systems.

Findings

Outperforms baseline anomaly detection methods

Effective in detecting anomalies across all SWaT testbed stages

Incorporates dynamic thresholding for improved detection sensitivity

Abstract

Anomaly detection is critical for the secure and reliable operation of industrial control systems. As our reliance on such complex cyber-physical systems grows, it becomes paramount to have automated methods for detecting anomalies, preventing attacks, and responding intelligently. {This paper presents a novel deep generative model to meet this need. The proposed model follows a variational autoencoder architecture with a convolutional encoder and decoder to extract features from both spatial and temporal dimensions. Additionally, we incorporate an attention mechanism that directs focus towards specific regions, enhancing the representation of relevant features and improving anomaly detection accuracy. We also employ a dynamic threshold approach leveraging the reconstruction probability and make our source code publicly available to promote reproducibility and facilitate further research. Comprehensive experimental analysis is conducted on data from all six stages of the Secure Water Treatment (SWaT) testbed, and the experimental results demonstrate the superior performance of our approach compared to several state-of-the-art baseline techniques.