# Securing Swarms: Cross-Domain Adaptation for ROS2-based CPS Anomaly Detection

arXiv: https://arxiv.org/abs/2508.15865 · HTML: https://mlsanity.com/paper/2508.15865/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 13 of its 27 references that are in the map.
- First posted on arXiv 20 Aug 2025.

## Builds on (most cited first, 13 of 13)

- [Unsupervised Domain Adaptation by Backpropagation](https://mlsanity.com/paper/1409.7495/) (2014)
- [Unsupervised Scalable Representation Learning for Multivariate Time Series](https://mlsanity.com/paper/1901.10738/) (2019)
- [PyOD: A Python Toolbox for Scalable Outlier Detection](https://mlsanity.com/paper/1901.01588/) (2019)
- [Robot Operating System 2: Design, Architecture, and Uses In The Wild](https://mlsanity.com/paper/2211.07752/) (2022)
- [Deep Learning for Time Series Forecasting: Tutorial and Literature Survey](https://mlsanity.com/paper/2004.10240/) (2020)
- [Contrastive Domain Adaptation](https://mlsanity.com/paper/2103.15566/) (2021)
- [Machine Learning Based Network Vulnerability Analysis of Industrial Internet of Things](https://mlsanity.com/paper/1911.05771/) (2019)
- [SROS2: Usable Cyber Security Tools for ROS 2](https://mlsanity.com/paper/2208.02615/) (2022)
- [ROSpace: Intrusion Detection Dataset for a ROS2-Based Cyber-Physical System](https://mlsanity.com/paper/2402.08468/) (2024)
- [A Joint Reconstruction-Triplet Loss Autoencoder Approach Towards Unseen Attack Detection in IoV Networks](https://mlsanity.com/paper/2505.21703/) (2025)
- [SROS: Securing ROS over the wire, in the graph, and through the kernel](https://mlsanity.com/paper/1611.07060/) (2016)
- [A Transfer Learning Framework for Anomaly Detection in Multivariate IoT Traffic Data](https://mlsanity.com/paper/2501.15365/) (2025)
- [Detection Latencies of Anomaly Detectors: An Overlooked Perspective ?](https://mlsanity.com/paper/2402.09082/) (2024)

## Abstract (arXiv)

Cyber-physical systems (CPS) are being increasingly utilized for critical applications. CPS combines sensing and computing elements, often having multi-layer designs with networking, computational, and physical interfaces, which provide them with enhanced capabilities for a variety of application scenarios. However, the combination of physical and computational elements also makes CPS more vulnerable to attacks compared to network-only systems, and the resulting impacts of CPS attacks can be substantial. Intelligent intrusion detection systems (IDS) are an effective mechanism by which CPS can be secured, but the majority of current solutions often train and validate on network traffic-only datasets, ignoring the distinct attacks that may occur on other system layers. In order to address this, we develop an adaptable CPS anomaly detection model that can detect attacks within CPS without the need for previously labeled data. To achieve this, we utilize domain adaptation techniques that allow us to transfer known attack knowledge from a network traffic-only environment to a CPS environment. We validate our approach using a state-of-the-art CPS intrusion dataset that combines network, operating system (OS), and Robot Operating System (ROS) data. Through this dataset, we are able to demonstrate the effectiveness of our model across network traffic-only and CPS environments with distinct attack types and its ability to outperform other anomaly detection methods.