Cyber-Physical Systems (CPSs) are the backbone of Industry 4.0, seamlessly integrating physical and software components for advanced automation in diverse sectors. Recent cyber incidents have shown that these systems are increasingly vulnerable to targeted attacks. Undetected attacks on CPSs can disrupt operations, compromise safety, and cause significant economic losses. Thus, anomaly-based Intrusion Detection Systems (IDSs) are essential to ensure their safety and security, especially in an unsupervised setting where manual labelling is cost-prohibitive. However, current methods encounter significant challenges with complex and evolving characteristics of data streams generated from CPSs, like high dimensionality, uncertainty, and changing patterns, often resulting in high false alarms and missed attacks. This paper introduces RDSAD, an unsupervised, robust and adaptive anomaly-based intrusion detection method tailored to effectively monitor evolving complex CPS data streams. RDSAD integrates two innovative components: Dynamic Deviation Recognition (DDR) for capturing the underlying system dynamics, and Shift-aware Model Adaptation (SMA) for adaptive model updates in response to changing patterns. Through extensive evaluations, the experimental results demonstrate the superior performance of RDSAD compared with static and streaming state-of-the-art methods. It achieved the best AUC of 0.90 and 0.88 on SWaT and WADI datasets, respectively, and it obtained efficient runtime with large data streams.

“Social emotion” in text mining refers to the emotion experienced by the reader exposed to a text, as opposed to the emotion conveyed from the author’s perspective. Mining the cause of social emotion from text is a new challenging task with a wide range of applications, but its progress is hindered by the lack of annotated datasets. In this paper, we release the first English dataset for social emotion cause. The dataset is based on a well-established corpus of Facebook posts, and it was annotated through a crowdsourcing experiment. Together with the dataset, we provide two baseline models to be used as benchmarks for future studies.

The accuracy and performance of Machine Learning (ML) models can gradually or even suddenly degrade when the underlying statistical distribution of data streams changes over time; this is known as concept drift. This phenomenon could adversely affect the IoT data management and analysis landscape that relies intensely on data-driven cognitive technologies. Therefore, concept drift should be detected immediately, which is challenging due to the increasing number of dimensional features and lack of ground truth. Its adaptive countermeasures also become difficult to design when data streams are being generated frequently and require latency-sensitive responses. The uncertainty and time dependencies characteristics of IoT data streams further intensify the complexity of concept drift management. This work proposes a reactive drift management framework named RADAR for streaming IoT applications that can simultaneously detect and react to concept drift using two novel methods: temporal discrepancy measure, and intensity-aware analyser. Collectively, these methods help to determine the adaptation decision to ensure reliable performance, thereby limiting the scope of the frequent ML model update. Experiments conducted using synthetic and real-world setups comprising end-to-end systems demonstrate that RADAR outperforms other benchmarks in achieving better improvement of the performance with the best F-score of 0.86, and obtaining efficient runtime with large data streams.

Cyber-Physical Systems (CPSs) enable Information Technology to be integrated with Operation Technology to efficiently monitor and manage the physical processes of various critical infrastructures. Recent incidents in cyber ecosystems have shown that CPSs are becoming increasingly vulnerable to complex attacks. These incidents often lead to sensing and actuation misbehaviour by illegal manipulations of data, which can severely impact the underlying physical processes of critical infrastructures. Current research acknowledges that IT-based security measures cannot entirely protect CPSs from such threats. Moreover, they are not designed to monitor the measurement level activities of physical processes, and they fail to mitigate blended cyberattacks, especially multi-stage and zero-day ones. This article addresses these limitations by proposing a framework, named UnSupervised Misbehaviour Detection (USMD), comprising a deep neural network that learns about a system's expected behaviour from data-driven representations. USMD can identify in real-time the attacks on CPSs by using the long-short term memory and Attention method for multi-sensor data. The USMD's performance is evaluated on various known data sets (i.e., ToN_IoT, SWaT, WADI and Gas pipeline datasets). The experimental results indicate that the superior performance of USMD compared with six state-of-the-art methods, which we implemented and extensively tested. USMD achieves F-scores of 0.9699 and 0.9702 on SWaT and WADI datasets, respectively.

Social emotion prediction is concerned with the prediction of the reader’s emotion when exposed to a text. In this paper, we propose a transfer learning approach to social emotion prediction, where the source task is writer’s emotion prediction, an area in which models are advanced due to the rich literature and availability of large and high-quality training datasets. We utilized a pre-trained writer’s emotion prediction model to predict the writer’s emotion in comments, then we aggregated the emotions and trained a classifier to predict social emotion for posts. Results show that pre-trained models for writer’s emotion prediction can improve the prediction of social emotion. Furthermore, we demonstrate that our proposed model outperforms popular models in terms of F1-score and performs similarly to the best model in terms of Acc@1.