Abstract:To address the challenges of low detection accuracy and difficulty in attack domain localization caused by limited sample availability in cross-domain APT attack detection for industrial internet, a detection model named APTL-IDS is proposed for industrial control systems. The model converts traffic features from both the network and physical domains into RGB images and applies bilinear interpolation to standardize resolution, enabling effective cross-domain data fusion. Furthermore, deep critical features are extracted using pretrained VGG16, ResNet50, and Inception-V3 models, enhancing intrusion detection classification accuracy while reducing dependence on large-scale datasets. An ensemble model based on the average confidence strategy is constructed, and TPE algorithm is employed for hyperparameter optimization to improve detection accuracy and robustness. Experimental results on the CTU-13 and M2M public datasets demonstrate that the proposed model effectively distinguishes attacks originating from different domains and achieves 99.9% accuracy, precision, and F1-score, validating its effectiveness in cross-domain APT attack detection.