Abstract:Anomaly detection plays an important role in industry, especially in ensuring system safety and product quality. Due to the unavailability of anomalous data in many practical cases, anomaly detection is usually solved by one-class classification (OCC) methods using only normal data. As a classical OCC method, one-class support vector machine (OCSVM) is a popular discriminative approach for anomaly detection, which detects abnormal data points by establishing a decision boundary in the kernel space. However, the performance of OCSVM heavily relies on kernel parameters, whose selection is not trivial for anomaly detection problems. Moreover, for some uneven and complex data distributions, different data regions may have quite different densities and shapes, making it difficult for OCSVM to obtain good boundaries in all regions using a global kernel parameter. To address the above two issues, in this article, we propose a hybrid algorithm incorporating vector quantization and OCSVM (VQ-OCSVM). Specifically, vector quantization is used to extract distribution information of normal data, and the results are used to construct an explicit mapping function to map data into a high-dimensional feature space. Then, OCSVM is performed in the feature space to build a classifier. By introducing the explicit mapping into OCSVM, the proposed method can effectively bypass the kernel parameter selection problem of the classical OCSVM method. Furthermore, the constructed mapping carries the data distribution information, and the VQ-OCSVM model can be regarded as an integration of generative learning and discriminative learning. The complementary properties of these two paradigms make the proposed VQ-OCSVM algorithm have better generalization capacity for complex data distribution. Both qualitative and quantitative experimental results demonstrate the effectiveness and advantages of the proposed method.

Anomaly Detection for Industrial Control Operations with Optimized ABC–SVM and Weighted Function Code Correlation Analysis

Machine Learning for Cyber Security: Third International Conference, ML4CS 2020, Guangzhou, China, October 8–10, 2020, Proceedings, Part II

An Improved Support Vector Machine Attack Detection Algorithm for Industry Controls System

Cross-domain Anomaly Detection for Power Industrial Control System

Function-Aware Anomaly Detection Based on Wavelet Neural Network for Industrial Control Communication

Recent Advances in Machine Learning-based Anomaly Detection for Industrial Control Networks

Compared Insights on Machine-Learning Anomaly Detection for Process Control Feature

Anomaly-based Intrusion Detection in Industrial Data with SVM and Random Forests

Event-Based Anomaly Detection for Non-Public Industrial Communication Protocols in SDN-Based Control Systems

Extracting Function-Driven Tracing Characteristics for Optimized SVM Classification

Evaluation of Machine Learning-based Anomaly Detection Algorithms on an Industrial Modbus/TCP Data Set

Anomaly Detection for Industrial Control Networks using Machine Learning with the help from the Inter-Arrival Curves

Anomaly-Based Network Intrusion Detection Using SVM

A Hybrid Algorithm Incorporating Vector Quantization and One-Class Support Vector Machine for Industrial Anomaly Detection

Instruction Detection in SCADA/Modbus Network Based on Machine Learning

State-Based Control Feature Extraction for Effective Anomaly Detection in Process Industries

Time Series Anomaly Detection for ICS via Multidimensional Features and Spectral Residuals

Design And Analysis Of Multimodel-Based Anomaly Intrusion Detection Systems In Industrial Process Automation

Anomaly Detection Scheme Using Time Series Analysis for Industrial Control Systems

A Real Time IDSs Based on Artificial Bee Colony-support Vector Machine Algorithm

Functional Pattern-Related Anomaly Detection Approach Collaborating Binary Segmentation with Finite State Machine