A novel anomaly detection approach based on ensemble semi-supervised active learning (ADESSA).

•ADESSA detects attacks in CPS when traffic is rare labeled, unbalanced and unknown attacks exist.•ADESSA builds a balanced training set including high-information and low-information samples with limited budget.•Adding low-information but correctly labeled samples is effective for training when the training data is insufficient.