ADIMPL: a dynamic, real-time and robustness attack detection model for industrial cyber-physical systems based on improved meta pseudo labels

While the introduction of networking has increased the efficiency of Industrial Cyber-Physical Systems (ICPS), it has also lowered the cost for attackers, significantly increasing security risks. Current research on ICPS attack detection focuses on deep learning methods. However, the dependence on large labeled datasets often hinders these systems from adapting quickly to the dynamic changes and real-time demands of the ICPS environment. To address these issues, we present an attack detection method based on improved meta pseudo label (ADIMPL). ADIMPL innovatively combines two-layer network traffic feature extraction with the compact SqueezeNet deep neural network, achieving high performance with a minimal number of labeled samples. Additionally, the method dynamically adapts to changing attack patterns, significantly increasing detection accuracy while enhancing the robustness and real-time processing capabilities of the detection system. Extensive experiments on real-world industrial CPS datasets (CIC-IDS2017, CIC-IDS2018, and the CIC-Attack Dataset 2023) demonstrate that ADIMPL can effectively, robustly, and in real-time detect network attacks against industrial CPS. Notably, ADIMPL achieves a detection accuracy of 99.13% with an average latency of 0.098 s and maintains a minimum attack detection accuracy of 91.99% even under our proposed GAN+OPSO malicious attacks.