MP-GAN: Cyber-Attack Detection and Localization for Cyber-Physical Systems with Multi-Process Generative Adversarial Networks*

Cyber-Physical System (CPS) integrates sensing, computation, cybernetics, and networking to control a hybrid physical system consisting of different functional subsystems, making the production process more intelligent and controllable. However, cyber-attacks during its operation will lead to abnormal system behaviors or even system breakdowns. In recent years, data-driven anomaly detection methods have been adopted to judge whether the CPS system is under cyber-attacks based on rich sensor measurements to avoid further economic losses or safety issues. However, the multi-process essence of CPS has not been adequately addressed in existing works to locate the processes or points being attacked for in-time actions. In this work, we proposed a Multi-Process Generative Adversarial Network (MP-GAN) framework to detect anomalous CPS statuses and locate cyber-attacks. Specifically, the Long-Short-Term-Memory Recurrent Neural Networks (LSTM-RNN) was adopted as the base model to capture the temporal correlation of time series distributions, and the data was transferred between latent space and data space in a bi-directional manner, which regulated the generator to generate more realistic samples and thus better grasping the underline principles of the system. Moreover, parallel generators were employed to capture system performances at different physical processes, thus localizing the attacked CPS processes. Experiments on three CPS datasets, two collected from the Secure Water Treatment (SWaT) system and one collected from the water Distribution (WADI) system, showed that the proposed MP-GAN framework effectively reported anomalies caused by various cyber-attacks inserted in these complex multiprocess CPSs, which outperforms the state-of-the-art methods and can also locate most of the detected irregularities at the corresponding stages where the attacks were inserted.