Quantifying Model Uncertainty in Inverse Problems via Bayesian Deep Gradient Descent

Recent advances in reconstruction methods for inverse problems leverage powerful data-driven models, e.g., deep neural networks. These techniques have demonstrated state-of-the-art performances for several imaging tasks, but they often do not provide uncertainty on the obtained reconstructions. In this work, we develop a novel scalable data-driven knowledge-aided computational framework to quantify the model uncertainty via Bayesian neural networks. The approach builds on and extends deep gradient descent, a recently developed greedy iterative training scheme, and recasts it within a probabilistic framework. Scalability is achieved by being hybrid in the architecture: only the last layer of each block is Bayesian, while the others remain deterministic, and by being greedy in training. The framework is showcased on one representative medical imaging modality, viz. computed tomography with either sparse view or limited view data, and exhibits competitive performance with respect to state-of-the-art benchmarks, e.g., total variation, deep gradient descent and learned primal-dual.

I. INTRODUCTION
The task of reconstructing an unobservable signal or image x from a given collection of observations y that have undergone a corruption process (often following a complex forward transform) is ubiquitous in nearly all scientific disciplines, and represents an integral component of many scientific investigations. One notable feature of such a task is that the underlying problem is often ill-posed in the sense that small perturbations in the observational data y can lead to large deviations of the reconstructions, since relevant information might be damped / lost in the forward process.
The pipeline of most reconstruction procedures usually begins with deriving an accurate forward model. To cope with the inherent ill-posedness of the inverse problem, one fruitful idea is to employ regularisation techniques, either explicitly via variational regularisation or implicitly via iterative regularisation (Landweber, Gauss-Newton and EM). One prominent class of reconstruction algorithms is based on variational regularisation, which involves minimising a Tikhonov functional that consists of two terms, i.e., a fidelity term measuring the fitting quality of the model output to the observational data, and a penalty term which encodes a priori knowledge about the sought-for signal [1], [2], [3]. From a statistical standpoint, it may be viewed as the maximum a posteriori estimation of a certain posterior probability density function. During the past few decades, many hand-crafted § Equal contribution. Correspondence to riccardo.barbano.19@ucl.ac.uk. penalties / prior distributions, e.g., Sobolev smoothness, sparsity, total (generalised) variation, and anatomical priors, have been proposed, and have achieved impressive reconstructions (along with rigorous theoretical guarantees, e.g., stability, consistency and convergence rates). We refer to the class of methods that explicitly defines the forward operator and the probability distribution of the noise as knowledge-driven methods. However, for many applied inverse problems, the choice and design of a proper penalty term remains highly nontrivial and an unsuitable choice may greatly compromise the reconstruction accuracy. Furthermore, the model is often only an approximate description to the real-world physical process, and the high complexity associated with the minimisation problem can present the major computational bottleneck.
In recent years, deep learning methods have been widely employed for solving inverse problems [4], [5], [6], [7] and offer novel computational frameworks to tackle the aforementioned shortcomings of knowledge-driven approaches. There are several different strategies to use deep neural networks (DNNs) for image reconstruction, e.g., to reconstruct signals or images purely based on training data (i.e., approximating the inverse map [8]), to build effective penalty terms directly learned from the training data (or even without training data, e.g., deep image prior [9]), and to replace components of an established optimisation algorithm (e.g., gradient descent, proximal gradient iteration, primal-dual algorithm [7] and ADMM [4]) by DNNs; see the work [10] for a recent overview. Very encouraging empirical results have also been demonstrated for several classical and challenging inverse problems, e.g., image denoising [11], super-resolution [12], undersampled MRI [13], low-dose computed tomography (CT) [14] and photo-acoustic tomography [15]. Despite the extremely promising empirical results, purely data-driven approaches have some shortcomings, e.g., the need for a large amount of training data (which is infeasible to acquire at a large scale in medical applications), the lack of good interpretability of deep architectures, and the lack of robustness with respect to adversarial attacks. The unrolling approach (see e.g., [16], [17], [15], [18]) aims at combining the strengths of knowledgedriven and data-driven approaches, by explicitly incorporating the physical models (prior knowledge etc.) and exploiting the good approximation properties and expressivity of DNNs, and thus this class of methods is very promising for solving many challenging inverse problems, and has received enormous attention recently [19].
All the aforementioned works focus on producing one single reconstruction for a given set of corrupted observations, and do not provide relevant uncertainty estimates. Characterising uncertainty in DNN-based solutions to inverse problems is still in its infancy; nevertheless it remains an interesting open problem. In view of the lack of robustness of DNNs, especially in sensitive domains, e.g., medical imaging [20], uncertainty estimates provide valuable additional insights. In the context of deep learning, there are several different types of uncertainties, e.g. model uncertainty (also known as epistemic uncertainty), aleatoric uncertainty, and algorithmic uncertainty. The present work focuses on model uncertainty, which refers to the fact that for a given training dataset, there are a multitude of model configurations that can fit, each giving different predictions on the test dataset. In practice, this occurs frequently, due to the severe over-parameterisation of the DNN model. In this case, it is desirable to assess all different ways that can be used to explain the data, i.e., placing uncertainty over our model parameters [21]. Recovering such uncertainty enables conveying additional information on the confidence we have in the model prediction and is thus important for comprehensive down-stream decision making. Uncertainty quantification of inverse problems can be naturally formulated within a Bayesian framework [22]. This has also been extensively explored in recent years in deep learning, and more recently for learned inversion techniques [23], [24]. The work [23] proposes a data-driven sampling technique for exploring the posterior distribution of the inverse solution based on Wasserstein GANs. The work [24] proposes a probabilistic framework based on conditional VAEs, which potentially also allows incorporating physics, and demonstrates its performance on Gaussian and Poisson denoising. However, both works [23], [24] quantify the uncertainty inherent to the data, i.e., aleatoric uncertainty, but do not provide the uncertainty of the network that fits the data, i.e., epistemic uncertainty.
To quantify model uncertainty of a learned inversion model, one popular approach is to use Bayesian neural networks (BNNs), and to encode the model uncertainty in the network parameters (conditioned on the training data), through a probability distribution instead of a point estimator [25], [26]. However, the exact posterior and posterior predictive distributions are intractable due to the nonlinear dependency of network parameters in the likelihood function and the high-dimensionality of the parameter vector. Although Markov chain Monte Carlo (MCMC) [27] techniques are asymptotically exact, they often do not scale well on BNNs [28], and due to high parameter dimensionality, MCMC still cannot be routinely applied to inverse problems in imaging (note that however, there is important recent progress in this direction using tools from convex optimisation for the posterior distribution on the inverse solution [29]). In the literature, variational inference (VI) [30], [31] is often adopted as a practical approximate inference scheme for BNNs. Note that standard BNN implementations tend to double the number of parameters per layer [26] (e.g., mean and variance in a Gaussian mean field approximation), and consequently, VI often exhibits slow convergence which can potentially greatly compromise the network performances [32], [33]. Thus, there has been extensive research into designing practical approximate inference methods that allow easily scaling up to deep neural architectures. In particular, it has led to connections between VI and dropout [34], approaches which are referred to as Monte Carlo dropout (MCDO) schemes [35], [21]. They have shown promising empirical results in several applications but their drawbacks and poor performances were also noted in sequential decision problems [36], [37]. Thus, it is still of enormous importance to develop a scalable inference procedure providing epistemic uncertainty for the learning-based inversion techniques. In this work, we propose an efficient data-driven knowledge-aided computational framework for quantifying model uncertainty based on Bayesian DNNs for unrolling type learned inversion methods. In particular, it can be viewed as a probabilistic analogue of a recently proposed deep gradient descent [15], and hence the framework is termed as Bayesian Deep Gradient Descent (BDGD). Our main contributions are summarised as follows: • We introduce a tractable and statistically principled framework that provides the model uncertainty. This is achieved by integrating a data-driven knowledge-aided framework with the advances in BNNs and VI. • We propose a "greedy" training scheme (in a statistical context), which trains the framework block-wise, in a manner similar to deep gradient descent [15]. This allows for greatly reducing the training time. Further, we provide an interpretation of the procedure as performing a sequence of constrained variational inference problems. • Building upon [38], we further achieve computational efficiency for training a hybrid architecture where VI is only applied on a small portion of the whole network together with the greedy training scheme. The proposed framework is evaluated on CT reconstruction, from either sparse view or limited view data. The numerical results show that the approach is capable of delivering mean estimators competitive with benchmark algorithms while also providing useful uncertainty information.
The remainder of the paper is organised as follows. In Section II, we introduce the proposed framework and formalise the training and inference procedures. In Section III, we showcase the proposed framework on CT reconstruction. In Section IV, we provide concluding remarks.

II. BAYESIAN DEEP GRADIENT DESCENT A. Learning Gradient Descent
In practical reconstruction, typically iterative methods are employed to optimise the resulting Tikhonov functional. The associated minimisation problem for recovering the signal x from the measurements y is given by where D(y, Ax) is the data fidelity term, A the forward operator describing the data formation mechanism, Diagram of the CNN architecture representing one step update with the k th block. The deterministic layers with parameter φ k are colour-coded in gray. The Gaussian mean-field convolutional layer with parameter θ k is colour-coded in yellow. Note that a ReLU is applied after the summation between the skip connection and the output of the Gaussian mean-field convolutional layer.
penalty term expressing a priori knowledge on the signal x, C a constraint set, and λ ∈ R + the regularisation parameter that balances the data fidelity term and the regularisation term R(x). In unrolled iteration, one constructs a cascade of convolutional neural networks (CNNs) that mimic an iterative minimisation algorithm, and each block within the cascade learns the update for the next iteration: where f φ k denotes one block of the cascade, with φ k being the corresponding parameter vector. Note that f φ k can incorporate a feasibility projection operator P C . At each iteration, x k−1 is updated by the information passed through the gradient ∇D (y, Ax k−1 ). In this way, the reconstruction procedure recurrently incorporates the information about A and its adjoint, which often encodes various important physical laws of the inverse problem. Fig. 1 shows the network architecture of a single block, how it mimics the gradient update, and the overall cascade. The two branches within each block analyse the information of x k−1 and ∇D (y, Ax k−1 ) separately, and the analysis resulting from these two branches is then merged and further processed to give the update δx k−1 . With the skip connection and projection, the update step is done by where δx k−1 is the output of the block before the skip connection and mimics the product of step size and update direction in a gradient descent type algorithm.
By applying the blocks sequentially for K iterations, the reconstructed image is given by:

B. How to Learn in a Bayesian Framework
To provide model uncertainty for the reconstructed signal, we use Gaussian mean-field variational inference (MFVI) to Bayesian convolutional neural networks [26], and learn an approximate posterior distribution q(θ) over each block's parameters θ. Compared to vanilla deterministic DNNs, where the weights are represented by point estimates, BNNs place prior distributions over the weights, and obtain a posterior distribution via approximate inference. Thus, we replace the block's weights with distributions over the parameters [39]. To distinguish between deterministic and stochastic parameters, below we use φ and θ, respectively.
Given a training dataset where Y is the observation matrix and X is the ground truth matrix, we train the cascade using a greedy approach, i.e., block by block. One important issue is to interpret the resulting greedy scheme in a statistical context. To this end, we recursively define the prior distribution and likelihood function of Θ k := (θ 1 , . . . , θ k ) for training the k-th block. Specifically, when training the k-th block, we have already trained all blocks from f θ1 to f θ k−1 and computed the optimal approximate posterior distribution q * (Θ k−1 ). Then we define the joint prior distribution as p(Θ k ) = q * (Θ k−1 )p(θ k |Θ k−1 ), where the (conditional) prior p(θ k |Θ k−1 ) = N (0, I), and take the likelihood function to be p(x|y, Θ k ) = N (f Θ k (∇D, x 0 ), σ 2 k I), where σ 2 k is an additional trainable parameter. The variational family Q k for approximating the true posterior distribution p(Θ k |X, Y ) is chosen to be of the form q( are the variational parameters of the mean field approximation and D is the number of parameters per block. The optimal approximate posterior q * (Θ k ) is then learned by minimising the following constrained loss function over Q k , where KL(·||·) is the Kullback-Leibler divergence [40]. We employ the local reparametrization trick to compute the gradients [41], [42]. Mathematically minimising Eq. (4) is equivalent to the following constrained KL minimising problem min where p(Θ k |X, Y ) is given by Bayes' rule with likelihood function p(X|Y, Θ k ) and prior distribution p(Θ k ). It is worth noting that by its very construction, the approximate posterior distribution automatically admits a factorisation form with respect to the blocks, i.e., q * (Θ k ) = q * (θ 1 ) k i=2 q * (θ i |Θ i−1 ).

D. Practicalities in Training and Inference
Generally, VI methods need some tuning effort to perform well, especially on CNNs, otherwise they may exhibit slow convergence, which can significantly compromise accuracy [43]. Therefore, in the proposed framework, we use a composition of maps f θ k • f φ k to model the k-th block and perform variational inference on the parameters θ k 's in a greedy manner. Specifically, in the k-th block, we denote the parameters of the last layer by θ k , which is a random variable, and parameters of remaining layers in the block by φ k , which is regarded as deterministic variable, c.f., Fig. 1 (Bottom). It is worth noting that we are still optimising with respect to φ k 's. In doing so, we actually regard φ k 's as hyperparameters, use the likelihood functions with hyperparameters p Φ k (x|y, Θ k ) and for the k-th block solve for the following problem For notational simplicity, we omit the notation of Φ and, for instance, denote . Methodologically, it is equivalent to the variational family being a delta approximation (i.e., mean field with zero variance) on some network parameters but a Gaussian mean field approximation on the remaining ones. Naturally, the hybrid approach can greatly reduce the number of variational parameters, especially if the Bayesian component is only a small portion of the overall network, and the resulting cascade has an overall complexity comparable with the deterministic counterpart. The resulting construction retains the Bayesian strength for quantifying epistemic uncertainty with only slightly increased computational efforts and memory requirements. Once all the blocks in the cascade are trained, it can be used for inference. Each sampling step amounts to a feed forward propagation through the network, which is computationally very efficient (especially when compared with classical iterative reconstruction algorithms). Recall that the likelihood function of Θ K is p(x|y, Θ K ) = N (f Θ K (∇D, x 0 ), σ 2 K I), and the approximate posterior distribution is given by q * (Θ K ) = q * (θ 1 ) K k=2 q * (θ k |Θ k−1 ). One can use Monte Carlo (MC) estimators to estimate the statistics of the distribution q * (x|y) = p(x|y, Θ K )q * (Θ K )dΘ K . (11) Specifically, E q * (x|y) [x] can be estimated with the unbiased empirical estimator Moreover, the predictive variance of q * (x|y) can be estimated by where x ⊗2 = xx T . Indeed, with T samples. The training and inference procedures of our proposed framework are summarised by Algorithms 1 and 2, respectively. At the end of the training of each block, we reconstruct the next update x k with 1 MC sample and compute the gradient of the data fidelity term D, which is problem specific. In our implementation, at the inference stage, we use 100 MC samples to estimate the mean image and pixel-wise variance to compute the summarising statistics.
Remark (On the Approximate Inference's Landscape). Apart from Mean Field Variational Inference (MFVI), several other Bayesian approximate schemes have been proposed for uncertainty quantification of neural networks, e.g., MCDO [35]. These Bayesian treatments can also be used within the proposed framework as alternatives to MFVI. Note that with other Bayesian treatments, the underlying choice of prior and Algorithm 1: BDGD (Training) Input: # reconstruction steps K, dataset D, initial guess x (i) 0 1 for k ← 1 to K do 2 Construct network's input: Train the k-th network f Φ k ,θ k (∇D(y (i) , Ax k−1 ) Output: approximate posterior at each reconstruction step Algorithm 2: BDGD (Inference) Input: # reconstruction steps K, observation y, initial guess x0, trained parameters (ΦK , ΘK ), # samples S 1 Construct ∇D(y, Ax0)

Output:Ê[x] and Var[x]
thus also the approximate posterior is different. We refer to [21,Section 3.2] for the case of MCDO, which has a VI reinterpretation [21], [35], [44]. It consists in training a DNN with dropout, and also applying dropout at test time, which can be seen as approximate marginalisation.

III. EXPERIMENTAL RESULTS
We showcase the performance of BDGD on CT reconstruction, which is one of the most prominent medical imaging modalities. In (2D) CT, observations are made in the space Y ⊂ H 1 2 (R × [0, π)) which is the range of the forward operator, i.e., Radon transform, R : X → Y and X ⊂ L 2 (R 2 ), consisting of line integrals through X in ray directionsω ∈ S 1 . While the complete data problem in CT is mildly ill-posed and can be exactly reconstructed by filtered back-projection (FBP), in practice often only a subset of data is available, which can be represented by the composition A = S • R with S a subsampling of the directions Ω ⊂ [0, π). We shall consider two different cases of practical interest in the parallel beam geometry, i.e., i) sparse view and ii) limited view. Throughout, we assume that the projections contain 1% Gaussian noise. Then the data fidelity term is given by the standard squared L 2 norm, and accordingly, where the notation A denotes the (unfiltered) back-projection operator (i.e., the adjoint of A). The depth K of the cascade in BDGD is set to either 10 or 20 depending on the problem setting, and the initial guess x 0 is set to be the FBP solution.
For benchmarks, we take three approaches, i.e., total variation regularisation (TV) [45], deep gradient descent (DGD) [15], and learned primal-dual (LPD) [7]. The latter two are well-established deep unrolled iteration approaches. TV reconstruction is computed with the Chambolle-Pock algorithm, with the regularisation parameter selected via grid search. We also report results for a variant of BDGD, which uses MCDO instead of MFVI. The number of parameters (per block) is 32833, 32978, and 32833 for DGD, BDGD-MFVI and BDGD-MCDO, respectively. Meanwhile, LPD has 253220 shared parameters, and the parameters are trained simultaneously instead of greedily.
All the methods are trained on 4000 randomly generated ellipses (all of size 128×128), with the background having the lowest value 0. We train each block for 150 epochs. BDGD and the benchmarks are all implemented in Python using Operator Discretisation Library (ODL) [46], PyTorch and TensorFlow. To evaluate the operator A and its adjoint, we use the GPU accelerated ASTRA backend [47].
For validation, we construct a second ellipse dataset (Ellipses Phantoms), and also test on the Shepp-Logan (SL) phantom, one widely used medical test image. For a quantitative comparison, we use peak signal-to-noise ratio (PSNR), which is computed by averaging the numerical results over five seeds.

A. Sparse View CT
In Table I, we present numerical results for sparse view CT with 30 directions uniformly taken from 0 to π, computed with K = 10 (further increasing the cascade's depth does not lead to better reconstructions). Table I indicates that BDGD-MFVI significantly outperforms all other methods on both datasets with the only exception of LPD on the ellipses datasets. In Fig. 2, we show the reconstructions of the SL phantom, and to shed insights into the working mechanisms of BDGD, we show the mean and pixel variance after the first, fifth, and tenth block, e.g.,Ê[x 10 ] and Var[x 10 ]. It is observed that both BDGD-MFVI and BDGD-MCDO show large pixel variance at k = 1, which is reduced at k = 5. However, BDGD-MFVI shows larger pixel variance at k = 10 than at k = 5, whereas BDGD-MCDO still presents low model uncertainty. The boxplot in the left panel of Fig. 3 (Left) shows the evolution of PSNR with the number k of blocks. Interestingly, during the first few blocks, BDGD-MFVI and BDGD-MCDO perform comparably, but BDGD-MFVI allows further improvement with additional blocks.
Numerically, in BDGD-MFVI, there appear two distinct phases from a variance standpoint. In the first phase, i.e., the reconstruction phase, it gradually improves the sample quality and reduces the overall model uncertainty level. For instance, in Fig. 2, BDGD-MFVI exhibits high variance up to the first block, i.e., the reconstructions disagree the most; but as the method progresses up to the fifth block, the reconstruction shows reduced model uncertainty. In the second phase, i.e., the fine-tuning phase, it improves the sample quality and gradually reveals more uncertainty for fine details. That is, the greedy training strategy actually incrementally improves the reconstruction. Overall, BDGD-MFVI performs better than BDGD-MCDO, which, in terms of PSNR, behaves nearly identical with the deterministic one on the ellipse phantom (we do also fail to observe a fine-tuning phase), whereas on the SL phantom, BDGD-MCDO outperforms DGD, showing again the benefit of being Bayesian.

B. Limited View CT
We show results for limited view [0, 2π/3), using K = 20; see Table II for PSNR and Fig. 4 for exemplary reconstructions. Like before, BDGD outperforms the other methods on both datasets in terms of PSNR. Fig. 4 shows the reconstruction of an ellipse phantom, along with the pixel variance for BDGD (for both MFVI and MCDO). In the phantom, a larger ellipse almost blends into the background, which is is very challenging to reconstruct for all the methods under consideration. However, the presence of the ellipse is well captured by the variance in BDGD-MFVI. Thus, being Bayesian indeed allows a more thorough analysis of the reconstructed image. Note that the uncertainties by BDGD-MFVI capture far more detail about the ellipse edges than those by BDGD-MCDO, and thus are potentially more informative than the latter. The right panel of Fig. 3 (Right) shows the boxplot of the evolution of PSNR with the number of blocks, which exhibits a similar behaviour to the case of sparse view.

C. Model Uncertainty with Different Geometries and Unseen Abnormalities
One of the serious issues in CT reconstructions is possible artefacts due to insufficient information in the data. Thus, it is of much interest to have indicators on artefacts. Interestingly, BDGD can provide indicative information by allocating higher variances in related regions, cf. Fig. 5, which also includes a more challenging scenario, i.e., limited view [0, π/3). In particular, as the view angle range decreases, the magnitude and significant areas of the variance increase, flaring up potential issues with the reconstruction in relevant regions. A very similar phenomenon can be observed, in an even more striking way, in the out-of-distribution (OOD) test data. In this test, we have added the text "ICPR 2020" in the ground truth phantom, following the work [20]. Being abnormal features in the ellipses patterns, large uncertainty quantities now concentrate on the area around the text, indicating potentially serious issues in the region. This shows the benefit of having the uncertainty available in addition to the point estimate.

IV. CONCLUSION AND FUTURE WORK
In this work, we have proposed a novel data-driven knowledge-aided framework, named as Bayesian Deep Gradient Descent (BDGD), for providing model uncertainty within the learning based inversion techniques. We adopted a hybrid model with both point estimation and probabilistic treatment of network parameters, and numerically realised it using an efficient greedy training strategy in a consistent probabilistic context. The numerical results with CT show that it is competitive with state-of-the-art benchmarks. In particular, the results indicate that being Bayesian, even if only a little (one layer per block), can actually be very beneficial to the mean estimate (in terms of PSNR), while also delivering useful uncertainty estimates. There are several avenues worth further pursuing. First, it is of great interest to explore how the predictive variance information can aid the performance of a downstream processing pipeline, e.g., segmentation of reconstructed images. Secondly, in view of the outstanding performance of BDGD, it is of much interest to evaluate the significant potential of the framework on more complex medical imaging settings, e.g., photo-acoustic tomography with limited view geometry, and positron emission tomography with a low count emission level. We will explore these possibilities in future works.


A Survey of Specification-based Intrusion Detection Techniques for Cyber-Physical Systems

Cyber-physical systems (CPS) integrate computation and communication capabilities to monitor and control physical systems. Even though this integration improves the performance of the overall system and facilitates the application of CPS in several domains, it also introduces security challenges. Over the years, intrusion detection systems (IDS) have been deployed as one of the security controls for addressing these security challenges. Traditionally, there are three main approaches to IDS, namely: anomaly detection, misuse detection and specificationbased detection. However, due to the unique attributes of CPS, the traditional IDS need to be modified or completely replaced before it can be deployed for CPS. In this paper, we present a survey of specification-based intrusion detection techniques for CPS. We classify the existing specification-based intrusion detection techniques in the literature according to the following attributes: specification source, specification extraction, specification modelling, detection mechanism, detector placement and validation strategy. We also discuss the details of each attribute and describe our observations, concerns and future research directions. We argue that reducing the efforts and time needed to extract the system specification of specification-based intrusion detection techniques for CPS and verifying the correctness of the extracted system specification are open issues that must be addressed in the future. Keywords—Cyber-physical systems; intrusion detection systems; specification-based intrusion detection mechanism; security

I. INTRODUCTION
The recent years have witnessed an increasing growth in the development and deployment of different types of cyberphysical systems (CPS). CPS have shaped every aspect of our lives as their applications span through several domains including electrical power grids, water and wastewater management, oil and gas sector, traffic systems and many other domains. Considering the nature of CPS, security incidents could lead to physical harm to people, destruction of property or environmental disasters. For this reason, the secured operation of CPS is a major concern for all stakeholders.
According to Gartner analysts [1], CPS security incidents are expected to rise in the coming years due to a lack of security focus and spending that are aligned to CPS. They also observe that the liability for CPS security incidents will not only affect the corporate entity but will also lead to a personal liability for 75% of CEOs by 2024. This is a wakeup call for all those charged with the responsibility for the secured operation of CPS and for greater attention to the development and deployment of appropriate security controls for CPS.
One of the security controls for CPS involves the use of intrusion detection systems (IDS). Traditionally, there are three main approaches to IDS, namely: anomaly detection, misuse detection and specification-based detection. However, due to the unique attributes of CPS, the traditional IDS need to be modified or completely replaced before it can be deployed for CPS. A discussion of the techniques and challenges on the use of IDS in CPS have been provided by Han et al. in [2] . Our interest in this paper is to survey the use of specification-based intrusion detection techniques for CPS.
Some works in the literature have conducted surveys related to the use of IDS for CPS [3], [4], [5]. Mitchell and Chen [3] presents a survey of IDS design principles and techniques for CPS. They categorize the existing CPS IDS techniques in the literature, describe their advantages and disadvantages and suggest future research areas. Zarpelão et al. [4] also conducted a survey of IDS in Internet of Things (IoT). They classify the IDS proposed in the literature according to the following attributes: detection method, IDS placement strategy, security threat and validation strategy. A much recent survey related to the use of IDS for CPS is presented by Wu et al. [5]. They conducted a survey of the proposed IDS designs for in-vehicle networks. However, to the best of our knowledge, none of the existing surveys have considered the use of specification-based IDS for CPS.
In this paper, we present a survey of specification-based intrusion detection techniques for CPS. In particular, we classify the existing specification-based intrusion detection techniques in the literature according to the following attributes: specification source, specification extraction, specification modelling, detection mechanism, detector placement and validation strategy. We also discuss the details of each attribute and describe our observations, concerns and future research directions. We argue that reducing the efforts and time needed to extract system specification of specification-based intrusion techniques for CPS and verifying the correctness of the extracted specification are open issues that must be addressed in the future.
The rest of this paper is organised as follows. Section II presents a discussion on CPS and specification-based intrusion detection, which provides an understanding for describing the suitability of specification-based intrusion detection techniques for CPS. Section III provides a survey of specification-based intrusion detection techniques for CPS and the proposed taxonomy. Section IV describes our observations, concerns and future research directions, which is one of the most relevant contributions of this work. Section V concludes the paper.

A. Cyber-Physical Systems
CPS facilitate the integration of computation and communication capabilities to monitor and control physical systems. This enables the accomplishment of time-sensitive functions with different degrees of interaction with the environment, including human interaction [6]. As a result of this, CPS are called time-sensitive systems which makes timing a central theme in their design and implementation. CPS are also referred to as safety-critical systems because the failure of the system due to faults or other external influences, could endanger the lives of humans operating the physical systems, those embedded with the CPS (medical devices) or those within the radius of their operation (nuclear plants). The application of CPS span through several domains and they include modern vehicles, medical devices, industrial systems, etc., all with different standards, requirements, communication technologies, and time constraints.
The general architecture of CPS is depicted in Figure 1. CPS as showed in the diagram, typically have a physical system that is being monitored and controlled, a set of sensors that report the state of the physical system, a set of actuators that are used by the controllers to maintain the system in the desired state, and a set of controllers (or a controller) that monitors and controls the physical system using the sensors and actuators, and via a communication channel [7]. The interaction between these components of CPS is known to be vulnerable to cyber attacks. For example, a power station located north of the city of Kiev, Ukraine, suffered a cyber attack which blacked out a portion of the Ukrainian capital equivalent to a fifth of its total power capacity [8]. This calls for increased efforts towards addressing the security issues of CPS.
[7] There are several security challenges in the operation of CPS. These challenges can be attributed to the unique features of CPS which makes the traditional security solutions ineffective in addressing the security challenges of CPS. For example, CPS have time constraints because the physical processes are generally time-aware and deadline sensitive [9]. Also, the complexities in the analysis and design of security solutions for CPS are further exacerbated by the need to understand and address the upstream and downstream dependencies of the component systems [6]. Therefore, the current information technology (IT) security controls would have to be modified significantly or to be completely replaced because they are unable to address the security challenges of CPS.
One of the security solutions for CPS involves the use of intrusion detection systems (IDS). There are three main approaches to IDS, namely: anomaly detection, which relies on comparing current behaviour with the pre-established normal behaviour to detect an intrusion; misuse detection, which use intrusion signatures to detect an intrusion; and specificationbased detection, which depends on the monitoring of the specified system behaviour to detect an intrusion [10]. A review of the existing intrusion detection techniques for CPS has been provided by Mitchell and Chen in [3] and Han et al. in [2] discuss the techniques and challenges of intrusion detection in CPS. We are interested in the use of specificationbased IDS for CPS in this paper. The following subsections provide an in-depth discussion on specification-based IDS and its suitability for CPS, so as to motivate our survey of the existing specification-based intrusion detection techniques for CPS.

B. Specification-based Intrusion Detection
The notion of specification-based intrusion detection was first introduced by Ko et al. in [10]. It leverages the specification of a system, which describes the expected behaviour of the system. Any deviation of the system operations from the defined correct behaviour is flagged as a security violation. In general, the specification-based intrusion detection process involves the use of a specification source to extract the expected behaviour of a system, which in turn is modelled. A detection mechanism is then applied to the modelled specification for monitoring the system behaviour for any deviation. Figure 2 provides a diagrammatic illustration of the specification-based intrusion detection process.
Specification-based intrusion detection has shown to be a better approach to IDS than anomaly detection and misuse detection [11]. Even though anomaly detection is able to detect novel attacks, it suffers from a high rate of false alarm because unseen legitimate system behaviours are classified as anomalies. Misuse detection, on the other hand, does not generate false alarms but it is unable to detect novel attacks. Hence, specification-based appears to be the mean between misuse detection and anomaly detection because it combines the advantages of both approaches. Its false positive rate is similar to misuse detection as it does not generate false alarms when unusual system behaviours are discovered. Similar to anomaly detection, specification-based intrusion detection is able to detect novel attacks because it detects attacks as deviations from the defined correct system behaviours.
The use of specification-based intrusion detection spans through several domains. Initially, it was intended for execution  monitoring of security-critical programs in distributed system [10]. However, it has been applied to routing protocols such AODV [12], [13], [14] or OSLR [15], DNP3 protocol [16], [17], [18] Voice over IP [19], [20], [21] and other areas of CPS as discussed in section III. A practical experience in the use of specification-based intrusion is presented by Uppuluri and Sekar in [11]. In this work, the experiments conducted show that specification-based intrusion detection is able to detect 80% of the attacks without knowledge about the attacks or the attacker behaviour. They observe that the combination of specification-based intrusion detection with some misuse specification increases the detection ability to 100% with 0% false positive rates.
Specification-based intrusion detection can also be combined with anomaly detection. This is the method adopted by Sekar et al. in [22] and Stakhanova et al. in [23]. Sekar et al. [22] use state-machine specification in combination with information about statistics that need to be maintained to detect anomalies. They evaluate effectiveness of the approach is using 1999 Lincoln Labs intrusion detection evaluation data and the results show that the proposed intrusion detection approach detects all of the probing and denial of service attacks with a low rate false alarm. In the case of Stakhanova et al. [23] the proposed technique facilitates the automatic development of the normal and abnormal behaviour specification in a form of variable-length pattern classified using anomaly-based method. They assess the proposed technique via simulations using publicly available synthetic data and the results show that the approach can detect unknown anomalous behaviour and known anomalous behaviour with a low rate false alarm.

C. Suitability of Specification-based Intrusion Detection for Cyber-Physical Systems
There are several characteristics of CPS that makes specification-based intrusion detection the most suitable type of intrusion detection approach for CPS. One of these characteristics is the laws of physics that govern the physical systems in CPS. The IDS deployed in CPS are expected to monitor physical processes for intrusion. These physical processes are governed by the laws of physics, which makes certain behaviours of the physical systems more likely to be seen than others [3]. Thus, specification-based intrusion detection technique can be used to define these behaviours and to monitor the physical systems for any deviation from these expected behaviours.
Another feature of CPS environment is that activities are usually automated and time driven in a closed-loop settings [3]. This provides some regularity and predictability in the CPS environment which can be used for monitoring. It is different from the IT environment where activities are user triggered and users' behaviours can be very unpredictable. Consequently, the regularity and predictability of CPS environment can be exploited by specification-based intrusion detection to define the correct behaviours of the system, which is subsequently used to monitor behaviours outside the defined behaviours.
Moreover, the protocols deployed in CPS are well-known and widely used which makes it easy to extract the correct behaviour of the system. As a result of this, it is attractive to use specification-based intrusion technique for CPS. This is because the protocol specifications which are readily available can be used as specification source to extract the expected behaviour of the system. Also, specification modelling and detection mechanism can then be employed to complete the specification-based intrusion detection process.

III. SPECIFICATION-BASED INTRUSION DETECTION TECHNIQUES FOR CYBER-PHYSICAL SYSTEMS
In this section, we present a survey of specification-based intrusion detection techniques for CPS. We observe that a common feature of the specification-based intrusion detection techniques for CPS is as follows: a set of properties, which indicates the correct system behaviour is sourced, extracted and modelled; and then, a detection mechanism is used to monitor for any deviation from the defined system specification. Using this understanding, we classify the existing literature according to the following attributes: specification source, specification extraction, specification modelling, detection mechanism, detector placement and validation strategy. The proposed taxonomy of specification-based intrusion detection techniques for CPS is depicted in Figure 3 and Table I summarizes the existing works on specification-based intrusion detection techniques for CPS.

A. Specification Source
Specification source refers to how the set of properties that indicates the correct system behaviour is obtained. There are three major specification sources of specification-based intrusion detection techniques for CPS, namely: protocol specification, reference model and observed behaviour. 1) Protocol Specification: Protocol specification is a formal document that defines the expected behaviour of a system. Given the well-defined behaviour of CPS, several protocol specifications have been deployed as the specification source to describe its correct behaviour in many studies. For example, Tseng et al. in [12] utilise the Ad hoc distance Vector (AODV) routing protocol specification as specification source. Other works that have employed AODV routing protocol specification as specification source include Hansson et al. in [13] and Hassan et al. in [14].
Gil et al. in [24] have used IEEE 802.11 protocol and the extensible authentication protocol (EAP) specifications as specification source to define the desired behaviour of wireless local area network. Song et al. in [25] combine both informal protocol specification and other documents from dynamic registration and configuration protocol as specification source. The spanning tree protocol (STP) specification has been leveraged as specification source by Jieke et al. in [26] to describe the expected behaviour for carrier Ethernet network infrastructure. And Tseng et al. in [15] use H.323 protocol specification as specification source.
McParland et al. in [18] deploy protocol guidelines for both ModBus TCP and DNP3 as specification source. They abstract the specific details away of the protocols to focus on the physics models of the system. Unlike them, Lin et al. in [16] and [17] employ only DNP3 as specification source to extract the normal behaviour of the system. Further, Berthier and Sanders in [27] use C12.22 standard protocol specification as specification source to ensure that all violations of the specified security policy of the system will be captured.
The controller area network (CAN) protocol specification has been utilised by Olufowobi et al. in [28] as specification source. Larson et al. in [29] employ the CAN protocol version 2 and the CANOpen application layer draft standard 3.01 as specification source to extract the expected behaviour of electronic control unit of an in-vehicle network. Also, Esquivel-Vargas et al. in [30] exploit the Building Automation and Control Networks (BACnet) protocol as specification source to depict the normal behaviour of each device in the BACnet network.
2) Reference Model: The reference model of the system under consideration has also been employed in several studies as specification source, to obtain the correct system behaviour [31], [32], [33], [34]. Mitchell and Chen in [31] employ the reference model of a modern electrical grid CPS embedding physical components as specification source. They also use the reference model of unmanned air vehicles and reference model of medical CPS in [32] and [33] respectively as specification sources. Also, Sharma et al. in [34] utilize the reference model of unmanned air vehicles CPS as specification source.
3) Observed Behaviour: Observed behaviour of the system under consideration is another method that can be employed as specification source, to define the correct behaviour of a system. It involves the monitoring of a system during its normal operation and then using the knowledge obtained as specification source, to specify the correct behaviour of the system. For example, Pan et al. in [35] use time-synchronized data from synchrophasor and observable events from audit logs as specification source to define the correct behaviour for the cyber-physical environment in electric power system. Also, the specification source utilized by Carcono et al. in [36] is based on monitoring the evolution of the target system states.

B. Specification Extraction
Specification extraction is the method that can be deployed to extract the correct behaviour of the system using the specification source. This can either be accomplished manually or automatically.
2) Automatic: Efforts have been made in recent years to extract the correct system behaviour from the specification source automatically [30], [34], [28]. Esquivel-Vargas et al. in [30] made the first attempt to extract specification automatically. In this work, they implement automated specification extraction in two steps: a subset of the devices capabilities is observed in the network traffic; and based on this observation, an algorithm is used to extract all the devices capabilities from the specification source. Automated specification extraction has also been employed by Sharma et al. in [34] to derive the behaviour rules of IoT device using the operational profile as specification source. And most recently, Olufowobi et al. in [28] exploit real-time schedulability analysis of messages to automate specification extraction.

C. Specification Modelling
Specification modelling describes the modelling approach that is adopted to model the specification extracted from a specification source, to describe the correct system behaviour. This subsection presents the different methods that are currently being used for specification modelling.

1) Specification Modelling Using State-based Approach:
State-based approach is the most common method for specification modelling. There are several variants of the state-based approach currently in use. The standard state machine has been used by Mitchell et al. in [31], [32], [33] for specification modelling where the extracted specification is transformed into state machines. Jeike et al. in [26] employ state machine for specification modelling. In this work, the states of the machine are states of the protocol, and the state transitions are caused by the receptions of BPDUs or expiration of timeouts. Standard state machines have also been deployed by Berthier and Sanders in [27] to capture the expected system behaviour. And Sharma et al. in [34] have converted the extracted specification into state machines for specification modelling.
Another variant of the state-based approach that has been adopted for specification modelling is the finite state machine. Tseng et al. in [12], [15] use finite state machine for specification modelling. They specify the correct AODV routing protocol behaviour using the finite state machine in [12] and describe the valid routing behaviour of a network node based on Optimised Link State Routing (OLSR) protocol in [15]. The extended finite state machine has been applied by Hansson et al. in [13] and by Song et al. in [25] for specification modelling. Gill et al. in [24] utilise state transition model to describe the extracted specification and state transition patterns are employed by Pan et al. in [35] for specification modelling. Also, a sector specific state modelling language referred to as Industrial State Modelling Language (ISML) has been employed in [36] for specification modelling.
2) Specification Modelling Using Bro: Another tool that can be used for specification modelling is the open source Bro network security monitor (now known as Zeek) [37]. McParland et al. in [18] use Bro scripts for specification modelling but the specific details of the communication protocols and technologies are removed to concentrate on the physics models of the devices being investigated. Similarly, the security specifications of DNP3 protocol have been modelled as a parser and integrated into Bro by Lin et al. in [16], [17]. And Esquivel- Vargas et al. in [30] use Bro for specification modelling of the automatically extracted correct system behaviour.
3) Specification Modelling Using NS-2 Simulator: NS-2 stands for Network Simulator Version 2 and it is an opensource event-driven simulator for modelling the dynamic nature of communication networks [38]. Hassan et al. in [14] employ NS-2 simulator for specification modelling. In this work, the extracted specification for the runtime behaviour of AODV protocol is implemented using the NS-2 simulator, which allows the detection of any violations from the correct system behaviour.

4) Specification Modelling Using Real-time Model:
A recent work by Olufowobi et al. in [28] has proposed the use of a real-time model for specification modelling. In this work, CAN traces that describe the normal behaviour of the network is used to extract real-time parameters as the features which represent the desired specification. Then, the real-time model of the CAN is deployed to specify the expected system behaviour and to flag the violations of the model as indications of a compromised network.

D. Detection Mechanism
Detection mechanism refers to the method that can be adopted to ascertain if there is any deviation from the expected system behaviour. Such deviations are flagged as malicious and since it only relies on the defined specification, this approach is able to detect zero-day attacks. We classify the detection mechanism based on the taxonomy suggested in [39] and the recent developments in the field.

1) State-based Detection Mechanism:
Most of the detection mechanism deployed by specification-based intrusion detection techniques for CPS are based on states. The desired state of the system is defined using the specification source that have been extracted and modelled. The goal of the detection mechanism is to detect any deviation from the desired state. For example, Tseng et al. in [12], [15] use a finite state machine for detecting incorrect route request and route reply messages of the AODV routing protocol. They employ predefined finite state machine constraints in [12] which are based on the sourced, extracted, and modelled correct specification; any deviation from these constraints are flagged as malicious. And in [15] the detection mechanism involves checking whether the network node violates the constraints based on the finite state machine.
Mitchell et al. have also used state-based method as detection mechanism in [31], [32], [33]. In these works, they transform the behaviour rules into state machines, which are then used to monitor the system for deviations from the specified system behaviour. Similarly, Berthier and Sanders in [27] use a state machine module to keep track of the state of each device for which traffic is capture, to ensure that stateful constraints are not violated. And Sharma et al. in [34] transforms behaviour rules into a C-language state machine labelled with safe and unsafe states; against which normal and malicious behaviours of the IoT device can be statistically described.
The DNP3 analyser used by Lin et al. in [17], [16] as detection mechanism is based on states. They observed that the DNP3 analyser can maintain states from the parsed network packets and using this states, the incoming packets can be corrected and analysed to ensure there are no violations. Also, Carcano et al. in [36] propose the concept of critical state analysis and state proximity as detection mechanism. They argue that the critical states of a CPS are well documented and that by monitoring the evolution of the physical process states and keeping track of when the CPS enter into a critical state, it is possible to detect attack patterns (known or unknown) likely to drive the CPS into a critical state.
2) Transition-based Detection Mechanism: The detection of malicious behaviour can also be accomplished by monitoring the transition between states. McParland et al. in [18] describes operational protocols using pre-and post-conditions of physical state transitions and any transition that does not lead to a good state is flagged as a potential failure or attack on sensors or actuators. The detection mechanism presented by Gill et al. in [24] used as state transition modelling. In this work, the detection mechanism is achieved by monitoring any anomalous transition in the observed state transition model. And temporal-state transitions are used by Pan et al. in [35] as the detection mechanism. The method adopted in this work involves the monitoring of transition from state to state to detect patterns that are likely to interrupt the protection scheme.
3) Trace-based Mechanism: Trace-based method is another detection mechanism that can be used to monitor deviations from the specified system behaviour. For example, Song et al. in [25] define a set of valid network traces that indicates all finite traces of a network accepted by the specification. They then employ these traces as detection mechanism by monitoring for any trace violating the specification. Olufowobi et al. in [28] use CAN traces as detection mechanism. The CAN traces used in this work depict the normal behaviour of the network, and the detection mechanism involves checking to see if the CAN traces conform with the specification.

4) Other Methods:
There are other methods that can be used as detection mechanism which is neither state-based, transition-based, nor trace-based. One of such method presented by Jieke and Redol in [26] and Hansson in [13] combines the attributes of state-based method and transitionbased method. In this works, the detection mechanism depends not only on the state of the system but also on the transition between states. Another method is the detection mechanism that has been described by Hassan et al. in [14] which involves identifying misuses to routing messages based on the derived specification. Also, Larson et al. in [29] employ a detection mechanism that checks protocol violations by monitoring the ECU object directory for illegal modifications.

E. Detector Placement
In the use of specification-based intrusion detection techniques for CPS, the detector placement strategies can be distributed, centralised, or hybrid (a combination of both the distributed and the centralised detector placement). This type of classification has been used by Zarpelão et al. in [4] to describe the possible placement strategies for intrusion detection systems in Internet of Things. Hence, this subsection presents the three types of detector placement methods that can be used in specification-based intrusion detection techniques for CPS.

1) Distributed Detector Placement:
The use of distributed detector placement is the most desired placement strategy of specification-based intrusion detection for CPS. This is because of the distributed nature of CPS and the need for an IDS which allows every device to be monitored by other devices and ensures there is no single point of failure. For this reason, the use of distributed detector placement in specification-based intrusion detection for CPS has been proposed in [33], [12], [26], [15], [31], [32], [26], [13], [14], [15], [34].
2) Centralised Detector Placement: Centralised detector placement refers to the detector placement where the detector is located at a centralised component, for example, a dedicated host or a network router. This is the strategy employed by most of the survey works [18], [27], [16], [30], [28], [35], [17], [24], [25], [36]. Even though the use of centralised detector placement creates a single point of failure, the ease of its implementation is responsible for its prevalence.
3) Hybrid Detector Placement: Hybrid detector placement is an approach that attempts to combine the benefits of distributed detector placement and centralised detector placement. This approach has been deployed by Larson et al. in [29]. They observe that placing a detector in the network device would make the use of specification-based intrusion detection impossible in CAN environment because it cannot ascertain if the source of the message is allowed to transmit, or if the destination is allowed to receive. As of result of this, they combine distributed detector placement and centralised detector placement to remedy the limitation of centralised detector placement.

F. Validation Strategy
This subsection aims to present the validation strategy that have been employed in the use of specification-based intrusion detection techniques for CPS. Validation is the process of ascertaining if the developed model behaves with acceptable accuracy according to the objectives of the study [40]. To classify the existing validation strategy in the use of specificationbased intrusion techniques for CPS, we use the classification of validation methods proposed by Verendel in [41] namely: hypothetical, empirical, simulation, theoretical, and none.

1) Hypothetical:
Here, hypothetical examples are used for the validation of the proposed techniques. This is the approach that is adopted by Larson et al. in [29] and Tseng et al. in [12]. Larson et al. [29] use hypothetical example where assumption about the capability of an attacker is made. They apply this to a conceptual network model connecting two networks through a common Gateway to validate their proposed specificationbased intrusion detection technique. Similarly, Tseng et al. [12] employ a hypothetical example of how the network monitors trace AODV packets based on the AODV scenario they described to validate their proposed specification-based intrusion detection method.
2) Empirical: Empirical methods have also been used as validation strategy of specification-based intrusion detection for CPS. Berthier and Sanders [27] utilise empirical evaluation and observe that the objectives of such verification are two folds: verifying that the implementation is correct, and measuring the performance of the implementation under various conditions.
Moreover, the validation strategy using simulation may require the development of a specialised tool. This is the approach adopted by Hansson et al. in [13]. They develop a simulation environment in C++ called Aquarius, which is then deployed for the validation of their proposed technique. Wellknown tools have also been deployed as validation strategy. For example, Hassan et al. [14] use NS-2 network simulator, Tseng et al. [15] use GloMoSim simulation platform and Gill et al. [24] use a custom Snort-Wireless preprocessor.
Pan et al. [35] implemented a test-bed to simulate an electric transmission system which they used to validate the specification-based intrusion detection framework proposed in their work. Esquivel-Vargas [30] also simulate a prototype which is implemented using third-party software tools and custom scripts to validate their proposed approach. The validation of the method proposed by Sharma [34] is accomplished using UAV-CPS simulated in MATLAB. And the validation strategy employed by Olufowobi [28] involves the simulation of their proposed method with real CAN logs collected from two passenger cars and on an open-source CAN dataset collected from real-world scenarios.

4) Theoretical:
Theoretical methods as validation strategies involve the use of formal or precise theoretical arguments to support the obtained results. This method has been used by Song et al. in [25] to validate specification-based intrusion detection technique. They utilise ACL2 theorem prover [42] and the enforcement of security requirements is defined and proved as theorems in ACL2.

5) None
: None refers to the papers where no validation methods are deployed. Among the works we surveyed in this paper, only the work by Jieke and Pan [26] falls in this category.

IV. OBSERVATIONS, CONCERNS AND FUTURE RESEARCH DIRECTIONS
We observe from this study that specification-based intrusion detection technique has been applied in several domains of CPS. For example, it has been employed by McParland [18] for monitoring security of networked control systems. Mitchell and Chen [33] have proposed the use of specification-based intrusion detection for safety critical medical cyber physical systems. Also, specification-based intrusion detection has been proposed for monitoring in-vehicle networks by Larson et al. [29] and Oluwofobi et al. [28]. Bertheir and Sanders [27] propose the use of specification-based intrusion detection to monitor traffic at the edge of an advanced metering infrastructure. Other applications of specification-based intrusion detection techniques for CPS include SCADA systems [16], [17], [36], building automation systems [30], mobile ad hoc networks [12], [25], [13], [14], [15], IoT devices [34], power system [31], [35], unmanned air vehicles [32] and wireless local area networks [24].
There are several protocols that have been deployed in the operation of CPS. For this reason, it is natural to see that many of the existing literature of specification-based intrusion detection techniques for CPS involve the monitoring of protocols used in CPS. For instance, CAN protocol which is used for in-vehicle networks has been studied by Larson et al. in [29] and Oluwofobi et al. in [28]. Also, specificationbased intrusion detection has been proposed for monitoring DNP3 protocol [16], [17], [18]. Other protocols that have been considered by the surveyed papers include C12.22 standard protocol [27], BACnet protocol [30], IEEE 801.11 protocol [24], spanning tree protocol [26], OLSR protocol [15], dynamic auto-configurations protocol [25], and AODV protocol [12], [13], [14].
We also note that only the works by Berthier and Sanders [27], Sharma et al. [34] and Song et al. [25] employed formal modelling for the verification of the specified behaviour. The use of formal modelling is an important aspect of specificationbased intrusion detection technique as it enables the verification of the extracted specification. Since specification-based intrusion detection techniques depend on the specified system behaviours, it is imperative that these behaviours represents the correct behaviour of the system and formal modelling provides a tool for such verification. Unfortunately, only a few of the existing literature on specification-based intrusion detection for CPS attempted to verify the derived system specification.
Moreover, we notice that the traditional IDS performance metrics have been used in some of the existing works on specification-based intrusion detection techniques for the evaluation of their proposed technique. Performance metrics are used to measure the performance of IDS. For example, false positive rate has been used in [27], [24], [13], [36], [15] and the combination of false positive rate and false negative rate have been used in [33], [30], [28], [31], [34], [32]. In addition, Lin et al. in [17], [16] use throughput as the performance metric.
One of the biggest concerns in the use of specificationbased intrusion detection techniques for CPS is the efforts and time required for specification extraction. As we have already observed, most of the existing works in the use of specificationbased intrusion detection techniques for CPS employed the manual approach for specification extraction. This method is prone to errors and could jeopardize the intrusion detection ability of the specification-based IDS. Although efforts have been made by Esquivel-Vargas et al. in [30], Olufowobi et al. in [28], and Sharma et al. in [34] to address the problem through the use of automatic specification extraction, it still remains an open research issue.
Another concern when deploying specification-based intrusion detection techniques for CPS is verifying the correctness of the extracted specification. The ability of a specification-based IDS to detect anomalous behaviour depends on how correct the extracted specification represents the normal system behaviour. One of the ways to verify the correctness of the extracted specification is through the use of formal modelling. Out of the 20 works we surveyed, only Berthier and Sanders [27], Sharma et al. [34] and Song et al. [25] have deployed formal modelling for the verification of the correctness of the extracted specification. Thus, future research works need to consider the best methods for verifying the correctness of the extracted specification so as to encourage the practical application of specification-based IDS for CPS.

V. CONCLUSION
In this paper, we presented a survey of specification-based intrusion detection techniques for CPS. We selected 20 papers in the literature that proposed the use of specification-based intrusion detection mechanism for CPS. These papers were published between 2005 and 2020. We proposed a taxonomy to classify these papers, which is based on the following attributes: specification source, specification extraction, specification modelling, detection mechanism, detector placement and validation strategy. We observed that to fully realize the potentials of specification-based intrusion detection techniques for CPS, more work needs to be done in the future to reducing the efforts and time required to extract the system specification and to verifying the correctness of the extracted system specification.


Suppressing Spoof-irrelevant Factors for Domain-agnostic Face Anti-spoofing

Face anti-spoofing aims to prevent false authentications of face recognition systems by distinguishing whether an image is originated from a human face or a spoof medium. We propose a novel method called Doubly Adversarial Suppression Network (DASN) for domain-agnostic face anti-spoofing; DASN improves the generalization ability to unseen domains by learning to effectively suppress spoof-irrelevant factors (SiFs) (e.g., camera sensors, illuminations). To achieve our goal, we introduce two types of adversarial learning schemes. In the first adversarial learning scheme, multiple SiFs are suppressed by deploying multiple discrimination heads that are trained against an encoder. In the second adversarial learning scheme, each of the discrimination heads is also adversarially trained to suppress a spoof factor, and the group of the secondary spoof classifier and the encoder aims to intensify the spoof factor by overcoming the suppression. We evaluate the proposed method on four public benchmark datasets, and achieve remarkable evaluation results. The results demonstrate the effectiveness of the proposed method.

Introduction
Computerized face-recognition techniques [8,13,31,37] have been successfully deployed in a wide range of realworld applications, such as criminal identification and ecommerce systems. Despite its remarkable accuracy, these face recognition systems can erroneously authenticate deceivers as genuine users if the facial images of the genuine users are displayed. Therefore, to ensure the security of face recognition, it is important to devise a way to prevent this error.
Several methods have been proposed to prevent deceptions by capturing faithful spoof factors with the guidance of auxiliary supervisions. These methods utilized a priori knowledge to properly guide the network to capture generalizable cues. [2,19] utilized the fact that spoof medium and genuine faces are distinctively different in terms of facial depth, and exploited pseudo-depth maps as auxiliary super- The spoof and genuine images that share the same SiFs, such as identity, background, and illuminations are visually similar to each other than the two genuine images that do not share the factors. Bottom: In our method, two types of adversarial learning strategies are deployed, hence our method is termed Doubly Adversarial Learning. The first adversarial learning is deployed to suppress SiFs, and samples that share the same SiFs are dispersed as a result. The second adversarial learning is deployed to intensify the spoof factor in the encoded features.
vision. Other methods have been proposed to utilize reflection maps [12] or physiological signals [19] along with the facial depth maps, and achieved notable improvements. Images captured in unconstrained real-world scenarios are largely diverse in terms of spoof-irrelevant factors, such as identities or background patterns, compared to the collected images of the existing datasets. Since it is impossible to collect images by considering every possible combination of these factors, large discrepancies between a training set and real-world data are inevitable. Therefore, it is desir-able to mitigate the effect of such spoof-irrelevant factors, so that the model learns faithful spoof factors independently from spoof-irrelevant factors by using the training datasets that are limitedly diversified.
Here, the term spoof-irrelevant factors (SiFs) indicates the factors that are uninformative and irrelevant to the face anti-spoofing, and at the same time induces visual similarities. For instance, the spoof and genuine images of the same identity may look much similar to each other than the two images of the same class (e.g., spoof or genuine) with different identities. Therefore, if features are naïvely extracted from images without taking the SiFs into account, then the extracted features may be located in accordance with the SiFs, and deterioration of face anti-spoofing accuracy would be yielded ( Figure 1). Some methods [29,30] have been proposed to increase generalization ability by alleviating the effects of SiFs. [29] proposed a method to train a model to achieve invariance to noise patterns incurred by sensory devices. [30] attempted to make a model to be invariant to identities by explicitly disentangling identity features using identity labels. Multiple types of SiFs exist in the face images, however, the existing methods have considered only a single factor, hence not readily generalized.
Our insight is that we need a learning scheme that efficiently suppresses multiple SiFs simultaneously in a way that does not disturb the learning of a spoof factor. Various types of SiFs exist in images, thus reducing the effect of only a single SiF may erroneously guide the network to encode the remaining SiFs as spoof factors. In this regard, it is important that we design the model to be invariant to multiple SiFs. In addition, we aim to build the model to stably suppress multiple SiFs, so that suppression of multiple SiFs does not dominate the overall learning procedure of the encoder, nor weakens the discriminative power of the encoder. To realize our goal, we propose an architecture called Doubly Adversarial Suppression Network (DASN) that suppresses SiFs by adopting a doubly adversarial learning strategy. To consider various types of SiFs, we deploy multiple discrimination heads after an encoder, and adversarial learning is conducted between the discrimination heads and the encoder. Furthermore, our DASN performs additional adversarial learning between the group of the encoder and the secondary spoof classifier, and the intermediate layer of each discrimination head to intensify the spoof factor in the encoded feature. Incorporating the suppression of multiple SiFs is more challenging compared to the suppression of a single SiFs since the training process is hindered by instability. We note that by deploying the second adversarial learning scheme, the overall training process becomes stabilized and the performance is further boosted. The two different adversarial learning procedures are performed comprehensively, hence the overall learning scheme is termed Doubly Adversarial Learning.
The contributions of our work can be summarized as follows: • We propose a DASN, which adopts doubly adversarial learning to effectively suppress the spoof-irrelevant factors, and intensify a spoof factor for enhanced generalization ability.
• DASN achieves the-state-of-the-art performance on various benchmark datasets [5,6,32,36] for domain generalization of face anti-spoofing. Moreover, our extensive ablation studies show that the suppression of SiFs is effectively conducted by adopting our DASN.

Related Works
Face Anti-Spoofing Methods. Face anti-spoofing is becoming increasingly important as concerns about the security of face-recognition systems grow. Many face antispoofing methods have been proposed; early methods used hand-crafted features, such as Local Binary Patterns (LBP) [3,21] or Histogram oriented Gradients (HoG) [15,34] to solve the problem. After the success of deep learning in various tasks, many researchers proposed methods that use deep features [18,22,33], and achieved improvements over the traditional methods. More recently, researchers considered auxiliary information, such as facial depth maps [2], physiological signals [19], and reflection maps [12] to capture discriminative cues that could be universally applied to different domains. The researchers exploited the difference in these auxiliaries between spoof media and real humans (e.g., live humans exhibit physiological signals, whereas spoof mediums do not), and achieved notable achievements by showing improved generalization to unseen domains. However, the existing methods depend on the inaccurate pseudo-labels (e.g., depth maps are limited to facial areas), and the performance is still not satisfactory due to the large variations among different domains.

Domain Generalization Methods.
To address the problems, researchers aimed to tackle the face anti-spoofing in the perspective of domain-generalization to take advantage of multiple seen data [24,26,27]. [26] proposed a multi-adversarial network that aims to enhance the generalization ability to unseen domains by training a generator to learn a feature space that is shared by multiple discriminators pre-trained on different source domains. [27] proposed a method to supervise the network with generalized learning directions by incorporating domain shift scenarios in the meta-learning framework. [24] attempted to learn spatio-temporal features by deploying both the image-based network and video-based network, and utilized class-conditional domain discriminators to further improve the generalization capability. [30] proposed a method  (1) 1 st adversarial learning (red) between an encoder and the discrimination heads to suppress multiple SiFs, and (2) 2 nd adversarial learning (purple) between the group of the encoder and the secondary spoof classifier, and SiF-aware intermediate layers to intensify the spoof factor. that disentangles identity factors to be invariant to an identity. However, [30] has considered only a single number of the spoof-irrelevant factors that can disturb the face antispoofing. In contrast, we fully consider all types of spoofirrelevant factors that can be utilized.

Proposed Method
In this section, we first discuss the spoof-irrelevant factors. Then we introduce a doubly adversarial learning scheme for suppressing spoof-irrelevant factors and intensifying the spoof factor in the encoded features. Finally, we describe a Doubly Adversarial Suppression Network (DASN), which is a spoof classification network that is trained using the proposed doubly adversarial learning.

Spoof-irrelevant Factors
We term the spoof-irrelevant factors as the factors that are irrelevant and uninformative to the face anti-spoofing, and that can incur visual similarity when the same type of SiFs are shared by images. For example, information regarding the facial structure of a subject, or gender is not meaningful in terms of detecting face spoofs, and different images of the same identity would be visually alike to each other ( Figure 1). Hence, the identity of a face is an irrelevant factor. There can be a variety of SiFs, and lack of consideration of these factors can cause difficulties in classifying spoof and genuine images that share the same SiFs.
To avoid this problem, we aim to build a model that learns features that are discriminative for spoof classification, but insensitive to the variations of the SiFs.
Face anti-spoofing databases have been collected under various acquisition scenarios by varying SiFs, such as identities and camera sensors. In order to consider various SiFs, we consider every possible factor that is provided in the form of labels. Among the different types of the SiFs, at most three types of SiFs are commonly provided as labels from each database: (1) identities of each face, (2) environments (i.e., conditions of illuminations and backgrounds), and (3) sensors (i.e., types of cameras) ( Table 1). In our method, the adversarial learning between an encoder and multiple discrimination heads is conducted to suppress the SiFs.

Spoof-irrelevant Factors Suppression
We introduce the first adversarial learning scheme that suppresses spoof-irrelevant factors, so that the trained model becomes invariant to them. In this learning scheme, an encoder and multiple discrimination heads are adversarially trained, and SiFs are suppressed in the encoded features ( Figure 2).
Spoof Classification. We are given a set X of images, a corresponding set Y of spoof class labels, and a corresponding set F k of labels of each SiFs, where k is a SiF in a set K = {identity, environment, sensor}. Here, the entire spoofing network consists of an encoder E and a spoof classifier C (Figure 3). Given an image and its corresponding label (x, y) ∼ (X, Y ), the encoder E and the spoof classifier C are trained to predict whether the image is spoof or genuine; each does this by minimizing the following spoof classification loss: where σ denotes a softmax function. Training the network solely with the spoof classification loss leads to degraded results, and we hypothesize that this degradation is a result of features that are entangled with SiFs.
Spoof-irrelevant Factors Suppression. We introduce a new learning scheme that makes the model focus on the spoof factor by discarding SiFs, so that accurate face antispoofing is conducted. In the learning scheme, we deploy multiple discrimination heads that consist of a SiF-aware intermediate layer I k and a discriminator D k where k corresponds to each of the SiFs in K (Figure 3). Each discriminator classifies the corresponding SiF from the encoded fea-
-Minimize the spoof classification losses.
-Maximize the secondary spoof classification loss.  Figure 3: Overview of DASN; the network is trained by our doubly adversarial learning in two step. In the first learning step, the encoder, the spoof classifier, and the secondary classifier strive to suppress SiFs and intensify the spoof factor in a collaborative way [28]. A GRL reverses the sign of the gradients so that the encoder is updated in a way that suppresses SiFs. In the second learning step, the discrimination heads learn to suppress the spoof factor and classify SiFs; the SiF-aware intermediate layer I k and the discriminator D k are updated with another GRL to suppress the spoof factor in I k . In each stage, only the blue-colored parts are updated. As the training progresses, the discrimination heads gradually diverge, and DASN successfully suppresses the three SiFs: k ∈ {identity, environment, sensors}, and the spoof factor is intensified as the encoder overcomes the spoof factor suppression.
tures by minimizing SiF classification loss: where f k is a Sif label that corresponds to x, and 1 [n=f k ] is an indicator function which equals to 1 if n = f k and 0 otherwise. N k denotes the number of classes in each type of spoof-irrelevant factor ( Table 1). As an opponent of the discrimination heads, the encoder is adversarially trained to maximize the loss with the objective of suppressing SiFs. This learning scheme is interpreted as the following adversarial procedure: where I and D denotes a set of I k and a set of D k for all SiFs in K, respectively. The maximization process of the encoder is implemented by using a gradient reversal layer (GRL) [9] that is inserted in between the encoder and each of the discrimination heads (Fig 3). The GRL acts as an identity function during the forward propagation, and reverses the sign of gradients by multiplying −1 during the backpropagation. If SiFs are abundant in the encoded features, the discriminators can easily distinguish the SiFs by using the encoded features with small error. Hence, for the encoder to maximize the loss, the encoder strives to suppress the SiFs during the feature-encoding process. We observe that as the network is successfully trained, the SiF classification losses gradually diverge; this trend implies that the discriminators fail to classify the SiFs from the encoded features, and that the encoder succeeds in suppressing the SiFs so that the encoded features become invariant to the SiFs.

Doubly Adversarial Learning
The first adversarial learning alleviates the effects of SiFs in the encoded features, however, it may cause the encoder to lose discriminative power since the SiF suppression procedure does not guarantee the features to be discriminative in terms of spoof detection. Also, the overall learning of the encoder can be dominated by the SiF suppression procedure since the encoder has to compete against multiple discrimination heads. In order to address the problem, we deploy an additional learning strategy. Along with the spoof classification loss (Eq. 1), this learning scheme guides the encoder to learn more discriminative features, and the encoder can be strengthened with intensified spoof factors. In this learning scheme, the group of the encoder and the secondary classifier is adversarially trained against each of the intermediate layers of the discrimination heads ( Figure 2) Secondary Spoof Classification. We deploy a secondary spoof classifier S after each of the SiF-aware intermediate layers (Figure 3). The objective of the secondary spoof classifier is to minimize the secondary spoof classification loss which is defined as: (E(x))))) + y log(σ(S(I k (E(x))))) . (4) In contrast, each of the intermediate layers is adversarially trained to maximize this loss with the objective of suppressing the spoof factor. Thus, this learning scheme is interpreted as the following min-max procedure: By adopting this learning scheme, the encoder is adversarially trained to overcome the suppression of the multiple SiF-aware intermediate layers, so the spoof factor of the encoded features can be intensified, and the encoder is collaboratively [28] trained on varied gradients from each SiFaware intermediate layer.
Doubly Adversarial Learning. The overall learning process involves two different adversarial learning processes, so we call it a Doubly Adversarial Learning. The full objective is summarized by aggregating the defined losses with corresponding weight terms, λ k sif , for each k in K, and is written as: where Eq. 6 is a min-max procedure to suppress SiFs, and Eq. 7 is a min-max procedure to intensify the spoof factor.

Doubly Adversarial Suppression Network
We propose DASN to realize the introduced learning scheme; it learns complex objectives that are in opposition to each other, so we divide the overall learning scheme into two steps (Figure 3).
Step 1: Update Encoder and Spoof Classifiers. We train the encoder E, the spoof classifier C, and the secondary spoof classifier S. E and C are updated by minimizing the spoof classification loss (Eq. 1). E is also trained to maximize the SiF classification loss (Eq. 2) at the same time. In this way, E is trained to suppress the SiFs and to encode features that are informative for the spoof classification. To suppress SiFs by maximizing the SiF classification loss, the GRL is inserted in between the encoder and each

Datasets and Metrics
We train and evaluate the proposed method using four public benchmark datasets (Table 1) Metrics. We evaluate the proposed method by following the same evaluation protocols [27,30] of the existing methods; one of the datasets is selected as a testing set, and the remaining three are utilized as training sets. Therefore, four evaluation tasks are possible: O&C&I to M, O&M&I to C, O&C&M to I, and I&C&M to O. We report the performance of the proposed method by using Area Under the Curve (AUC) and Half Total Error Rate (HTER) = (False Acceptance Rate+False Rejection Rate)/2 [1].

Experimental Setup
We use all frames of all the videos to train and test our method. For each frame, we locate face regions by using a face detector [17], then the located regions are cropped and resized to 256 × 256. As a backbone network, we use ResNet-18 [11] that is pre-trained on ImageNet [7]. We use Xavier initialization [10] to initialize the parameters of layers that are not a part of the pre-trained network. We apply global average pooling to the output feature map of the backbone network to obtain vectorized features of 512dimensionality. Except for the last fully connected (FC) layers, every other FCs are followed by a ReLU activation function, and the number of their hidden nodes is 512. We train the network using a constant learning rate of 10 −5 with the Adam optimizer [14] on a single NVIDIA V100 GPU. The weight terms λ k sif are simply selected by observing the initial loss values to balance the loss values in the similar scales; e.g., we use 0.05 for λ identity sif , 0.08 for λ environment sif and 0.08 for λ sensor sif on O&C&I to M. We set the size of a mini-batch to 32 on the I&C&M to O task, and 64 on the remaining three tasks.

Ablation Studies
We demonstrate the effectiveness of the proposed method by conducting extensive ablation studies. In this ablation studies, all the models also are based on ResNet-18; the baseline model is trained solely with the spoof classification loss. Spoof-irrelevant Factors Suppression. The performance of models can be significantly improved by suppressing SiFs because these factors can disturb face anti-spoofing (Table 4). Especially, among the SiFs, it is shown that suppressing the identity factor can be most effective, as the performance improvements over the baseline are largest, except for the O&C&I to M task. Doubly Adversarial Learning. We also compare the performance of the models by varying the combinations of the suppressed SiFs (Table 4). We observe that the increase in the number of SiFs does not guarantee the improvements in performance, and some even show degraded results compared to the ones that consider the less number of SiFs. This observation implies that as the number of the discrimination heads that the encoder competes against increases, the encoder can be disturbed by the discrimination heads, and the spoof factor in the encoded features can be suppressed. By deploying the doubly adversarial learning scheme, the model stably incorporates the multiple SiFs as the proposed DASN explicitly intensifies the spoof factor in the encoded  features, and the collaborative learning [28] behavior also contributes to the improved results.
ASN d vs. DASN. To distinguish our method from the conventional approach of domain generalization [9], we compare our DASN and ASN d , which uses domain information as a SiF and is trained by the 1 st adversarial learning scheme (Table 4). DASN shows enhanced generalization ability than ASN d and this implies that DASN more delicately removes the factors that interfere with the face antispoofing.

Discussion
Grad-CAM Visualization. We present a visualization of Gradient-weighted Class Activation Mapping (Grad-CAM) [25] that produces a localization map highlighting important regions for predicting the classes, so that more insights on how the proposed network makes decisions can be obtained ( Figure 4). The visualized results show that the attended regions can be diversified, even if the spoof and gen- uine images share the same SiFs, and this observation supports that our method is insensitive to the SiFs.
In addition, we observe that for spoof images, the attended regions are diversely located in the image, whereas the regions are consistently attended on facial areas for the genuine images. This trend implies that the clues for dis-  Figure 5: Visualization of our method on the evaluation task by t-SNE [20] depending on spoof factor and three SiFs. Each color represents each class of the spoof factor and SiFs.
criminating spoof images are more diversely located than the clues for the genuine images.
t-SNE Visualization. We visualize the distributions of the output features of DASN by using t-SNE [20] ( Figure 5). It is shown that the output features of DASN are more clearly clustered for the spoof factor. Compared to the output features baseline model, the output features of the DASN are more dispersed, even though they share the same SiFs, and this trend is most distinguished for identity. This implies that the proposed method is effective in suppressing the SiFs, and intensifying the spoof factor.

Conclusion
In this paper, we propose a DASN that adopts a doubly adversarial learning scheme to improve generalization capability for face anti-spoofing. In our learning scheme, the encoder is trained against multiple discrimination heads to maximize the SiF classification loss, with the objective of suppressing the SiFs in the encoded features. In addition, the encoder is trained to learn the intensified spoof factor by involving additional adversarial learning, where the encoder aims to minimize the secondary spoof classification loss with the objective of overcoming the suppressions of SiFaware intermediate layers. The extensive empirical evaluation results on public benchmark datasets demonstrate the effectiveness of our proposed method.