你所需要的只是对正常情况建模：多模态网络物理系统中异常检测的联合潜在聚类
Modeling Normal Is All You Need: Joint Latent Clustering for Anomaly Detection in Multimodal Cyber-Physical Systems
- Holon Institute of Technology (HIT)（霍隆技术学院）
- Afeka Academic College of Engineering（阿法卡工程学院）
机构由 AI 辅助整理，请以论文原文为准。
AI总结：
研究多模态网络物理系统异常检测，提出联合潜在聚类方法，通过MIIM假设集、公平协议及潜在评分建模正常行为，在三个真实数据集上表现优异，优于其他深度检测器。
AI中文摘要：
网络物理系统（CPS）中的故障极为罕见且缺乏代表性，难以刻画甚至选择模型，因此检测必须对正常行为建模。CPS正常行为由多个不平衡、弯曲、边缘狭窄的运行状态组成，即大规模、隐式、不平衡多模态（MIIM）。本文提出用联合学习的潜在表示和显式高斯混合模式聚类对正常规律建模，在潜在空间中评分，采用公平协议评估。在三个真实CPS数据集上，该检测器表现出色，优于其他深度检测器，证明了方法的有效性。方法贡献包括MIIM假设集、公平协议和仅基于潜在的评分。
英文摘要：
A cyber-physical system (CPS) can enter a faulty state that is individually normal on every sensor and reconstructs accurately, yet is improbable under normal joint operation. This exposes the central weakness of reconstruction-based detection: reconstruction measures whether a state can be reproduced (reachability), not whether normal operation is likely to occupy it (probability). We model CPS normal behavior as a union of many imbalanced operating regimes, ten assumptions we call Massive, Implicit, Imbalanced Multimodality (MIIM). Our detector, LatAD, jointly learns a latent and a Gaussian-mixture clustering of these regimes (VaDE) and scores anomalies by density rather than reconstruction. Because a CPS is an assembly of coupled subsystems, we factorize that density over correlation-community subsystems and combine per-community surprises by a cohesion-weighted, sparsity-adaptive statistic, concentrating a local fault a global density dilutes. Evaluated with raw point-wise metrics and a difficulty split isolating the stealthy faults a per-channel threshold misses, LatAD attains the best AUROC on three real CPS benchmarks (WADI 0.862, HAI 0.949, SWaT 0.993) and leads the difficult subset of all three, notably on HAI (0.849; a significant +0.09 over the next-best baseline, 95% CI [0.046, 0.160]); the reconstruction-based USAD and TranAD fall to 0.30-0.48 on these reconstructable-but-improbable faults.
