# Clustering-Enhanced Domain Adaptation for Cross-Domain Intrusion Detection in Industrial Control Systems

arXiv: https://arxiv.org/abs/2604.12183 · HTML: https://mlsanity.com/paper/2604.12183/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 16 of its 35 references that are in the map.
- First posted on arXiv 14 Apr 2026.

## Builds on (most cited first, 16 of 16)

- [Domain-Adversarial Training of Neural Networks](https://mlsanity.com/paper/1505.07818/) (2015)
- [Unsupervised Deep Probabilistic Approach for Partial Point Cloud Registration](https://mlsanity.com/paper/2303.13290/) (2023)
- [Deep transfer learning for intrusion detection in industrial control networks: A comprehensive review](https://mlsanity.com/paper/2304.10550/) (2023)
- [Bringing Masked Autoencoders Explicit Contrastive Properties for Point Cloud Self-Supervised Learning](https://mlsanity.com/paper/2407.05862/) (2024)
- [T2TD: Text-3D Generation Model based on Prior Knowledge Guidance](https://mlsanity.com/paper/2305.15753/) (2023)
- [Machine Learning for Intrusion Detection in Industrial Control Systems: Applications, Challenges, and Recommendations](https://mlsanity.com/paper/2202.11917/) (2022)
- [UVMap-ID: A Controllable and Personalized UV Map Generative Model](https://mlsanity.com/paper/2404.14568/) (2024)
- [ZeroReg: Zero-Shot Point Cloud Registration with Foundation Models](https://mlsanity.com/paper/2312.03032/) (2023)
- [Structure Causal Models and LLMs Integration in Medical Visual Question Answering](https://mlsanity.com/paper/2505.02703/) (2025)
- [FreeInsert: Disentangled Text-Guided Object Insertion in 3D Gaussian Scene without Spatial Priors](https://mlsanity.com/paper/2505.01322/) (2025)
- [3D Shape Knowledge Graph for Cross-domain 3D Shape Retrieval](https://mlsanity.com/paper/2210.15136/) (2022)
- [Turn Fake into Real: Adversarial Head Turn Attacks Against Deepfake Detection](https://mlsanity.com/paper/2309.01104/) (2023)
- [Large Language Models for Multimodal Deformable Image Registration](https://mlsanity.com/paper/2408.10703/) (2024)
- [Fully-Geometric Cross-Attention for Point Cloud Registration](https://mlsanity.com/paper/2502.08285/) (2025)
- [Organ-Agents: Virtual Human Physiology Simulator via LLMs](https://mlsanity.com/paper/2508.14357/) (2025)
- [POCI-Diff: 3D-Layout Guided Diffusion for Controllable Synthetic Surveillance Data Generation](https://mlsanity.com/paper/2601.14056/) (2026)

## Abstract (arXiv)

Industrial control systems operate in dynamic environments where traffic distributions vary across scenarios, labeled samples are limited, and unknown attacks frequently emerge, posing significant challenges to cross-domain intrusion detection. To address this issue, this paper proposes a clustering-enhanced domain adaptation method for industrial control traffic. The framework contains two key components. First, a feature-based transfer learning module projects source and target domains into a shared latent subspace through spectral-transform-based feature alignment and iteratively reduces distribution discrepancies, enabling accurate cross-domain detection. Second, a clustering enhancement strategy combines K-Medoids clustering with PCA-based dimensionality reduction to improve cross-domain correlation estimation and reduce performance degradation caused by manual parameter tuning. Experimental results show that the proposed method significantly improves unknown attack detection. Compared with five baseline models, it increases detection accuracy by up to 49%, achieves larger gains in F-score, and demonstrates stronger stability. Moreover, the clustering enhancement strategy further boosts detection accuracy by up to 26% on representative tasks. These results suggest that the proposed method effectively alleviates data scarcity and domain shift, providing a practical solution for robust cross-domain intrusion detection in dynamic industrial environments.