The rapid development of Industry 4.0 has amplified the scope and destructiveness of industrial Cyber-Physical System (CPS) by network attacks. Anomaly detection techniques are employed to identify these attacks and guarantee the normal operation of industrial CPS. However, it is still a challenging problem to cope with scenarios with few labeled samples. In this paper, we propose a few-shot anomaly detection model (FSL-PN) based on prototypical network and contrastive learning for identifying anomalies with limited labeled data from industrial CPS. Specifically, we design a contrastive loss to assist the training process of the feature extractor and learn more fine-grained features to improve the discriminative performance. Subsequently, to tackle the overfitting issue during classifying, we construct a robust cost function with a specific regularizer to enhance the generalization capability. Experimental results based on two public imbalanced datasets with few-shot settings show that the FSL-PN model can significantly improve F1 score and reduce false alarm rate (FAR) for identifying anomalous signals to guarantee the security of industrial CPS.

翻译：工业4.0的快速发展放大了网络攻击对工业信息物理系统（CPS）的影响范围与破坏性。异常检测技术被用于识别这些攻击并保障工业CPS的正常运行。然而，处理仅有少量标注样本的场景仍是一个具有挑战性的问题。本文提出一种基于原型网络和对比学习的小样本异常检测模型（FSL-PN），用于在工业CPS中利用有限标注数据识别异常。具体而言，我们设计了一种对比损失函数来辅助特征提取器的训练过程，通过学习更细粒度的特征以提升判别性能。随后，为应对分类过程中的过拟合问题，我们构建了一个带有特定正则化项的鲁棒代价函数以增强泛化能力。基于两个具有小样本设置的不平衡公共数据集的实验结果表明，FSL-PN模型能显著提升F1分数并降低识别异常信号的虚警率（FAR），从而保障工业CPS的安全性。