Digital Twin-based Anomaly Detection with Curriculum Learning in
  Cyber-physical Systems
Qinghua Xu Shaukat Ali Tao Yue
Anomaly detection is critical to ensure the security of cyber-physical
systems (CPS). However, due to the increasing complexity of attacks and CPS
themselves, anomaly detection in CPS is becoming more and more challenging. In
our previous work, we proposed a digital twin-based anomaly detection method,
called ATTAIN, which takes advantage of both historical and real-time data of
CPS. However, such data vary significantly in terms of difficulty. Therefore,
similar to human learning processes, deep learning models (e.g., ATTAIN) can
benefit from an easy-to-difficult curriculum. To this end, in this paper, we
present a novel approach, named digitaL twin-based Anomaly deTecTion wIth
Curriculum lEarning (LATTICE), which extends ATTAIN by introducing curriculum
learning to optimize its learning paradigm. LATTICE attributes each sample with
a difficulty score, before being fed into a training scheduler. The training
scheduler samples batches of training data based on these difficulty scores
such that learning from easy to difficult data can be performed. To evaluate
LATTICE, we use five publicly available datasets collected from five real-world
CPS testbeds. We compare LATTICE with ATTAIN and two other state-of-the-art
anomaly detectors. Evaluation results show that LATTICE outperforms the three
baselines and ATTAIN by 0.906%-2.367% in terms of the F1 score. LATTICE also,
on average, reduces the training time of ATTAIN by 4.2% on the five datasets
and is on par with the baselines in terms of detection delay time.