Industrial Rare Cyber Attack Detection Based on Federated Diffusion-Squeeze Graph Modeling

Abstract

Distributed learning applied in industrial cyber-physical systems (ICPS) is vulnerable to cyber attacks, especially rare ones. Common data-driven cyber attack detection approaches face the challenges of imbalanced data, resulting in insufficient extraction of anomalous features. To enhance the sensitivity of rare cyber attack detection in complex ICPS, we propose a federated diffusion-squeeze graph model (FedDSG). In each edge device, we construct a local diffusion-based generative module to balance rare anomalous data and construct feature graphs, which maintains information fidelity and type balance of data. To alleviate the extra computational load, we establish a graph-structured detection module based on information bottleneck (IB) to filter out redundant topological features and identify the optimal graph for modeling. In the central server, we design an aggregation strategy in the central server to consolidate a global FedDSG and the global generative module generates synthetic cyber attack data to retrain the global detection module. In addition, we verify FedDSG using public industrial datasets on the self-constructed simulation platform. The results show that FedDSG improves the efficiency of rare cyber attack detection.