  Deep Learning is emerging as an effective technique to detect sophisticated
cyber-attacks targeting Industrial Control Systems (ICSs). The conventional
approach to detection in literature is to learn the "normal" behaviour of the
system, to be then able to label noteworthy deviations from it as anomalies.
However, during operations, ICSs inevitably and continuously evolve their
behaviour, due to e.g., replacement of devices, workflow modifications, or
other reasons. As a consequence, the accuracy of the anomaly detection process
may be dramatically affected with a considerable amount of false alarms being
generated. This paper presents DAICS, a novel deep learning framework with a
modular design to fit in large ICSs. The key component of the framework is a
2-branch neural network that learns the changes in the ICS behaviour with a
small number of data samples and a few gradient updates. This is supported by
an automatic tuning mechanism of the detection threshold that takes into
account the changes in the prediction error under normal operating conditions.
In this regard, no specialised human intervention is needed to update the other
parameters of the system. DAICS has been evaluated using publicly available
datasets and shows an increased detection rate and accuracy compared to state
of the art approaches, as well as higher robustness to additive noise.
