Exploiting Time Dynamics for One-Class and Open-Set Anomaly Detection

In this paper we describe and compare multiple one-class anomaly detection methods for Cyber-Physical Systems (CPS) that can be trained with data collected only during normal behaviors. We also consider the problem of detecting which group of sensors is most affected by the anomalous situation solving an open-set classification task. The proposed methods are domain independent and are based on a temporal analysis of data collected by the system. More specifically, we use different flavours of deep learning architectures, including recurrent neural networks (RNN), temporal convolutional networks (TCN), and autoencoders. Experimental results are conducted in three different scenarios with publicly available datasets: social robots, autonomous boats and water treatment plants (SWaT dataset). Quantitative results on these datasets show that our approach achieves comparable results with respect to state of the art approaches and promising results for open-set classification.