PaperlayerView exact revision on arXiv

Source-linked AI summary

Time Series Anomaly Detection for Cyber-Physical Systems via Neural System Identification and Bayesian Filtering

Cheng Feng, Pengwei Tian

arXiv:2106.07992v2cs.LGcs.CRstat.ML

TL;DR

CPS anomaly detectors must handle complex system dynamics and uncertain sensor noise, which challenge reliable detection. NSIBF learns a state-space model with a specialized neural network and applies Bayesian filtering to track hidden-state uncertainty. The authors report improved anomaly-detection metrics against state-of-the-art methods in simulated and real-world CPS experiments.

  • Problem

    CPS anomaly detection must identify abnormal operation amid complex system dynamics and uncertain sensor noise.

    Source: §1 · p. 1

  • Method

    NSIBF learns CPS dynamics as a state-space model with a specialized neural network, then applies Bayesian filtering to track hidden-state uncertainty and estimate measurement likelihoods.

    Source: §1 · p. 2

  • Results

    NSIBF improves anomaly-detection metrics over state-of-the-art methods in a simulated CPS example and on three real-world CPS datasets.

    Source: §7 · p. 8

  • Takeaways & Limitations

    The experiments support combining neural system identification with Bayesian filtering for anomaly detection in noisy CPS data.

    Source: §1 · p. 2, §7 · p. 8

    The filtering method assumes Gaussian hidden-state distributions, and its prediction and reconstruction error covariances are empirically estimated from validation data.

    Source: §3.2 · p. 3, §3.1 · p. 3

Abstract

from arXiv · show

Recent advances in AIoT technologies have led to an increasing popularity of utilizing machine learning algorithms to detect operational failures for cyber-physical systems (CPS). In its basic form, an anomaly detection module monitors the sensor measurements and actuator states from the physical plant, and detects anomalies in these measurements to identify abnormal operation status. Nevertheless, building effective anomaly detection models for CPS is rather challenging as the model has to accurately detect anomalies in presence of highly complicated system dynamics and unknown amount of sensor noise. In this work, we propose a novel time series anomaly detection method called Neural System Identification and Bayesian Filtering (NSIBF) in which a specially crafted neural network architecture is posed for system identification, i.e., capturing the dynamics of CPS in a dynamical state-space model; then a Bayesian filtering algorithm is naturally applied on top of the "identified" state-space model for robust anomaly detection by tracking the uncertainty of the hidden state of the system recursively over time. We provide qualitative as well as quantitative experiments with the proposed method on a synthetic and three real-world CPS datasets, showing that NSIBF compares favorably to the state-of-the-art methods with considerable improvements on anomaly detection in CPS.

1 INTRODUCTION

CPS anomaly detection matters because early warnings can support timely interventions, but complex dynamics and unstable noise challenge data-driven detection. NSIBF combines neural system identification with Bayesian filtering and is reported to outperform state-of-the-art methods across CPS experiments.

1 INTRODUCTION

  • Traditional manually crafted rules are insufficient for increasingly complex CPS, motivating data-driven anomaly detection for critical infrastructure monitoring.Early detection can support fault checking, predictive maintenance, or shutdown to avoid potential economic and environmental losses.Source: §1 · p. 1
  • Residual-error methods flag deviations between observed and predicted or reconstructed measurements, but robust thresholds are difficult to define under unstable CPS sensor and process noise.State-estimation methods can track uncertainty, although their domain-knowledge demands and limited generality restrict practical applicability; deep density-based approaches still need further study on CPS data.Source: §1 · pp. 1–2
  • NSIBF combines a specialized neural network for CPS state-space system identification with Bayesian filtering that tracks hidden-state uncertainty and estimates measurement likelihoods over time.The authors report experiments on a synthetic and three real-world CPS datasets, with superior performance against state-of-the-art methods.Source: §1 · p. 2
  • The paper reports consistently better CPS anomaly detection than state-of-the-art methods and provides data and code for reproducibility.The experiments include qualitative and quantitative evaluations on a synthetic example and three real-world datasets.Source: §1 · p. 2

2 BACKGROUND

CPS anomaly detection commonly models hidden system states and uses Bayesian filtering to compare observed measurements with predictions. Traditional state-space methods, however, can require substantial domain knowledge and may not capture the dynamics of complex modern CPS.

2 BACKGROUND

  • A state-space model represents hidden system states, control inputs, and sensor measurements, while Bayesian filters recursively estimate state distributions and support anomaly alerts from residuals or low measurement likelihood.The model uses prior sensor measurements and actuator states to predict the current hidden state and corresponding measurement distribution.Source: §2 · p. 2
  • Building a state-space model through system identification is challenging because it requires substantial prior knowledge of system dynamics.Security, privacy, and technical constraints can also prevent anomaly detectors from accessing system control logic.Source: §2 · p. 2
  • Traditional domain-defined state-space models may fail to capture the complex dynamics of increasingly large and complex modern CPS.CPS monitoring uses sensor measurements and actuator states, with sensors measuring physical parameters and actuators changing physical states in response to control commands.Source: §2 · pp. 2–3

3 NEURAL SYSTEM IDENTIFICATION AND BAYESIAN FILTERING

NSIBF learns a nonlinear CPS state-space model with a specialized neural architecture, then applies Bayesian filtering to track hidden-state uncertainty and score observed measurements. Its prediction and update steps recursively estimate state distributions and detect anomalies; the procedure can also operate at sequence level.

3.1 Neural System Identification

  • The system-identification network encodes sensor readings, predicts hidden-state transitions from a sensor-and-actuator history window, and decodes hidden states into measurements.The paired measurement decoders share parameters, and the network is trained end-to-end using normal data with reconstruction, prediction, and hidden-state smoothness loss terms.Source: §3.1 · p. 3
  • Neural system identification replaces state-transition and measurement matrices with learned networks, while prediction and reconstruction errors represent process and sensor noise.The error covariance matrices Q and R are empirically estimated from validation data under zero-mean multivariate Gaussian error assumptions.Source: §3.1 · p. 3

3.2 Bayesian Filtering and Anomaly Detection

  • The Bayesian filtering stage recursively tracks hidden-state distributions and estimates the likelihood of observed measurements, assuming multivariate Gaussian hidden states.The method is inspired by unscented Kalman filtering for nonlinear state-space models.Source: §3.2 · p. 3

3.2.1 The prediction step.

  • In the prediction step, sigma points represent the prior hidden-state distribution and pass through the learned transition network to estimate the next-state mean and covariance.The prediction mean and covariance become the prior distribution for the current time step.Source: §3.2.1 · pp. 3–4

3.2.2 The update and anomaly detection step.

  • In the update step, predicted hidden states are decoded into sensor measurements, whose predicted distribution yields a Mahalanobis-distance anomaly score before the Kalman update fuses observations into the posterior state.Larger scores indicate greater anomaly likelihood, and the threshold can be tuned using an acceptable false-alarm rate or mean time between false alarms.Source: §3.2.2 · p. 4

3.3 Algorithm and Implementation

  • The algorithm trains on anomaly-free CPS data, estimates Q and R from validation data, and then recursively predicts distributions, scores observations, and updates hidden states.Sequence-level detection is also possible by stacking consecutive sensor measurements as the gnet input, thereby encoding temporal features in learned hidden states.Source: §3.3 · p. 5

4 QUALITATIVE EXPERIMENTS

A noisy sine-wave CPS simulation tests whether Bayesian filtering improves anomaly detection over residual-error methods. NSIBF scores detect injected anomalies more readily than reconstruction and prediction residuals.

4 QUALITATIVE EXPERIMENTS

  • The qualitative CPS experiment simulates a noisy sine wave whose actuator state controls sinusoid frequency, with u0 = 3, process noise N(0, 0.12), measurement noise N(0, 0.22), over 10,000 time points.Source: §4 · p. 5
  • Testing anomalies occur in consecutive 100-point intervals every 1,000 points, with increased process noise during anomalous periods.The anomalous-period process noise is sampled from N(0, 0.6^2).Source: §4 · p. 5
  • The model is trained on the first 7,500 training points, with the remaining 2,500 used for validation, and detects anomalies at sequence level.It compresses 31-point measurement windows to a two-dimensional hidden state, predicts the next 31 points, and reconstructs current and future measurements.Source: §4 · p. 5
  • NSIBF detects injected anomalies more readily than reconstruction- and prediction-residual methods in the noisy sine-wave experiment.The authors attribute this to density-based detection and Bayesian filtering that tracks hidden-state uncertainty amid noise.Source: §4 · p. 5

5 QUANTITATIVE EXPERIMENTS

The quantitative experiments compare NSIBF with anomaly-detection baselines on three real-world CPS datasets. They also use uniform negative sampling to tune hyperparameters without labeled anomalies, and report point-adjusted F1 results.

5.1 Datasets

  • PUMP, WADI, and SWAT represent a water pump, an urban water-distribution testbed, and a water-treatment testbed, respectively.WADI's last day is excluded because its operational-mode change yields a different distribution; WADI and SWAT are downsampled to five-second intervals. Anomalies occur only in expert-labeled test data.Source: §5.1 · p. 6

5.2 Baseline Anomaly Detection Methods

  • The baselines include isolation-based, reconstruction- and prediction-residual, and density-based anomaly detectors.Non-time-series baselines and NSIBF receive stacked measurements; the stack covers five time points for PUMP and 12 for WADI and SWAT.Source: §5.2 · p. 6

5.4 Evaluation Metrics and Results

  • NSIBF improves F1 by 2.9% on PUMP, 3.7% on WADI, and 7.6% on SWAT compared with the second-best methods, and significantly outperforms NSIBF-RECON and NSIBF-PRED on all three datasets.Source: §5.4 · p. 8

5.3 Uniform Negative Sampling for Guiding Hyperparameter Tuning

  • Uniform negative sampling creates synthetic anomalies from normal-only validation data to guide NSIBF hyperparameter tuning.The method samples values beyond each dimension's normal-data extrema and selects the hyperparameters with the best overall performance on 20 generated datasets.Source: §5.3 · p. 7

5.4 Evaluation Metrics and Results

  • Evaluation selects the best point-adjusted F1 by enumerating anomaly thresholds, treating a contiguous anomalous segment as detected when any point is flagged.The paper favors this segment-level metric over point-wise metrics.Source: §5.4 · p. 8

6 RELATED WORK

Related work includes residual-error methods, system-specific semi-data-driven approaches, and deep neural state-space models. NSIBF distinguishes itself by explicitly separating neural system identification from Bayesian filtering.

6 RELATED WORK

  • Residual-error detection is common in deep learning for CPS, using prediction or reconstruction errors from recurrent networks and autoencoders.The paper reports that NSIBF achieves better anomaly-detection performance than these commonly used residual-error methods.Source: §6 · p. 8
  • Invariant-rule and noise-fingerprint approaches are system-specific, whereas NSIBF is data-driven and does not require case-specific domain knowledge.The paper characterizes NSIBF as having greater generality and lower implementation difficulty than those methods.Source: §6 · p. 8
  • Earlier deep state-space approaches implicitly combine model specification and Bayesian filtering in the neural network; NSIBF explicitly decouples these steps.The authors state this lets the framework capture process and sensor measurement noise in CPS.Source: §6 · p. 8

7 CONCLUSION

NSIBF learns CPS dynamics and detects time-series anomalies, with improvements on anomaly-detection metrics reported across a simulated example and three real-world CPS datasets.

  • NSIBF improves anomaly-detection metrics compared with various state-of-the-art methods in the reported experiments.The conclusion describes improvements but gives no metric values here.Source: §7 · p. 8
  • The evaluation includes a qualitative simulated CPS experiment and quantitative experiments on three real-world CPS datasets.Source: §7 · p. 8
  • The authors describe NSIBF as highly generalizable and easy to implement, with potential for IoT use cases involving increasingly ubiquitous CPS.Source: §7 · p. 8

A BASELINE IMPLEMENTATIONS

The baselines combine implementations taken from existing repositories with several methods implemented by the authors; experiments ran on a specified Linux workstation.

B HYPERPARAMETER CONFIGURATIONS OF NSIBF

The appendix lists shared weighting and architecture-search settings alongside dataset-specific sequence lengths and latent-dimension ranges for NSIBF.

Related papers

Loading 2106.07992v2…