# iADCPS: Time Series Anomaly Detection for Evolving Cyber-physical Systems via Incremental Meta-learning

arXiv: https://arxiv.org/abs/2504.04374 · HTML: https://mlsanity.com/paper/2504.04374/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 22 of its 52 references that are in the map.
- First posted on arXiv 6 Apr 2025.

## Builds on (most cited first, 22 of 22)

- [Model-Agnostic Meta-Learning for Fast Adaptation of Deep Networks](https://mlsanity.com/paper/1703.03400/) (2017)
- [Detecting Spacecraft Anomalies Using LSTMs and Nonparametric Dynamic Thresholding](https://mlsanity.com/paper/1802.04431/) (2018)
- [A review on outlier/anomaly detection in time series data](https://mlsanity.com/paper/2002.04236/) (2020)
- [DCdetector: Dual Attention Contrastive Representation Learning for Time Series Anomaly Detection](https://mlsanity.com/paper/2306.10347/) (2023)
- [iTAML: An Incremental Task-Agnostic Meta-learning Approach](https://mlsanity.com/paper/2003.11652/) (2020)
- [Unsupervised Meta-Learning For Few-Shot Image Classification](https://mlsanity.com/paper/1811.11819/) (2018)
- [Incremental Object Detection via Meta-Learning](https://mlsanity.com/paper/2003.08798/) (2020)
- [Deep Anomaly Detection for Time-series Data in Industrial IoT: A Communication-Efficient On-device Federated Learning Approach](https://mlsanity.com/paper/2007.09712/) (2020)
- [Time Series Anomaly Detection for Cyber-Physical Systems via Neural System Identification and Bayesian Filtering](https://mlsanity.com/paper/2106.07992/) (2021)
- [Deep Learning-Based Anomaly Detection in Cyber-Physical Systems: Progress and Opportunities](https://mlsanity.com/paper/2003.13213/) (2020)
- [DoubleAdapt: A Meta-learning Approach to Incremental Learning for Stock Trend Forecasting](https://mlsanity.com/paper/2306.09862/) (2023)
- [Anomaly Detection for a Water Treatment System Using Unsupervised Machine Learning](https://mlsanity.com/paper/1709.05342/) (2017)
- [Learning Deep Time-index Models for Time Series Forecasting](https://mlsanity.com/paper/2207.06046/) (2022)
- [Contrastive Domain Adaptation for Time-Series via Temporal Mixup](https://mlsanity.com/paper/2212.01555/) (2022)
- [Few-Shot One-Class Classification via Meta-Learning](https://mlsanity.com/paper/2007.04146/) (2020)
- [Real-World Anomaly Detection by using Digital Twin Systems and Weakly-Supervised Learning](https://mlsanity.com/paper/2011.06296/) (2020)
- [Label-Free Multivariate Time Series Anomaly Detection](https://mlsanity.com/paper/2312.11549/) (2023)
- [Adaptive Model Pooling for Online Deep Anomaly Detection from a Complex Evolving Data Stream](https://mlsanity.com/paper/2206.04792/) (2022)
- [Cybersecurity of Industrial Cyber-Physical Systems: A Review](https://mlsanity.com/paper/2101.03564/) (2021)
- [Digital Twin-based Anomaly Detection with Curriculum Learning in Cyber-physical Systems](https://mlsanity.com/paper/2309.15995/) (2023)
- [MTS-DVGAN: Anomaly Detection in Cyber-Physical Systems using a Dual Variational Generative Adversarial Network](https://mlsanity.com/paper/2311.02378/) (2023)
- [Checking is Believing: Event-Aware Program Anomaly Detection in Cyber-Physical Systems](https://mlsanity.com/paper/1805.00074/) (2018)

## Abstract (arXiv)

Anomaly detection for cyber-physical systems (ADCPS) is crucial in identifying faults and potential attacks by analyzing the time series of sensor measurements and actuator states. However, current methods lack adaptation to data distribution shifts in both temporal and spatial dimensions as cyber-physical systems evolve. To tackle this issue, we propose an incremental meta-learning-based approach, namely iADCPS, which can continuously update the model through limited evolving normal samples to reconcile the distribution gap between evolving and historical time series. Specifically, We first introduce a temporal mixup strategy to align data for data-level generalization which is then combined with the one-class meta-learning approach for model-level generalization. Furthermore, we develop a non-parametric dynamic threshold to adaptively adjust the threshold based on the probability density of the abnormal scores without any anomaly supervision. We empirically evaluate the effectiveness of the iADCPS using three publicly available datasets PUMP, SWaT, and WADI. The experimental results demonstrate that our method achieves 99.0%, 93.1%, and 78.7% F1-Score, respectively, which outperforms the state-of-the-art (SOTA) ADCPS method, especially in the context of the evolving CPSs.