Cluster-based deep one-class classification model for anomaly detection

Younghwan Kim, Huy Kang Kim

Research output: Contribution to journalArticlepeer-review

3 Citations (Scopus)


As cyber-attacks on Cyber-Physical System (CPS) become more diverse and sophisticated, it is important to quickly detect malicious behaviors occurring in CPS. Since CPS can collect sensor data in near real time throughout the process, there have been many attempts to detect anomaly behavior through normal behavior learning from the perspective of data-driven security. However, since the CPS datasets are big data and most of the data are normal data, it has always been a great challenge to analyze the data and implement the anomaly detection model. In this paper, we propose and evaluate the Clustered Deep One-Class Classification (CD-OCC) model that combines the clustering algorithm and deep learning (DL) model using only a normal dataset for anomaly detection. We use auto-encoder to reduce the dimensions of the dataset and the K-means clustering algorithm to classify the normal data into the optimal cluster size. The DL model trains to predict clusters of normal data, and we can obtain logit values as outputs. The derived logit values are datasets that can better represent normal data in terms of knowledge distillation and are used as inputs to the OCC model. As a result of the experiment, the F1 score of the proposed model shows 0.93 and 0.83 in the SWaT and HAI dataset, respectively, and shows a significant performance improvement over other recent detectors such as Com-AE and SVM-RBF.

Original languageEnglish
Pages (from-to)903-911
Number of pages9
JournalJournal of Internet Technology
Issue number4
Publication statusPublished - 2021

Bibliographical note

Funding Information:
This work was supported by Institute of Information & communications Technology Planning & Evaluation (IITP) grant funded by the Korea government (MSIT)(No. 2018-0-00232, Cloud-based IoT Threat Autonomic Analysis and Response Technology).

Publisher Copyright:
© 2021 Taiwan Academic Network Management Committee. All rights reserved.


  • Anomaly detection
  • Clustering
  • Deep learning
  • Knowledge distillation

ASJC Scopus subject areas

  • Software
  • Computer Networks and Communications


Dive into the research topics of 'Cluster-based deep one-class classification model for anomaly detection'. Together they form a unique fingerprint.

Cite this