  The prevalence of networked sensors and actuators in many real-world systems
such as smart buildings, factories, power plants, and data centers generate
substantial amounts of multivariate time series data for these systems. The
rich sensor data can be continuously monitored for intrusion events through
anomaly detection. However, conventional threshold-based anomaly detection
methods are inadequate due to the dynamic complexities of these systems, while
supervised machine learning methods are unable to exploit the large amounts of
data due to the lack of labeled data. On the other hand, current unsupervised
machine learning approaches have not fully exploited the spatial-temporal
correlation and other dependencies amongst the multiple variables
(sensors/actuators) in the system for detecting anomalies. In this work, we
propose an unsupervised multivariate anomaly detection method based on
Generative Adversarial Networks (GANs). Instead of treating each data stream
independently, our proposed MAD-GAN framework considers the entire variable set
concurrently to capture the latent interactions amongst the variables. We also
fully exploit both the generator and discriminator produced by the GAN, using a
novel anomaly score called DR-score to detect anomalies by discrimination and
reconstruction. We have tested our proposed MAD-GAN using two recent datasets
collected from real-world CPS: the Secure Water Treatment (SWaT) and the Water
Distribution (WADI) datasets. Our experimental results showed that the proposed
MAD-GAN is effective in reporting anomalies caused by various cyber-intrusions
compared in these complex real-world systems.
