Anomaly detection of industrial control systems (ICS) based on sensor data analytic is of utmost importance because ICS may suffer from various attacks leading to anomaly behaviors and even equipment failures. As an emerging deep learning technique, deep support vector data description (DeSVDD) has been successfully applied to ICS anomaly detection. Its advantage lies in only requiring normal data to train one-class classifier, which is suitable for actual industrial scenarios with extremely data imbalance of abundant normal data and scare abnormal data. However, this also results in its shortcoming of ignoring the valuable classification information hidden in the abnormal data. In order to overcome this issue, this paper proposes an improved DeSVDD method, called radius constraint DeSVDD (RC-DeSVDD). The proposed model constructs an anomaly detection model framework of abnormal data assisted DeSVDD, where a radius constraint is designed by considering the difference between normal and abnormal data. Further, considering the limited amount of abnormal data, a bi-directional generative adversarial network (BiGAN) is introduced to generate abnormal data. Experimental results on three benchmark datasets demonstrate the superiority of the proposed RC-DeSVDD anomaly detection method.
Read full abstract