Causal Inference-Based Adversarial Domain Adaptation for Cross-Domain Industrial Intrusion Detection

The intrusion detection system (IDS) ensures the safe and stable operation of the industrial control system (ICS). However, due to the lack of data in ICS and the influences of numerous communication protocols, the detection performance of the IDS constructed with the unbalanced dataset of ICS is limited. In this article, a causal inference-based adversarial adaptive approach is proposed to improve the detection performance. First, the data feature space mapping between cross-domain datasets is realized through causal inference. Second, the graph structure relationship and time series features contained in the data features are mined and two-dimensional. Finally, IDS is constructed through common domain-adversarial transfer learning based on high-impact features and fine-tuning based on remaining features. This method can not only construct a cross-application or cross-protocol IDS with a high F1-score for imbalanced data, but also detect some new attacks in the target domain. As for the problem of cross-domain data imbalance, the F1-scores of the trained ICS model in the two cross-domain tasks respectively reached 97.27% and 97.78%. In the detection of new attacks in the target domain, the trained ICS model achieved an average F1-score of 97% for known attacks and the best F1-scores of the two cross-domain tasks reached 90% and 56%.