Abstract:

The anomaly detection of most of the industrial control systems (ICS) is faced with the problem of class-imbalance,which leads to a decrease in accuracy and the deterioration of generalization.According to the generative adversarial network (GAN),this paper proposes an anomaly detection model using only normal samples for training——the latent feature reconstruction generative GAN model (LFR-GAN).In the training stage,the model learns to generate the mapping of data to the latent space by a new encoder for realizing latent space feature reconstruction.In addition,an SE Block module is embedded to enhance the effective feature weight and to improve the ability of latent space feature reconstruction.For the discriminator,it identifies three data pairs produced by two encoders and one generator simultaneously,improving the model accuracy and generalization ability.In the detection stage,considering the reconstruction and identification of losses comprehensively,anomaly scoring formula optimization based on the L2 norm is adopted to overcome mode collapse.The validation experiment results on SWaT and WADI datasets show that the LFR-GAN model has obvious advantages over other GAN models in terms of learning ability,stability and detection results.

Key words: industrial control system, unbalanced data set, generative adversarial network, anomaly detection