Anomaly Detection in Industrial Control Systems Based on Cross-Domain Representation Learning

2025-09-15

AI Summary

Conventional single-domain anomaly detection methods for Industrial Control Systems (ICS)—e.g., relying solely on network traffic or sensor measurements—fail to capture complex cross-domain behavioral correlations, limiting their effectiveness against sophisticated, multi-stage attacks. Method: This paper proposes a cross-domain graph-based joint anomaly detection framework. It constructs a heterogeneous graph integrating network traffic and physical sensor states, designs a cross-domain representation learning architecture using graph neural networks to model dynamic interdependencies among multi-source behaviors, and incorporates a multi-task learning mechanism to jointly optimize anomaly identification across domains. Contribution/Results: Evaluated on multiple ICS benchmark datasets, the method achieves an average 6.2% improvement in F1-score over state-of-the-art approaches. It demonstrates superior detection capability for stealthy, cross-domain composite anomalies while offering interpretability and scalability—establishing a novel paradigm for explainable, extensible, cross-domain collaborative security monitoring in ICS.

Technology Category

• Application Domains: Internet of Things, Sensor Networks & Smart Cities
• Intelligent Robots: Multimodal Perception & Sensor Fusion
• Machine Learning: Transfer, Domain Adaptation, Multi-Task Learning

Application Category

• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs
• Security and Privacy: Large-scale security measurements
• Search and Retrieval-Augmented AI: Vertical and domain-specific search

Abstract

Industrial control systems (ICSs) are widely used in industry, and their security and stability are very important. Once the ICS is attacked, it may cause serious damage. Therefore, it is very important to detect anomalies in ICSs. ICS can monitor and manage physical devices remotely using communication networks. The existing anomaly detection approaches mainly focus on analyzing the security of network traffic or sensor data. However, the behaviors of different domains (e.g., network traffic and sensor physical status) of ICSs are correlated, so it is difficult to comprehensively identify anomalies by analyzing only a single domain. In this paper, an anomaly detection approach based on cross-domain representation learning in ICSs is proposed, which can learn the joint features of multi-domain behaviors and detect anomalies within different domains. After constructing a cross-domain graph that can represent the behaviors of multiple domains in ICSs, our approach can learn the joint features of them by leveraging graph neural networks. Since anomalies behave differently in different domains, we leverage a multi-task learning approach to identify anomalies in different domains separately and perform joint training. The experimental results show that the performance of our approach is better than existing approaches for identifying anomalies in ICSs.

Problem

• Detecting anomalies in industrial control systems
• Learning cross-domain joint behavioral features
• Identifying multi-domain anomalies via graph networks

Innovation

• Cross-domain graph construction for ICS behavior representation
• Graph neural networks learning multi-domain joint features
• Multi-task learning for separate anomaly identification across domains