Deep Meta Learning-Based Anomaly Detection for Industrial Control Systems

doi:10.3778/j.issn.1673-9418.2410047

Abstract

Abstract: With the continuously networking process of industrial control systems, it is facing an endless stream of new types of network attacks, which lowers the detection accuracy of traditional anomaly detection methods due to the limited samples and limited generalization ability. For this reason, model agnostic meta learning (MAML) architecture is adopted to propose a deep MAML (D-MAML) anomaly detection method based on a convolutional neural network in this paper. Firstly, the inner and outer loop anomaly detection architecture of D-MAML is constructed. Among them, the inner loop extracts the sample features and the outer loop dynamically updates the parameters to improve the model generalization ability and meet the demand of small sample detection. Then, a meta module enhanced convolutional neural network is designed and the inner loop model parameters are updated based on the gradient descent method to improve the feature extraction capability. Further, an outer loop model parameter update algorithm based on a multistep loss function is proposed to improve the stability of the algorithm. Meanwhile, the cosine annealing algorithm is used to dynamically update the learning rate of the outer loop to solve the problem of insufficient algorithm generalization ability. Finally, the 5-classification experimental validation of D-MAML is carried out based on three publicly available datasets. The results show that the single-sample best accuracy of D-MAML is 67.17%, and the multi-sample best accuracy can be further improved to 92.84%.

Key words: industrial control systems, anomaly detection, small sample, model agnostic meta learning (MAML)

摘要： 工控系统在不断网络化的过程中，正面临着层出不穷的新型网络攻击，导致传统异常检测方法因样本数量有限、泛化能力不足而造成检测精度低的问题。为此，采用模型无关的元学习（MAML）架构，提出基于卷积神经网络的深度元学习（D-MAML）异常检测方法。构建D-MAML的内、外双循环异常检测架构。其中，内循环提取样本特征，外循环动态更新参数，以提高模型泛化能力，满足少样本检测需求。设计元模块增强的卷积神经网络，并基于梯度下降法更新内循环模型参数，提高特征提取能力。提出基于多步损失函数的外循环模型参数更新算法，提高算法稳定性。采用余弦退火算法动态更新外循环学习率，解决算法泛化能力不足问题。基于三个公开的数据集对D-MAML进行了5分类实验验证。结果表明，D-MAML的单样本最佳准确率为67.17%，多样本最佳准确率可进一步提升到92.84%。

关键词: 工控系统, 异常检测, 少样本, 模型无关的元学习（MAML）

LI Xinchun, TAN Xinhuan, LI Lin, XU Chi. Deep Meta Learning-Based Anomaly Detection for Industrial Control Systems[J]. Journal of Frontiers of Computer Science and Technology, 2025, 19(8): 2251-2260.

李新春, 谭新欢, 李琳, 许驰. 基于深度元学习的工控系统异常检测方法[J]. 计算机科学与探索, 2025, 19(8): 2251-2260.

References

[1] 常钰, 王钢, 朱鹏, 等. 工业互联网安全知识图谱构建研究综述[J]. 计算机科学与探索, 2024, 18(2): 279-300.
CHANG Y, WANG G, ZHU P, et al. Survey of research on construction method of industry Internet security knowledge graph[J]. Journal of Frontiers of Computer Science and Technology, 2024, 18(2): 279-300.
[2] 柴浩轩, 金曦, 许驰, 等. 面向工业物联网的5G机器学习研究综述[J]. 信息与控制, 2023, 52(3): 257-276.
CHAI H X, JIN X, XU C, et al. Review of machine learning-based 5G for industrial Internet of things[J]. Information and Control, 2023, 52(3): 257-276.
[3] 王振东, 刘尧迪, 杨书新, 等. 基于天牛群优化与改进正则化极限学习机的网络入侵检测[J]. 自动化学报, 2022, 48(12): 3024-3041.
WANG Z D, LIU Y D, YANG S X, et al. Network intrusion detection based BSO and improved RELM[J]. Acta Automatica Sinica, 2022, 48(12): 3024-3041.
[4] 杨超城, 严宣辉, 陈容均, 等. 融合双重注意力机制的时间序列异常检测模型[J]. 计算机科学与探索, 2024, 18(3): 740-754.
YANG C C, YAN X H, CHEN R J, et al. Time series anomaly detection model with dual attention mechanism[J]. Journal of Frontiers of Computer Science and Technology, 2024, 18(3): 740-754.
[5] 屠雅春, 许驰, 杜昕宜, 等. 基于字符距离聚类的未知工控协议分类方法[J]. 计算机应用研究, 2023, 40(12): 3696-3700.
TU Y C, XU C, DU X Y, et al. Character distance clustering-based classification algorithm for unknown industrial control protocols[J]. Application Research of Computers, 2023, 40(12): 3696-3700.
[6] CAI J, WANG Q, LUO J Z, et al. CapBad: content-agnostic, payload-based anomaly detector for industrial control protocols[J]. IEEE Internet of Things Journal, 2022, 9(14): 12542-12554.
[7] WANG W P, WANG Z R, ZHOU Z F, et al. Anomaly detection of industrial control systems based on transfer learning[J]. Tsinghua Science and Technology, 2021, 26(6): 821-832.
[8] ABDELATY M, DORIGUZZI-CORIN R, SIRACUSA D. DAICS: a deep learning solution for anomaly detection in industrial control systems[J]. IEEE Transactions on Emerging Topics in Computing, 2022, 10(2): 1117-1129.
[9] WANG X D, GARG S, LIN H, et al. Toward accurate anomaly detection in industrial Internet of Things using hierarchical federated learning[J]. IEEE Internet of Things Journal, 2022, 9(10): 7110-7119.
[10] KAUR D, ANWAR A, KAMWA I, et al. A Bayesian deep learning approach with convolutional feature engineering to discriminate cyber-physical intrusions in smart grid systems[J]. IEEE Access, 2023, 11: 18910-18920.
[11] XU C, DU X Y, LI L, et al. End-edge collaborative lightweight secure federated learning for anomaly detection of wireless industrial control systems[J]. IEEE Open Journal of the Industrial Electronics Society, 2024, 5: 132-142.
[12] DU X Y, XU C, LI L, et al. Multigranularity feature automatic marking-based deep learning for anomaly detection of industrial control systems[J]. IEEE Open Journal of Instrumentation and Measurement, 2024, 3: 2500110.
[13] AHMAD R, ALSMADI I, ALHAMDANI W, et al. Zero-day attack detection: a systematic literature review[J]. Artificial Intelligence Review, 2023, 56(10): 10733-10811.
[14] SANDBERG H, GUPTA V, JOHANSSON K H. Secure networked control systems[J]. Annual Review of Control, Robotics, and Autonomous Systems, 2022, 5: 445-464.
[15] VETTORUZZO A, BOUGUELIA M R, VANSCHOREN J, et al. Advances and challenges in meta-learning: a technical review[J]. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024, 46(7): 4763-4779.
[16] FINN C, ABBEEL P, LEVINE S. Model-agnostic meta-learning for fast adaptation of deep networks[C]//Proceedings of the 34th International Conference on Machine Learning, 2017: 1126-1135.
[17] TIAN Y J, ZHAO X X, HUANG W. Meta-learning approa-ches for learning-to-learn in deep learning: a survey[J]. Neuro-computing, 2022, 494: 203-223.
[18] RAVI S, LAROCHELLE H. Optimization as a model for few-shot learning[C]//Proceedings of the 5th International Conference on Learning Representations, 2017.
[19] XU C Y, SHEN J Z, DU X. A method of few-shot network intrusion detection based on meta-learning framework[J]. IEEE Transactions on Information Forensics and Security, 2020, 15: 3540-3552.
[20] KIM M. ML/CGAN: network attack analysis using CGAN as meta-learning[J]. IEEE Communications Letters, 2021, 25(2): 499-502.
[21] LU C M, WANG X F, YANG A M, et al. A few-shot-based model-agnostic meta-learning for intrusion detection in security of Internet of things[J]. IEEE Internet of Things Journal, 2023, 10(24): 21309-21321.
[22] SHARAFALDIN I, LASHKARI A H, HAKAK S, et al. Developing realistic distributed denial of service (DDoS) attack dataset and taxonomy[C]//Proceedings of the 2019 International Carnahan Conference on Security Technology. Piscataway: IEEE, 2019: 1-8.
[23] SHARAFALDIN I, LASHKARI A H, GHORBANI A A. Toward generating a new intrusion detection dataset and intrusion traffic characterization[C]//Proceedings of the 4th International Conference on Information Systems Security and Privacy, 2018: 108-116.
[24] TAVALLAEE M, BAGHERI E, LU W, et al. A detailed analysis of the KDD CUP 99 data set[C]//Proceedings of the 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications. Piscataway: IEEE, 2009: 1-6.
[25] VINYALS O, BLUNDELL C, LILLICRAP T, et al. Matching networks for one shot learning[C]//Advances in Neural Information Processing Systems 29, 2016.