One-Class Learning on Temporal Graphs for Attack Detection in Cyber-Physical Systems

Various domains, including critical infrastructures, industry, and the private sector, deploy cyber-physical systems (CPS). These systems integrate IT and OT components and interact with the environment and therefore differ significantly from pure IT setups. However, CPS often operate as black boxes, hindering effective attack detection. Our research addresses the challenge of detecting attacks in CPS relying on network data and learning on normal behavior. We show the performance of two methods in use for attack detection without attack knowledge. We propose new memory update strategies that can be used in practice. Specifically, we optimize for temporal graphs using graph neural networks (GNN) to capture system behavior. Negative sampling helps to use one-class learning. Our results show that a temporal graph network (TGN), combined with negative sampling, is suitable for one-class learning and can be used for attack detection. Additionally, a simple heuristic suffices for detecting basic attacks. Notably, existing benchmark datasets do not adequately support one-class learning, highlighting the need for tailored evaluation.