用联合聚类建模多模态正常行为，提升工业系统隐性异常检测能力。
Modeling Normal Is All You Need: Joint Latent Clustering for Anomaly Detection in Multimodal Cyber-Physical Systems
- 将正常状态视为多种不平衡运行模式的并集，联合学习潜在空间与高斯混合聚类。
- 在真实工业系统上实现最高AUROC（SWaT达0.993），对隐蔽故障提升显著。
- 适合检测重建正确但概率极低的隐蔽异常，尤其适用于复杂耦合系统。
网络物理系统（CPS）可能进入一种单个传感器读数均正常且可准确重构的状态，但在整体协同运行下却极不可能出现。这暴露了基于重构的检测方法的核心缺陷：它衡量的是状态是否可重现（可达性），而非正常运行是否可能占据该状态（概率性）。本文将正常行为建模为多个不均衡运行模式的并集，提出十项假设构成大规模、隐式、不均衡多模态（MIIM）框架。所提检测器LatAD联合学习潜在表示与高斯混合聚类（基于VaDE），通过密度评分而非重构来识别异常。由于CPS由多个耦合子系统组成，我们对相关性社区进行密度分解，并使用耦合加权、稀疏自适应统计量融合各子系统异常度，使局部故障不会被全局密度稀释。在三个真实CPS基准测试中，经原始点级指标和困难子集划分验证，LatAD在WADI（AUROC 0.862）、HAI（0.949）、SWaT（0.993）上均取得最优表现，尤其在困难子集上领先显著（如HAI达0.849，比次优基线高0.09，95%置信区间[0.046, 0.160]）；而基于重构的USAD与TranAD在这些可重构但低概率故障上性能骤降至0.30-0.48。
原文摘要 · Abstract (English)
A cyber-physical system (CPS) can enter a faulty state that is individually normal on every sensor and reconstructs accurately, yet is improbable under normal joint operation. This exposes the central weakness of reconstruction-based detection: reconstruction measures whether a state can be reproduced (reachability), not whether normal operation is likely to occupy it (probability). We model CPS normal behavior as a union of many imbalanced operating regimes, ten assumptions we call Massive, Implicit, Imbalanced Multimodality (MIIM). Our detector, LatAD, jointly learns a latent and a Gaussian-mixture clustering of these regimes (VaDE) and scores anomalies by density rather than reconstruction. Because a CPS is an assembly of coupled subsystems, we factorize that density over correlation-community subsystems and combine per-community surprises by a cohesion-weighted, sparsity-adaptive statistic, concentrating a local fault a global density dilutes. Evaluated with raw point-wise metrics and a difficulty split isolating the stealthy faults a per-channel threshold misses, LatAD attains the best AUROC on three real CPS benchmarks (WADI 0.862, HAI 0.949, SWaT 0.993) and leads the difficult subset of all three, notably on HAI (0.849; a significant +0.09 over the next-best baseline, 95% CI [0.046, 0.160]); the reconstruction-based USAD and TranAD fall to 0.30-0.48 on these reconstructable-but-improbable faults.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。