Uncertainty-Guided Label Rebalancing for CPS Safety Monitoring

2026-03-26

AI Summary

This work addresses the challenge of extreme class imbalance in cyber-physical systems (CPS) security monitoring, where malicious events are exceedingly rare and conventional rebalancing techniques exhibit limited efficacy on temporal telemetry data. To this end, the authors propose U-Balance, a novel approach that introduces behavioral uncertainty into CPS anomaly detection for the first time. Specifically, a GatedMLP model predicts an uncertainty score for each telemetry window, which then informs an uncertainty-guided label reassignment mechanism (uLNR). This mechanism probabilistically relabels high-uncertainty samples—initially marked as benign—as anomalous, thereby uncovering high-value boundary cases. Evaluated on a drone benchmark with a 46:1 class imbalance, U-Balance achieves an F1-score of 0.806, outperforming the strongest baseline by 14.3 percentage points while maintaining computational efficiency during inference.

Technology Category

• Machine Learning: Calibration & Uncertainty Quantification
• Multiagent Systems: Multiagent Systems under Uncertainty
• Reasoning under Uncertainty: Uncertainty Representations

Application Category

• Security and Privacy: Large-scale security measurements
• Responsible Web: Machine-in-the-loop, human agency and autonomy
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Safety monitoring is essential for Cyber-Physical Systems (CPSs). However, unsafe events are rare in real-world CPS operations, creating an extreme class imbalance that degrades safety predictors. Standard rebalancing techniques perform poorly on time-series CPS telemetry, either generating unrealistic synthetic samples or overfitting on the minority class. Meanwhile, behavioral uncertainty in CPS operations, defined as the degree of doubt or uncertainty in CPS decisions , is often correlated with safety outcomes but unexplored in safety monitoring. To that end, we propose U-Balance, a supervised approach that leverages behavioral uncertainty to rebalance imbalanced datasets prior to training a safety predictor. U-Balance first trains a GatedMLP-based uncertainty predictor that summarizes each telemetry window into distributional kinematic features and outputs an uncertainty score. It then applies an uncertainty-guided label rebalancing (uLNR) mechanism that probabilistically relabels \textit{safe}-labeled windows with unusually high uncertainty as \textit{unsafe}, thereby enriching the minority class with informative boundary samples without synthesizing new data. Finally, a safety predictor is trained on the rebalanced dataset for safety monitoring. We evaluate U-Balance on a large-scale UAV benchmark with a 46:1 safe-to-unsafe ratio. Results confirm a moderate but significant correlation between behavioral uncertainty and safety. We then identify uLNR as the most effective strategy to exploit uncertainty information, compared to direct early and late fusion. U-Balance achieves a 0.806 F1 score, outperforming the strongest baseline by 14.3 percentage points, while maintaining competitive inference efficiency. Ablation studies confirm that both the GatedMLP-based uncertainty predictor and the uLNR mechanism contribute significantly to U-Balance's effectiveness.

Problem

• class imbalance
• safety monitoring
• Cyber-Physical Systems
• behavioral uncertainty
• imbalanced datasets

Innovation

• behavioral uncertainty
• label rebalancing
• GatedMLP
• uLNR
• Cyber-Physical Systems