Improving Intrusion Detection with Domain-Invariant Representation Learning in Latent Space
This addresses the problem of identifying novel threats in industrial applications, though it appears incremental as it builds on domain generalization concepts.
The paper tackles zero-day anomaly detection by developing a multi-task representation learning technique that fuses information across domains into a domain-invariant latent space, resulting in significant improvements in detecting anomalies in unseen domains.
Zero-day anomaly detection is critical in industrial applications where novel, unforeseen threats can compromise system integrity and safety. Traditional detection systems often fail to identify these unseen anomalies due to their reliance on in-distribution data. Domain generalization addresses this gap by leveraging knowledge from multiple known domains to detect out-of-distribution events. In this work, we introduce a multi-task representation learning technique that fuses information across related domains into a unified latent space. By jointly optimizing classification, reconstruction, and mutual information regularization losses, our method learns a minimal(bottleneck), domain-invariant representation that discards spurious correlations. This latent space decorrelation enhances generalization, enabling the detection of anomalies in unseen domains. Our experimental results demonstrate significant improvements in zero-day or novel anomaly detection across diverse anomaly detection datasets.