用强化学习动态调阈值，提升工业系统异常检测精度
ASTRO: Adaptive Spatio-Temporal Reinforcement Optimization for GNN Powered Anomly Detection in Cyber Physical Systems
- 结合GNN与DQN，动态优化异常检测阈值
- SWaT数据集F1达0.990，WADI达0.788，领先基线近14%
- 适合大规模工业控制系统部署，可实时适应复杂环境
工业物联网（IIoT）环境中的异常检测对保护工业控制系统（ICS）和网络物理系统（CPS）免受运行时虚假数据注入等恶意攻击至关重要。传感器网络日益复杂、控制回路相互关联，使得高维时变信号中的异常行为难以识别。本文提出自适应时空强化优化框架ASTRO，首次将强化学习用于动态阈值优化。ASTRO融合图神经网络（GNN）、深度Q网络（DQN）、时序建模与多头注意力机制，持续调整决策边界以提升检测精度。GNN建模传感器间的空间关系，时序模块捕捉时间依赖性，注意力层聚焦关键时间步。模型输出连续异常分数，并通过自适应阈值转化为二分类结果，该阈值由DQN优化。在真实工业基准数据集SWaT与WADI上评估，ASTRO在SWaT上取得0.990的F1分数，在包含127个终端设备的复杂WADI数据集上达0.788，优于现有最优方法近14%。多次实验验证其一致的泛化能力与稳定性。结果表明，ASTRO是强化大规模网络物理基础设施安全的高效可扩展方案。
原文摘要 · Abstract (English)
Anomaly detection in Industrial Internet of Things (IIoT) environments is essential to protect the Industrial Control Systems (ICS) and Cyber-Physical Systems (CPS) from occuring run time false data injection and other malicious attacks. The increasing complexity of sensor networks and interconnected control loops makes it difficult to identify anomalous behavior hidden within high-dimensional and time-dependent signals. To address these challenges, this article introduces Adaptive Spatio-Temporal Reinforcement Optimization ASTRO (ASTRO), a novel anomaly detection framework that pioneers the use of reinforcement learning for dynamic threshold optimization. By integrating a Deep Q-Network (DQN) with Graph Neural Networks (GNNs), temporal modelling and a Multi-Head Attention mechanism, ASTRO continuously adapts its decision boundaries to improve detection accuracy. The GNN component models the spatial relations among sensors, Temporal model captures time series dependencies and the attention layer highlights most informative time steps. The model generates continuous anomaly scores, which are transformed into binary decisions using an adaptive threshold, optimized via a Deep Q-Network (DQN). The ASTRO approach is evaluated on two real world industrial benchmarks: the Secure Water Treatment (SWaT) and Water Distribution (WADI) datasets. The proposed model achieves an exceptional performance on the SWaT with F1 score of 0.990. Moreover, on highly complex 127 end devices WADI dataset, it secures F1 score of 0.788, outperforming state-of-the-art baselines by nearly 14%. Results across multiple runs confirm consistent generalization and stability. These experiments demonstrate that the ASTRO framework is highly practical and scalable method for strengthening the large scale cyber physical infrastructures
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。