Zero-Shot Cross-Domain Anomaly Detection for Water ICS: A PLC-Based Dataset and Transfer Learning Evaluation Across Heterogeneous Benchmarks

Abstract

This study proposes a zero-shot cross-domain intrusion detection framework for industrial control systems (ICS) using a canonical feature representation and domain-adversarial learning. While prior approaches relied on labeled target data, the proposed method generalizes across heterogeneous SCADA datasets without target supervision. Our experimental results across SWaT, BATADAL, Mississippi, and HAI datasets show that our proposed approach outperforms traditional unsupervised baselines. Specifically, PCA-based detection achieves a ROC-AUC of 0.84 on SWaT and 0.63 on Mississippi, compared to near-random performance (0.50 ROC-AUC, 0 F1-score) for Isolation Forest and One-Class SVM due to threshold calibration limitations. A two category negative transfer taxonomy is introduced to explain performance degradation under domain divergence, and domain-adversarial analysis confirms domain-invariant representations with accuracy converging to chance level. These findings highlight the robustness of the proposed framework for real-world cross-domain ICS anomaly detection and its potential for deployment in environments with limited labeled data.