MENDEL: Time series anomaly detection using transfer learning for industrial control systems

Machine learning is commonly used to detect anomalies in industrial control systems (ICS). In general, building an anomaly detection model requires massive training data and computational resources. Therefore, an ideal solution is to use a pre-trained model instead of building each model completely from scratch. However, we cannot directly use a pre-trained model because each ICS dataset has its own unique features and characteristics. This paper proposes a practical transfer learning technique dubbed MENDEL (tiMe sEries aNomaly Detection using transfEr Learning) to efficiently build anomaly detection models, respectively, for different ICS domains. MENDEL first applies principal components analysis (PCA) to each model to obtain a fixed number of reduced features compatible with other models and then finds a reasonable mapping between different models' reduced features systemically for effective transfer learning. We evaluate the performance of MENDEL on two datasets (SWaT and WADI) with two models (InterFusion and USAD). Our evaluation results show that MENDEL can overall achieve high F1 scores even when a model is retrained with only a small proportion of the training dataset. For example, when we first train InterFusion with the SWaT train dataset and then retrain the trained model with only 10% of the entire WADI train dataset, the retrained InterFusion achieves an F1 score of 72%, which is better than an F1 score of 44% achieved by InterFusion with the entire SWAT training dataset.