# ResADM: A Transfer-Learning-Based Attack Detection Method for Cyber-Physical Systems
## 5 Conclusions and Discussion  
This study introduced ResADM, a network attack-detection method based on transfer learning that aimed to address several challenges in network-attack detection, including data class imbalance, feature selection in high-dimensional data, and weak model-generalization capability. To tackle the issue of data class imbalance, intentional sampling was utilized to construct sample sets with balanced attack categories, effectively addressing the challenge of imbalanced attack categories in large-scale traffic datasets. Furthermore, an importance-based feature-selection method was developed to extract key features of network attack behaviors, addressing the difficulty in identifying attack features. Lastly, a transfer learning model network structure was designed, and a robust network-attack detection model was established by pre-training on the UNSW-NB15 dataset and optimizing the training parameters of the source model. Simulation experiments were conducted on the CICIDS2017 dataset, and promising results were obtained. The experiments demonstrated that ResADM effectively balanced data categories, extracted 32-dimensional attack-behavior features, and achieved a high network-attack-detection accuracy of up to 99.95%. As a result, this research holds significant practicality and feasibility. However, this study had certain limitations that should be acknowledged. Firstly, the constantly evolving landscape of cyber-attacks has introduced new methods that may not have been adequately represented in outdated datasets. Thus, further validation is necessary to assess the effectiveness of our model against the latest cyber-attack techniques. Additionally, deep-learning models impose significant demands on server performance, so while we endeavored to streamline our model, it requires further validation to evaluate its performance in the face of large-scale DDoS attacks characterized by extensive flooding. To overcome these limitations and enhance the overall robustness of ResADM, it would be beneficial to broaden the range of experiments and validate the proposed method using additional datasets. This could involve incorporating recently collected data that encompasses a wider range of cyber-attack scenarios. Moreover, comparing the transfer-learning-model network structure with other architecture would enable the selection of \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Methods** & **Accuracy** & **Precision** & **Recall** & **F1-Score** \\ \hline ResADM & 0.9998 & 0.9999 & 0.9999 & 0.9999 \\ CNN & 0.9967 & 0.9967 & 0.9967 & 0.9967 \\ DNN & 0.9977 & 0.9977 & 0.9975 & 0.9976 \\ LSTM & 0.9958 & 0.9951 & 0.9951 & 0.9951 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Results of comparative experiments. the most suitable model for the given problem. Conducting further research on parameter optimization could also contribute to enhancing the effectiveness of the proposed method. Conceptualization, H.W. and L.Z. ; methodology, Y.W. ; software, H.Z. ; validation, Y.W., H.Z. and J.D. ; writing--original draft preparation, H.Z. ; writing--review and editing, L.Z. and H.W. ; visualization, Y.W. ; supervision, J.D. All authors have read and agreed to the published version of the manuscript. This work was funded by the National Natural Science Foundation of China (No. 62106053). Not applicable. The data are available from the corresponding author on reasonable request. The data are not publicly available due to privatcy. We are extremely grateful to the editors and the anonymous reviewer for their valuable comments and suggestions. The authors declare no conflict of interest. The following abbreviations are used in this manuscript: