TFDPM: Attack detection for cyber–physical systems with diffusion probabilistic models

With the development of AIoT, data-driven attack detection methods for cyber–physical systems (CPSs) have attracted lots of attention. However, existing methods usually adopt tractable distributions to approximate data distributions, which are unsuitable for complex systems. Besides, the correlation of the data in different channels does not attract sufficient attention. To address these issues, we use energy-based generative models, which are less restrictive in functional forms of the data distribution. In addition, graph neural networks are used to explicitly model the correlation of the data in different channels. In this paper, a general framework called Temporal pattern and Feature pattern-based Diffusion Probabilistic Model (TFDPM) is proposed for attack detection tasks in CPSs. Temporal pattern and feature pattern are simultaneously extracted given the historical data at first. To obtain predicted values, extracted features are sent to a conditional diffusion probabilistic model. Attacks are detected based on the difference between predicted values and observed values. In addition, to realize real-time detection, a conditional noise scheduling network is proposed to accelerate the prediction process. Experimental results show that the performance of TFDPM is up to about 4% higher than the existing state-of-the-art method. The noise scheduling network increases the detection speed up to 3 times without reducing the performance of TFDPM.