iADCPS: Time Series Anomaly Detection for Evolving Cyber-physical Systems via Incremental Meta-learning

TL;DR

This work tackles anomaly detection in evolving cyber-physical systems by introducing iADCPS, which combines data-level alignment via Temporal Mixup with model-level incremental one-class meta-learning (Dual-Adapter) and a label-free non-parametric dynamic threshold (LDP-DT). The approach bridges distribution gaps caused by CPS evolution and maintains strong detection performance with limited evolving normal samples. Extensive experiments on PUMP, SWaT, and WADI show state-of-the-art results in both stable and evolving scenarios, along with insights from ablation studies and efficiency benchmarks. The work advances practical CPS security by enabling continual adaptation without heavy labeling, while acknowledging computational considerations and outlining paths for future optimization.

Abstract

Anomaly detection for cyber-physical systems (ADCPS) is crucial in identifying faults and potential attacks by analyzing the time series of sensor measurements and actuator states. However, current methods lack adaptation to data distribution shifts in both temporal and spatial dimensions as cyber-physical systems evolve. To tackle this issue, we propose an incremental meta-learning-based approach, namely iADCPS, which can continuously update the model through limited evolving normal samples to reconcile the distribution gap between evolving and historical time series. Specifically, We first introduce a temporal mixup strategy to align data for data-level generalization which is then combined with the one-class meta-learning approach for model-level generalization. Furthermore, we develop a non-parametric dynamic threshold to adaptively adjust the threshold based on the probability density of the abnormal scores without any anomaly supervision. We empirically evaluate the effectiveness of the iADCPS using three publicly available datasets PUMP, SWaT, and WADI. The experimental results demonstrate that our method achieves 99.0%, 93.1%, and 78.7% F1-Score, respectively, which outperforms the state-of-the-art (SOTA) ADCPS method, especially in the context of the evolving CPSs.

Figures (8)

• Figure 1: An illustrative example of CPS evolution.
• Figure 2: An illustrative example of ADCPS.
• Figure 3: Intuitive demonstration of distribution shift from PUMP, SWaT, and WADI.
• Figure 4: Overview of iADCPS approach, which consists of two components: the Dual-Adapter, which achieves dual adaptation of the model $\mathcal{M}^{K}(\cdot|{\theta})$ through Temporal Mixup and incremental one-class meta-learning; and the LWD-DT, which dynamically adjusts thresholds based on low-density point without relying on the labels.
• Figure 5: Comparison of ADA and LDP-DT.