  Deep generative models are promising in detecting novel cyber-physical
attacks, mitigating the vulnerability of Cyber-physical systems (CPSs) without
relying on labeled information. Nonetheless, these generative models face
challenges in identifying attack behaviors that closely resemble normal data,
or deviate from the normal data distribution but are in close proximity to the
manifold of the normal cluster in latent space. To tackle this problem, this
article proposes a novel unsupervised dual variational generative adversarial
model named MST-DVGAN, to perform anomaly detection in multivariate time series
data for CPS security. The central concept is to enhance the model's
discriminative capability by widening the distinction between reconstructed
abnormal samples and their normal counterparts. Specifically, we propose an
augmented module by imposing contrastive constraints on the reconstruction
process to obtain a more compact embedding. Then, by exploiting the
distribution property and modeling the normal patterns of multivariate time
series, a variational autoencoder is introduced to force the generative
adversarial network (GAN) to generate diverse samples. Furthermore, two
augmented loss functions are designed to extract essential characteristics in a
self-supervised manner through mutual guidance between the augmented samples
and original samples. Finally, a specific feature center loss is introduced for
the generator network to enhance its stability. Empirical experiments are
conducted on three public datasets, namely SWAT, WADI and NSL_KDD. Comparing
with the state-of-the-art methods, the evaluation results show that the
proposed MTS-DVGAN is more stable and can achieve consistent performance
improvement.
