Enhanced anomaly detection of industrial control systems via graph-driven spatio-temporal adversarial deep support vector data description

Anomaly detection of Industrial Control Systems (ICS) plays a crucial role in ensuring system safety and improving product quality. However, traditional anomaly detection techniques often face significant challenges when dealing with data imbalance, dynamic spatial relationships, and temporal dependencies. To address these issues, this paper proposes an innovative anomaly detection method called Graph-driven SpatioTemporal Adversarial Deep Support Vector Data Description (GSTA-DeSVDD). Specifically, GSTA-DeSVDD builds an anomaly detection framework by combining spatio-temporal embedding with adversarial DeSVDD one-class classifier. For capturing the spatial relationships effectively, a hybrid static-dynamic graph learning strategy is designed in the Residual Graph Convolutional Networks (res-GCN) to capture global and local spatial dependencies in the data. Moreover, an attention-based Long Short Term Memory (LSTM) network is introduced to mine time series data dependencies. Finally, an adversarial one-class classifier is constructed by leveraging anomaly data generated through adversarial learning to assist accurate DeSVDD modeling. Experimental results on three benchmark datasets show that this proposed model outperforms the comparative methods in anomaly detection tasks. The source code is available at https://github.com/Jelly0030/GSTADeSVDD.