Cross-Plant Few-Shot Attack Recognition and Detection in Industrial Control Systems

Intrusion detectors for industrial control systems are trained on the few testbeds that provide labelled attacks and then applied to plants with different sensors and processes. This study evaluates bidirectional few-shot transfer between the SWaT and WADI water testbeds, with attack identities separated across episodic splits, chronologically separated detection streams, and no gradient updates on the target plant. Cross-plant recognition reached macro-F1 scores of 0.8625 for SWaT to WADI and 0.8528 for WADI to SWaT from five labelled windows per class, but a randomly initialised encoder of the same architecture did not differ detectably on identical episodes, so these values reflect the episodic task more than the transferred representation. Detection depended on the scoring rule and on the target plant. With SWaT as the target, replacing centroid scoring with a local-neighbourhood rule raised ROC-AUC from 0.402 to 0.742 and from 0.528 to 0.797 with an untrained encoder; as the normal reference grew from one to 500 windows, the local rule rose from 0.495 to 0.805 while the centroid fell to 0.397, consistent with the mean of multimodal normal operation lying between operating states. From SWaT to WADI, neither rule exceeded chance. Cross-plant results on these benchmarks should be reported against reference conditions that carry no transferred information.