Robust Intrusion Detection for Industrial Control System

Anomaly-based intrusion detection is crucial for monitoring and preventing network intrusions and misuse within industrial control systems. While unsupervised anomaly detection algorithms have shown significant advancements, they often assume the availability of clean training data devoid of anomalies, which is frequently violated in practical scenarios where datasets may contain a few anomalies. Simply training an unsupervised anomaly detector on such datasets may lead to degraded performance. In this study, we introduce an approach called RobustWAE to mitigate the risk of the anomaly detection model learning features specific to anomalies. The core concept of our approach involves utilizing the trained model to generate anomaly scores for training samples, with samples exhibiting higher anomaly scores being assigned lesser weight in parameter updates. Consequently, the model learns to prioritize normal data over anomalies, thus enhancing its anomaly detection capabilities. We employ a Variation Autoencoder variant known as Wasserstein Autoencoder (WAE) as our anomaly detection model. Our experiments conducted on two tabular network traffic datasets, namely UNSW-NB15 and NSL-KDD, consistently demonstrate significant improvements over the baseline models.