Deploying an intrusion detector trained in one industrial plant to another remains difficult because Industrial Control System (ICS) traffic is highly site-dependent, labels are scarce, and unseen attacks often appear after deployment. To address this challenge, this paper introduces a medoid prototype alignment framework for cross-plant unknown attack detection. Instead of aligning all source and target samples directly, the method first compresses heterogeneous traffic into a comparable representation space and then extracts robust medoid prototypes that summarize local operational structure in each domain. A prototype-calibrated transfer objective is further designed to align target prototypes with source prototypes while preserving source-domain discrimination and encouraging confident target predictions. This strategy reduces noisy cross-domain matching and improves transfer stability under heterogeneous industrial conditions. Experiments conducted on natural gas and water storage control systems show that the proposed method achieves the best average performance among all compared models, reaching an average accuracy of 0.843 and an average F1-score of 0.838 across four unknown-attack transfer tasks. The analysis also shows clear transfer asymmetry between source-target directions and confirms that prototype guidance is especially helpful on challenging reverse-transfer settings. These findings suggest that medoid prototype alignment is a practical solution for robust industrial intrusion detection under domain shift.

翻译：在工业控制系统中，部署从某工厂训练得到的入侵检测器至其他工厂仍面临挑战：工业控制系统(ICS)流量高度依赖特定站点，标签稀缺，且部署后往往出现未知攻击。针对此问题，本文提出一种面向跨厂未知攻击检测的中位数原型对齐框架。该方法并非直接对齐所有源域与目标域样本，而是先将异构流量压缩至可比较的表征空间，再提取鲁棒的中位数原型以概括各域局部运行结构。进一步设计原型校准迁移目标，在保持源域判别能力并鼓励目标域高置信预测的同时，实现目标原型与源原型的对齐。该策略可降低噪声跨域匹配，提升异构工业环境下的迁移稳定性。在天然气与水存储控制系统上的实验表明，所提方法在所有对比模型中取得最佳平均性能：四个未知攻击迁移任务的平均准确率达0.843，平均F1分数达0.838。分析还揭示了源-目标方向间显著的迁移不对称性，并证实原型引导在具有挑战性的逆向迁移场景中尤为有效。这些发现表明，中位数原型对齐是域偏移下鲁棒工业入侵检测的实用解决方案。